Format String %n Write-What-Where
reverse · hard · +50 XP
Target
POST /api/lab/format-string-101/log body {format} (printf-style logger; supports %d %s %n)
GET /api/lab/format-string-101/state (shows current privilege byte: 0=user, 1=admin)
GET /api/lab/format-string-101/loot (flag iff privilege byte == 1)
Goal: the logger evaluates a Python-printf-like format string. %n writes the number of bytes printed-so-far into a target address — in our sim, into state.privilege_byte. Craft a format string that uses field widths (%1c%n etc.) to set the byte to exactly 1, then call /loot.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/format-string-101/
// reuse on the cli
// submit flag
// no solves yet