bretley / how2exploit_binary

An in depth tutorial on how to do binary exploitation

how2exploit_binary: get your hack on.

A note from the creator

Greetings, fellow hacker, hobbyist, or computer enthusiast. If you've been looking for a place to start learning binary exploitation, then you're in luck. This tutorial is intended for anyone with experience in coding, ideally C or C++, but I only knew Python when I started.

Written by someone who is just barely better than "incompetent," I'll be explaining how I learned my skills. These tutorials will be a bit long winded, but hopefully they will be informative and entertaining. Please feel free to contact me about any clarifications that should be included in the tutorials.

This is intended for Linux. It's free if you don't already have it. Don't want to dual boot? Get a VM.

-Best of luck

Bretley

The Grand Glossary of Terms

I've compiled this list of as many useful things as I could find. It contains all sorts of goodies that I wish I had found or had explained to me earlier. If you have a question, it can probably be answered in here. Otherwise, get your Google-Fu on

• The Glossary

External Tools.

I strongly recommend you install and use the following tools to make your life a bit easier:

• longld/peda: I use this tool in all of these tutorials. It provides a wide range of useful functions and makes gdb far more user friendly. Just follow the installation instructions in the repo.

• Gallopsled/pwntools: pwntools is an exploit framework built in my favorite language, python. It has a whole slew of useful functions and chicanery that makes the exploit process more fun and less painful. Install with: $ sudo pip install pwntools

Introductory Tutorials:

• Setup Script
• Intro 1: What is a binary, really?
  • Companion Video
  • Areece x86 Calling Conventions
• Intro 2: Screwing around with the stack

Buffer Overflows and ROP:

• 1: The power of SEGFAULT
• 2: Build your own system()
• 3: Follow the Yellow Brick Functions
• 3.5: Learning pwntools
• 4: Pay a Visit to Your Local Library

Heap Exploitation:

• More to come here soon ;)

how2exploit_binary's Issues

Intro to Pwntools 404

Looks like your files for the intro to pwntools section were never uploaded!
Besides that this tutorial is great. Thanks

dump_stack.h

In intro 2 you are including dump_stack.h, but
on my debian it cannot be found. From where is
this header? I was looking on net and found nothing.

Incorrect address encoding in example

In excercise-3.5/README.md, you've got this example encoding.

say for example the address of write() in a binary is 0xdeadbeef
\xef\xbe\xed\xda

Wouldn't that be encoded like this?

\xef\xbe\xad\xde

(I'll open a large PR soon, this fix will be in there.)

People who are experienced with binexp: What more challenges should I add?

I intend to add challenges in the following areas:

Heap (pretty vague, but heap exploitation is an art form of its own)

syscalls/more ROP

Edge cases (SSP vulnerabilities, "magic shell",etc)

Any Ideas? I want to grow this repo

Add links to VM installation tutorials for Mac and Windows in README

VirtualBox for Macs

Ubuntu can be installed within Windows10

zsh : exec format error: ./overflow2

both the intro-2 and exercise-1 with the overflow file. i cant run it on linux

Why do these files exist?

• exercise-3/peda-session-date.txt
• exercise-3/peda-session-overflow.txt

Correctly Order Folders?

Currently, they're alphabetically organized which puts the "exercise" folders before the "intro" folders.

Does it make sense to add numbers before the folders so it looks like this?

1. intro-1
2. intro-2
3. intro-3
4. exercise-1
...

Edit: just realized I had only ever worked with the directories in my terminal and there is an index with them. nvm

Change repo description to...

"In depth binary exploitation tutorial"

Why is pwntools installed 3 times in this script?

how2exploit_binary/install.sh

Line 17 in de5e5f6

pip install pwntools;