Backdoor-Assisted Info Leak (Recursive Self-Leak)
- •
What it is
- •
Trigger another invocation of a vulnerable function so its diagnostic output reveals the running process's canary or addresses before the final payload is sent.
- •
- •
How it works
- •
Find a trigger that re-enters the function before the outer invocation reaches its checks.
- •
Use the extra invocation to read any diagnostic canary or address values. Keep them tied to the same running process.
- •
Build the final input for the correct frame using those values and independently verified offsets.
- •
Trigger re-entry → inspect diagnostics → build payload for the current process The outer frame remains active; its checks still matter if execution returns there.
- •
- •
When to use it
- •
Look for a repeat/re-entry input and determine where it occurs relative to the function epilogue.
- •
Useful when both a canary and PIE complicate a write, and diagnostics reveal the missing values.
- •
Confirm the extra invocation actually prints useful secrets; recursion alone is not a disclosure.
- •
Reverse-engineer the trigger and output path instead of assuming every repeat feature supplies a leak.
- •
- •
Examples
- •
Send
REPEATto enter another challenge call, read its printed canary and target address, then use those values in that process's next payload.
- •
- •
pwntools
- •
payload = b'A' * canary_offset + p64(canary) payload += b'B' * gap_to_return + p64(target) # canary and target come from this process's diagnostic output.
- •
- •
Debugging
- •
b challenge bt # Confirm re-entry before the outer frame returns.
- •
- •
- •
Cards
- •
Does recursive re-entry automatically bypass the outer frame’s canary check?
- •
No. It postpones that check while the child runs. If execution returns through the outer frame, its guard must still be valid.
- •
- •
What two normally-separate problems (in a canary-enabled, PIE-enabled binary) can a single recursive self-leak solve at once?
- •
The exact canary value (avoiding brute force) and the exact runtime address of a PIE-randomized target (avoiding nibble guessing) — both are constant for the process's life and both get disclosed by the same harmless first round.
- •
- •