Generic Format String Vulnerability - Active Check

# SPDX-FileCopyrightText: 2002 Michel Arboi
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.11133");
  script_version("2026-05-08T16:04:57+0000");
  script_tag(name:"last_modification", value:"2026-05-08 16:04:57 +0000 (Fri, 08 May 2026)");
  script_tag(name:"creation_date", value:"2005-11-03 14:08:04 +0100 (Thu, 03 Nov 2005)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_name("Generic Format String Vulnerability - Active Check");
  script_category(ACT_DESTRUCTIVE_ATTACK);
  script_copyright("Copyright (C) 2002 Michel Arboi");
  script_family("Gain a shell remotely");
  script_dependencies("find_service.nasl");
  script_require_ports("Services/unknown");

  script_xref(name:"URL", value:"https://web.archive.org/web/20020602182103/http://www.guardent.com/rd_whtpr_formatNewsham.html");
  script_xref(name:"URL", value:"https://web.archive.org/web/20031231144716/http://www.securityfocus.com/archive/1/81565");

  script_tag(name:"summary", value:"The remote service might be vulnerable to a format string
  vulnerability.");

  script_tag(name:"vuldetect", value:"Sends a crafted format string and checks if the service is:

  1. no longer responding

  2. failing to respond  with a four char long hex string to an initial standard request, but
  responding with one to a subsequent format string request.

  Note: Those checks might not be fully reliable depending on environmental factors. Please create
  an override for this result for such cases as expressed via the already lower quality of detection
  (QoD) value.");

  script_tag(name:"insight", value:"An attacker may use this flaw to execute arbitrary code on this
  host.");

  script_tag(name:"solution", value:"Update the software or contact the vendor and inform it of this
  vulnerability.");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"remote_analysis");

  exit(0);
}

include("port_service_func.inc");

port = unknownservice_get_port(nodefault:TRUE);

if(!soc = open_sock_tcp(port))
  exit(0);

send(socket:soc, data:"xxxxxxxxxxxxxxxxxxxxxxxxxx");
r1 = recv(socket:soc, length:256, min:1);
close(soc);

if(!soc = open_sock_tcp(port))
  exit(0);

flag = TRUE;
if(egrep(pattern:"[0-9a-fA-F]{4}", string:r1))
  flag = FALSE;

send(socket:soc, data:crap(length:256, data:"%#0123456x%04x%x%s%p%n%d%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%04x%%#0123456x%%x%%s%%p%%n%%d%%o%%u%%c%%h%%l%%q%%j%%z%%Z%%t%%i%%e%%g%%f%%a%%C%%S%%04x"));
r2 = recv(socket:soc, length:256, min:1);
close(soc);

soc = open_sock_tcp(port);
if(!soc) {
  report = "The service stops responding after receiving an excessively long format string request, indicating that it is affected.";
  security_message(port:port, data:report);
  exit(0);
}

close(soc);

if(flag && egrep(pattern:"[0-9a-fA-F]{4}", string:r2)) {
  report = "The service failed to return a four-character hex string on the first standard request, but returned one on the second format string request, indicating it is affected.";
  security_message(port:port, data:report);
  exit(0);
}

exit(99);