Hello everyone. Mirrai here.

If you read my last post on Return-Oriented Programming (ROP), you probably noticed a small detail in the vulnerable C code I provided. I left printf(username) in the binary and said, "We aren't exploiting that today though. That is a topic for another write-up."

Well, here we are.

1. What is a Stack Canary?

In general we have been doing stack exploitation. This will only work if the stack in question doesn't have a tripwire which is a exactly what a stack canary is. For those unaware the name comes from back went miners would put a canary bird in a mine. If the bird died it served as an early warning that the cave was bad. The concept is similar here. If the stack canary is overwritten then something has gone wrong.

The stack canary itself is a random 64-bit value placed directly between your local variables and the saved return address. First the compiler will add a stub that generates the canary on a given function stack.…