Okay.
Welcome back to Introduction to explain zero day discovery and development.
And here we are going to cover coronary bypasses and the basics of compile collection stack guard.
So stack injuries are also known as stack cookies and they are one of the earliest mitigations for buffer
overflow attacks.
Basically the stack canary is a dynamically generated value, which is then place between the point
where the buffer is being overflowed to the instruction pointer.
A stack check function is actually executed to check whether the canary is the same value and if it
is not the same value, it actually exits with stack smashing detected as an error.
So there are many methods to bypass this.
However, if you are dealing with a stack canary, you cannot land a drop chain because you will not
be able to reach an instruction pointer without bypassing the canary.
So we are going to confront the basic Terminator Canary type, which often ends with a bite of a known
value, such as a null byte or a hex F or something like that.
So stack canary bypass methodologies.
Now on Windows, we actually did use a methodology that could bypass stack entries on Windows, and
it's called a structured exception handler overwrite.
So you overwrite the stack in such a way that it actually causes a memory access violation, which triggers
the exception.
Handler And now we can exploit and overwrite the structure exception handler chain totally to get code
execution.
This was covered in our structure.
Exception Handler overwrite a Unicode exploit module.
The second method is indirect calls so you can store indirect calls or functions in some place in the
stack and manually call it to bypass the canary without having the canary being evaluated.
But the most common method is to brute force or leak the canary and repair it before it gets evaluated.
I just want to point out that the last all stack entries are dynamically generated.
So that means that each time at runtime the Canaries are always a different value.
So we will use the last option because it's a very well known method that works on multiple platforms.
Oh, my God.
Leaking the stack narrative format during specified attacks.
So programming bugs.
Let me turn off my phone.
Programming bugs often allow the leakage of memory addresses arbitrary values, including those of stack
canaries.
These are known as format string bugs or format string vulnerabilities.
Stack canaries are dynamically generated runtime meaning the value is different each time you run it,
like I keep mentioning.
So in this link right here, you can actually check out what is a format string attack.
Basically format string bugs are different and depending on what kind of format strings you can print
them as decimal hacks, you can print up values of the stack, you can leak up the base address for
windows exploits to bypass outer space layout randomization.
But that's not the Esler bypass method for Linux.
However, right now we're just fixated on bypassing the stack canary.
So in this section, our Stack Canary bypass, after we leak the stack canary of a format string bug,
remember it's actually dynamically generated.
We ingest and repair the canary between the point where the buffer begins to overflow to return instruction
pointer.
We then land our basic rope chain the previous exercise to obtain code execution and a shell.
This will be the first time they will extensively use power tools because of the features that greatly
conveniences exploit development, building wrap chains and interacting with spawn shells.