EXPLOITING A BLIND FORMAT STRING VULNERABILITY IN MODERN BINARIES: A CASE STUDY FROM PWN2OWN IRELAND 2024

Summary from the TLDR InfoSec newsletter

This post explains how an exploit was developed to gain write access to the stack by manipulating a looping pointer and creating a double stack pointer. The exploit involved constructing a Return-Oriented Programming (ROP) chain within the stack frame of a vulnerable function using format string techniques. The final steps of the exploit involved adjusting the stack pointer to execute the prepared ROP chain, ultimately leading to the successful exploitation of the blind format string vulnerability.