Bluehammer Vulnerability Poc

作者 reason-machines2384a003145a无许可证83 个星标收录于 2026年10月8日更新于 2026年10月8日仓库3个月前更新

Skill for working with the BlueHammer vulnerability proof-of-concept repository, covering build, usage, and code patterns.

仅含说明Security

AI 生成的概览

指导在隔离实验环境中构建、运行和分析 BlueHammer C 语言漏洞概念验证程序。

功能: 该技能提供获取、构建、运行和调试 BlueHammer C 语言漏洞概念验证仓库的说明。内容涵盖 PGP 签名验证、GCC 编译参数、载荷构造，以及使用 GDB、strace 和 pwntools 进行调试。它还列出了当 PoC 无法正常工作时需要排查的常见 C 语言编码缺陷。
适用场景: 适用于处理 BlueHammer 概念验证仓库的场景，例如构建或运行它、理解其代码，或排查无法正常工作的漏洞利用程序。仅限在获得授权的隔离实验环境中使用。
运行要求: 需要 BlueHammer 仓库、GCC 等 C 编译器，可选需要 GDB、strace、ltrace、binutils、pwntools、Docker 以及用于签名验证的 GnuPG。克隆仓库和获取 PGP 密钥需要网络访问。该技能不附带任何脚本。

BlueHammer Vulnerability PoC

Skill by ara.so — Daily 2026 Skills collection.

⚠️ Important Notice

BlueHammer is a proof-of-concept vulnerability repository intended for security research, education, and defensive purposes only. Use only in authorized, isolated lab environments. The author notes there are known bugs in the PoC that may prevent it from working as-is.

What BlueHammer Does

BlueHammer is a C-based proof-of-concept demonstrating a specific vulnerability. The repository is primarily a research artifact — it documents the vulnerability, provides a PoC exploit, and is signed with a PGP key for authenticity verification.

Getting the Code

Verify PGP Signature (Recommended)

The README is PGP signed. To verify authenticity:

bash

# Import the author's key (key ID from signature: FFoRCS0/SbA)gpg --keyserver keys.openpgp.org --recv-keys 494EF01FFC059584028479BEC5168442 4B4FD26C
# Verify the signed block in README.mdgpg --verify README.md

# Import the author's key (key ID from signature: FFoRCS0/SbA)gpg --keyserver keys.openpgp.org --recv-keys 494EF01FFC059584028479BEC5168442 4B4FD26C
# Verify the signed block in README.mdgpg --verify README.md

Building the PoC

Since the project is written in C with no build system documented, standard patterns apply:

Single-file build

bash

# If there is a single main source filegcc -o bluehammer bluehammer.c -Wall -Wextra
# With debug symbols for analysisgcc -g -O0 -o bluehammer_dbg bluehammer.c -Wall -Wextra
# If the project uses a Makefilemakemake clean && make

# If there is a single main source filegcc -o bluehammer bluehammer.c -Wall -Wextra
# With debug symbols for analysisgcc -g -O0 -o bluehammer_dbg bluehammer.c -Wall -Wextra
# If the project uses a Makefilemakemake clean && make

Common C build flags for vulnerability PoCs

bash

# Disable mitigations for testing (lab only)gcc -o bluehammer bluehammer.c \    -fno-stack-protector \    -z execstack \    -no-pie \    -Wall
# With address sanitizer for debugging crashesgcc -o bluehammer bluehammer.c \    -fsanitize=address \    -g -O1

# Disable mitigations for testing (lab only)gcc -o bluehammer bluehammer.c \    -fno-stack-protector \    -z execstack \    -no-pie \    -Wall
# With address sanitizer for debugging crashesgcc -o bluehammer bluehammer.c \    -fsanitize=address \    -g -O1

Running the PoC

bash

# Basic execution./bluehammer
# With a target argument (common pattern)./bluehammer <target>
# With verbose/debug output if supported./bluehammer -v <target>
# Check usage/help./bluehammer --help./bluehammer -h

# Basic execution./bluehammer
# With a target argument (common pattern)./bluehammer <target>
# With verbose/debug output if supported./bluehammer -v <target>
# Check usage/help./bluehammer --help./bluehammer -h

Code Patterns — Working with C Vulnerability PoCs

Reading and understanding the vulnerability trigger

#include <stdio.h>#include <stdlib.h>#include <string.h>
// Common pattern: controlled buffer to trigger the conditionvoid trigger_vulnerability(const char *input, size_t len) {    char buf[256];    // Inspect what the PoC does with input    memcpy(buf, input, len);  // potential overflow if len > 256    // ... vulnerability logic}
int main(int argc, char *argv[]) {    if (argc < 2) {        fprintf(stderr, "Usage: %s <payload>\n", argv[0]);        return 1;    }    trigger_vulnerability(argv[1], strlen(argv[1]));    return 0;}

#include <stdio.h>#include <stdlib.h>#include <string.h>
// Common pattern: controlled buffer to trigger the conditionvoid trigger_vulnerability(const char *input, size_t len) {    char buf[256];    // Inspect what the PoC does with input    memcpy(buf, input, len);  // potential overflow if len > 256    // ... vulnerability logic}
int main(int argc, char *argv[]) {    if (argc < 2) {        fprintf(stderr, "Usage: %s <payload>\n", argv[0]);        return 1;    }    trigger_vulnerability(argv[1], strlen(argv[1]));    return 0;}

Analyzing the PoC for bugs (author noted known bugs)

// When inspecting the PoC, look for these common issues:
// 1. Off-by-one errorschar buf[64];// Bug: should be < 64, not <= 64for (int i = 0; i <= 64; i++) buf[i] = 'A';
// Fix:for (int i = 0; i < 64; i++) buf[i] = 'A';
// 2. Missing null terminatorchar buf[8];strncpy(buf, "longinput", 8);  // no null terminator// Fix:strncpy(buf, "longinput", 7);buf[7] = '\0';
// 3. Incorrect size calculationint *arr = malloc(10);           // Bug: should be 10 * sizeof(int)int *arr_fixed = malloc(10 * sizeof(int));  // Fix
// 4. Wrong offset in exploit payloadsize_t offset = 128;  // may need adjustment per target binary/environment

// When inspecting the PoC, look for these common issues:
// 1. Off-by-one errorschar buf[64];// Bug: should be < 64, not <= 64for (int i = 0; i <= 64; i++) buf[i] = 'A';
// Fix:for (int i = 0; i < 64; i++) buf[i] = 'A';
// 2. Missing null terminatorchar buf[8];strncpy(buf, "longinput", 8);  // no null terminator// Fix:strncpy(buf, "longinput", 7);buf[7] = '\0';
// 3. Incorrect size calculationint *arr = malloc(10);           // Bug: should be 10 * sizeof(int)int *arr_fixed = malloc(10 * sizeof(int));  // Fix
// 4. Wrong offset in exploit payloadsize_t offset = 128;  // may need adjustment per target binary/environment

Sending a crafted payload

#include <stdio.h>#include <stdlib.h>#include <string.h>#include <unistd.h>
#define PAYLOAD_SIZE 512#define OFFSET       264   // adjust based on binary analysis
int main(void) {    unsigned char payload[PAYLOAD_SIZE];
    // Fill with pattern for offset discovery    memset(payload, 'A', PAYLOAD_SIZE);
    // Overwrite return address (example — adjust for target)    unsigned long target_addr = 0xdeadbeefcafeUL;    memcpy(payload + OFFSET, &target_addr, sizeof(target_addr));
    // Write payload to stdout for piping    fwrite(payload, 1, PAYLOAD_SIZE, stdout);    return 0;}

#include <stdio.h>#include <stdlib.h>#include <string.h>#include <unistd.h>
#define PAYLOAD_SIZE 512#define OFFSET       264   // adjust based on binary analysis
int main(void) {    unsigned char payload[PAYLOAD_SIZE];
    // Fill with pattern for offset discovery    memset(payload, 'A', PAYLOAD_SIZE);
    // Overwrite return address (example — adjust for target)    unsigned long target_addr = 0xdeadbeefcafeUL;    memcpy(payload + OFFSET, &target_addr, sizeof(target_addr));
    // Write payload to stdout for piping    fwrite(payload, 1, PAYLOAD_SIZE, stdout);    return 0;}

Debugging a non-working PoC

bash

# Run under GDB to catch crashesgdb ./bluehammer(gdb) run <args>(gdb) bt          # backtrace on crash(gdb) info registers
# Find the exact crash offset with a cyclic pattern (pwndbg/peda)python3 -c "import pwn; print(pwn.cyclic(500).decode())" | ./bluehammer
# Use ltrace/strace to trace library/syscallsstrace ./bluehammer <args>ltrace ./bluehammer <args>
# Check binary protectionschecksec --file=./bluehammer# or with pwntools:python3 -c "from pwn import *; e = ELF('./bluehammer'); print(e)"

# Run under GDB to catch crashesgdb ./bluehammer(gdb) run <args>(gdb) bt          # backtrace on crash(gdb) info registers
# Find the exact crash offset with a cyclic pattern (pwndbg/peda)python3 -c "import pwn; print(pwn.cyclic(500).decode())" | ./bluehammer
# Use ltrace/strace to trace library/syscallsstrace ./bluehammer <args>ltrace ./bluehammer <args>
# Check binary protectionschecksec --file=./bluehammer# or with pwntools:python3 -c "from pwn import *; e = ELF('./bluehammer'); print(e)"

Python harness for iterating on the PoC

python

#!/usr/bin/env python3"""Harness for testing BlueHammer PoC variants.Run in an isolated lab environment only."""import subprocessimport structimport os
BINARY = "./bluehammer"OFFSET = 264  # adjust via debugging
def build_payload(offset: int, ret_addr: int, shellcode: bytes = b"") -> bytes:    padding = b"A" * offset    addr_packed = struct.pack("<Q", ret_addr)  # little-endian 64-bit    return padding + addr_packed + shellcode
def run_payload(payload: bytes) -> tuple[int, bytes, bytes]:    """Send payload to the binary, return (returncode, stdout, stderr)."""    result = subprocess.run(        [BINARY],        input=payload,        capture_output=True,        timeout=5,    )    return result.returncode, result.stdout, result.stderr
def find_offset(max_size: int = 1024) -> int:    """Brute-force the crash offset."""    for size in range(16, max_size, 8):        payload = b"A" * size        try:            rc, _, _ = run_payload(payload)            if rc != 0:                print(f"[+] Crash at size: {size}")                return size        except subprocess.TimeoutExpired:            print(f"[!] Timeout at size: {size}")    return -1
if __name__ == "__main__":    print("[*] Testing BlueHammer PoC")    payload = build_payload(OFFSET, 0x4141414141414141)    rc, out, err = run_payload(payload)    print(f"Return code: {rc}")    print(f"Stdout: {out}")    print(f"Stderr: {err}")

#!/usr/bin/env python3"""Harness for testing BlueHammer PoC variants.Run in an isolated lab environment only."""import subprocessimport structimport os
BINARY = "./bluehammer"OFFSET = 264  # adjust via debugging
def build_payload(offset: int, ret_addr: int, shellcode: bytes = b"") -> bytes:    padding = b"A" * offset    addr_packed = struct.pack("<Q", ret_addr)  # little-endian 64-bit    return padding + addr_packed + shellcode
def run_payload(payload: bytes) -> tuple[int, bytes, bytes]:    """Send payload to the binary, return (returncode, stdout, stderr)."""    result = subprocess.run(        [BINARY],        input=payload,        capture_output=True,        timeout=5,    )    return result.returncode, result.stdout, result.stderr
def find_offset(max_size: int = 1024) -> int:    """Brute-force the crash offset."""    for size in range(16, max_size, 8):        payload = b"A" * size        try:            rc, _, _ = run_payload(payload)            if rc != 0:                print(f"[+] Crash at size: {size}")                return size        except subprocess.TimeoutExpired:            print(f"[!] Timeout at size: {size}")    return -1
if __name__ == "__main__":    print("[*] Testing BlueHammer PoC")    payload = build_payload(OFFSET, 0x4141414141414141)    rc, out, err = run_payload(payload)    print(f"Return code: {rc}")    print(f"Stdout: {out}")    print(f"Stderr: {err}")

Troubleshooting

PoC doesn't crash / no effect

The author acknowledged bugs in the PoC — read the source carefully for off-by-one errors, wrong size calculations, or incorrect offsets.
Recompile without mitigations: -fno-stack-protector -no-pie -z execstack
Check if ASLR is interfering: echo 0 | sudo tee /proc/sys/kernel/randomize_va_space (lab only, revert after)

Compilation errors

bash

# Missing headers — check what the source includes and install dev packagessudo apt install build-essential libc6-dev
# Link errorsgcc bluehammer.c -o bluehammer -lpthread -lm

# Missing headers — check what the source includes and install dev packagessudo apt install build-essential libc6-dev
# Link errorsgcc bluehammer.c -o bluehammer -lpthread -lm

Segfault immediately on run

bash

# Run with ASAN to get detailed crash infogcc -fsanitize=address -g -o bluehammer_asan bluehammer.c./bluehammer_asan <args>

# Run with ASAN to get detailed crash infogcc -fsanitize=address -g -o bluehammer_asan bluehammer.c./bluehammer_asan <args>

PGP verification fails

bash

# Ensure you have the full key fingerprintgpg --list-keys FFoRCS0# Re-fetch if neededgpg --keyserver hkps://keys.openpgp.org --recv-keys <full-fingerprint>

# Ensure you have the full key fingerprintgpg --list-keys FFoRCS0# Re-fetch if neededgpg --keyserver hkps://keys.openpgp.org --recv-keys <full-fingerprint>

Lab Environment Setup (Recommended)

bash

# Use a dedicated VM or container — never run on production systemsdocker run -it --rm \    --cap-add SYS_PTRACE \    --security-opt seccomp=unconfined \    ubuntu:22.04 bash
# Inside containerapt update && apt install -y gcc gdb python3 python3-pip strace ltrace binutilspip3 install pwntools
git clone https://github.com/Nightmare-Eclipse/BlueHammer.gitcd BlueHammer

# Use a dedicated VM or container — never run on production systemsdocker run -it --rm \    --cap-add SYS_PTRACE \    --security-opt seccomp=unconfined \    ubuntu:22.04 bash
# Inside containerapt update && apt install -y gcc gdb python3 python3-pip strace ltrace binutilspip3 install pwntools
git clone https://github.com/Nightmare-Eclipse/BlueHammer.gitcd BlueHammer

Key Facts

来源与署名

来源：reason-machines/trending-skills位于skills/bluehammer-vulnerability-poc提交2384a00

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Property	Value
Language	C
License	MIT
Stars	606
Forks	228
Known bugs in PoC	Yes (author confirmed)
PGP signed	Yes (SHA-512, Ed25519)

Bluehammer Vulnerability Poc

BlueHammer Vulnerability PoC

⚠️ Important Notice

What BlueHammer Does

Getting the Code

Verify PGP Signature (Recommended)

Building the PoC

Single-file build

Common C build flags for vulnerability PoCs

Running the PoC

Code Patterns — Working with C Vulnerability PoCs

Reading and understanding the vulnerability trigger

Analyzing the PoC for bugs (author noted known bugs)

Sending a crafted payload

Debugging a non-working PoC

Python harness for iterating on the PoC

Troubleshooting

PoC doesn't crash / no effect

Compilation errors

Segfault immediately on run

PGP verification fails

Lab Environment Setup (Recommended)

Key Facts

来源与署名

更多来自 reason-machines/trending-skills 的技能

Yourvpndead Vpn Detection

X Mentor Skill Nuwa

Wildworld Dataset

Understand Anything Knowledge Graph

Webphysics Avbd Engine

Ui Ux Pro Max Skill

更多Security技能

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt