Binary Exploitation Practice

Author: naup96321

environment

• Pwn templates: https://github.com/Naupjjin/MyCTFLib/blob/main/MyPwnLib/smp_exploit2.py
• DockerBox: https://github.com/Naupjjin/Pwn-Docker-Box
• LinuxKernelChallengeBox: https://github.com/Naupjjin/LinuxKernelChallengeBox

slides

Binary Exploitation 1 - https://docs.google.com/presentation/d/1KnQ3uEoz3wdYkYKn4ysllUBioCQWmT1vVljJ8-JbXhw/edit?usp=sharing
Binary Exploitation 2 - https://docs.google.com/presentation/d/1R_PwTL5VtOcG4UFDAZpjMmO0iWxSgkCKPz15s7x3-7c/edit?usp=sharing

stack pwn

name	description	Link
fmt aar	Format string read	LINK
fmt aaw	Format string write	LINK
fmt argv chain	Format string argv chain	LINK
GOThijack	GOT hijacking attack	LINK
Onegadget	Return-oriented programming with one gadget	LINK
OOB	Out-of-bounds vulnerability	LINK
ret2func	BOF+ret2win	LINK
ret2libc	BOF+ret2libc	LINK
ret2plt	BOF+ret2plt	LINK
ROP	Simple ROP	LINK
ret2shellcode	BOF+ret2shellcode	LINK
stack_migration	Stack migration technique	LINK

heap pwn

name	description	Link
Heap overflow
slime machine revenge	UAF + tcache poinsoning	LINK

kernel pwn

name	description	Link
No549	modprobe_path	LINK
kernel story I	kernel ROP + No protection	LINK
kernel story II	Kernel ROP + SMAP/SMEP	LINK
kernel story III	kernel ROP + SMAP/SMEP/KPTI/KASLR	LINK