Skip to main content

x64 Canaries

Dans cet exercice, nous allons comprendre ce que sont les protections "canary".

Les canaries sont des entiers, longs et aléatoires, qui permettent de vérifier que la stack n'a pas été écrasée. En chargeant notre binaire dans r2, nous pouvons observer ce canary :

r2 -AAAA pwn107-1644307530397.pwn107
WARN: Relocs has not been applied. Please use `-e bin.relocs.apply=true` or `-e bin.cache=true` next time
INFO: Analyze all flags starting with sym. and entry0 (aa)
INFO: Analyze imports (af@@@i)
INFO: Analyze entrypoint (af@ entry0)
INFO: Analyze symbols (af@@@s)
INFO: Analyze all functions arguments/locals (afva@@@F)
INFO: Analyze function calls (aac)
INFO: Analyze len bytes of instructions for references (aar)
INFO: Finding and parsing C++ vtables (avrr)
INFO: Analyzing methods (af @@ method.*)
INFO: Recovering local variables (afva@@@F)
INFO: Type matching analysis for all functions (aaft)
INFO: Propagate noreturn information (aanr)
INFO: Scanning for strings constructed in code (/azs)
INFO: Finding function preludes (aap)
INFO: Enable anal.types.constraint for experimental type propagation
INFO: Reanalyzing graph references to adjust functions count (aarr)
INFO: Autoname all functions (.afna@@c:afla)
[0x00000780]> pdf @main
            ;-- main:
            ; ICOD XREF from sym._start @ 0x79d(r)
┌ 243: sym.main ();
│ afv: vars(3:sp[0x10..0x48])
│           0x00000992      55             push rbp
│           0x00000993      4889e5         mov rbp, rsp
│           0x00000996      4883ec40       sub rsp, 0x40
│           0x0000099a      64488b0425..   mov rax, qword fs:[0x28]
│           0x000009a3      488945f8       mov qword [canary], rax
│           0x000009a7      31c0           xor eax, eax
...
[0x00000780]> db 0x00000a14
[0x00000780]> db 0x00000a19
[0x00000780]> ood
INFO: File dbg:///home/arthur/case/pwn107-1644307530397.pwn107 reopened in read-write mode
[0x7b69e6d75440]> dc
       ┌┬┐┬─┐┬ ┬┬ ┬┌─┐┌─┐┬┌─┌┬┐┌─┐
        │ ├┬┘└┬┘├─┤├─┤│  ├┴┐│││├┤
        ┴ ┴└─ ┴ ┴ ┴┴ ┴└─┘┴ ┴┴ ┴└─┘
                 pwn 107

You are a good THM player 😎
But yesterday you lost your streak 🙁
You mailed about this to THM, and they responsed back with some questions
Answer those questions and get your streak back

THM: What's your last streak? INFO: hit breakpoint at: 0x594910600a14
[0x594910600a14]> dc
%15$lX
INFO: hit breakpoint at: 0x594910600a19
[0x585ed0000a14]> pxr @ rbp - 0x8
0x7ffc42d6e588 0x7a421eb3f6ad9200   ......Bz
0x7ffc42d6e590 0x0000000000000001   ........ @ rbp 1
0x7ffc42d6e598 0x00007c0774308ca8   ..0t.|.. /usr/lib/x86_64-linux-gnu/libc.so.6 library R X 'mov edi, eax' 'libc.so.6'
0x7ffc42d6e5a0 0x00007ffc42d6e690   ...B.... [stack] stack R W 0x7ffc42d6e698
...

Et nous découvrons donc notre canary : 0x7a421eb3f6ad9200

Back to top