Binary Exploitation

Any Doubt...? Let's Discuss

Introduction

I am quite passionate about exploiting binary files. First time when I came across Buffer Overflow(a simple technique of exploitation) then I was not able to implement the same with the same copy of code on my system. The reason for that was there was no consolidated document that would guide me thoroughly to write a perfect exploit payload for the program in case of system changes.
Also there are very few descriptive blogs/tutorials that had helped me exploiting a given binary. I have come up with consolidation of Modern exploitation techniques (in the form of tutorial) that will allow you to understand exploitation from scratch.

I will be using vagrant file to setup the system on virtual box. To do the same in your system follow:

1. vagrant up
2. vagrant ssh

Topics

1. Lecture 1.

   • Memory Layout of C program.
   • ELF binaries.
   • Overview of stack during function call.
   • Assembly code for the function call and return.
   • Concept of $ebp and $esp.
   • Executable memory.

2. Lecture 1.5.

   • How Linux finds the binaries utilis?
   • Simple exploit using Linux $PATH variable.

3. Lecture 2.

   • What are stack overflows?
   • ASLR (basics), avoiding Stack protection.
   • Shellcodes
   • Buffer overflow:
     • Changing Control of the program to return to some other function
     • Shellcode injection in buffer and spawning the shell

4. Lecture 3.

   • Shellcode injection with ASLR enabled.
     • Environment variables.

5. Lecture 3.5

   • Return to Libc attacks.
   • Spawning shell in non executable stack
   • Stack organization in case ret2libc attack.

6. Lecture 4.

   • This folder contains the set of questions to exploit binaries on the concept that we have learned so far.

7. Lecture 5.

   • What is format string Vulnerability?
   • Seeing the content of stack.
   • Writing onto the stack.
   • Writing to arbitrary memory location.

8. Lecture 6.

   • GOT
   • Overriding GOT entry.
   • Spawning shell with format string vuln.

9. Lecture 7.

   • Heaps
   • Arena, Bins, Chunks.
   • Use after free exploit.
   • Double free exploit.