All right, so let's record it again.
So we're going to do something else to teach you about stat canaries.
Since about maybe like five years ago, they had a thing called stack guard.
So in this new exercise, let me just show you how to actually get this binary.
Let me see.
So what you want to do is pseudo docker pull gcr io slash task seven slash TPS dash punisher latest.
Now.
I already have it, so my image is up to date.
Remember, if you have trouble actually downloading these doctor images, make sure you track your VPN
for some reason.
GitHub and Docker.
They don't like VPNs.
I don't know.
It's the new age, you know, like they don't want you to have any privacy at all.
So turn off your VPN just to get your doctor images.
And then from that point on, go ahead and run them.
Just turn your VPN back on.
So to run this, just run the command Docker, run double dash, arm, dash it for interactive double
dash privilege dash p redirect port 2 to 2, 2 to 22.
And then the image and then then.
BASH Now, I want to tell you something that if you did not yet restart your Docker, Damon is probably
bound to your previous exit of container.
So what you want to do if you ran into any errors is sudo service docker restart and now you can S-H
back into this image.
So I want to show you stuff about what a stack canary is.
So a stack canary is basically a comes from stack guard from the new compile collection was the GCC.
And to prove you that there's a stack canary, it actually throws an error.
So we're going to do is we're going to S-H into our PO box.
CTF local host dash two, two, two.
Your password is always going to be player and then going to run t marks and then we're going to make
a payload.
So let's bash your moment binaries there.
So we're going to run python 3-c print.
Flights a times 1000 just to prove something.
Let's pipe it into the payload and then we're going to run.
Von Read payload stack smashing, detected terminated.
So since maybe around five years ago, a lot of Linux compile binaries have stack smashing protection,
which means that the previous exploits that have done in the first part of the course with our first
PO box would not work anymore if the compile of the person that wrote the program is any smarter.
So I also have another example binary that leaks the stack canary because the secondary always changes,
but it's stack there is always changes.
But the echo, this dash end workout, see its 16 characters in length.
Each byte is two characters that's eight byte long.
But if you run this again and again and again, notice that the stack canary actually ends in a no byte.
So what we are going to do in this exercise is that we are going to enumerate the stack canary.
Now, I didn't have much time, but I will pass this up with a preceding video on how to fuzz and look
for the stack in order to leak it.
So before we do that, let's just check that Islah is still disabled.
Old, long, over and over again.
Same addresses.
Good.
All right.
So now that we know how to actually trigger the bug, which is this argument right here, a percentage,
$33 sign, two L's and X, we're going to leak the canary before we begin repairing it.
So we're going to do is going to copy this and we got by and I already had this done by going to do
python three link canary dot py and as you can see it changes.
So the goal is is that you have to change and basically dynamically repair the canary in our exploit
and then continue with our drop chain because we can't.