Binary Exploitation 450: buffer overflow 3

Challenge

It looks like Dr. Xernon added a stack canary to this program to protect against buffer overflows. Do you think you can bypass the protection and get the flag? You can find it in /problems/buffer-overflow-3_2_810c6904c19a0e8b0da0f59eade5b0ce. Source.

Hints

• Maybe there’s a smart way to brute-force the canary?

Solution
I really don’t know what to do for this one. That’s 4 bytes, large number of
options. You can’t gdb this live, I don’t think it’s possible to do timing
based attacks to guess digits. So… ???

Flag