HITCON-Training

For Linux binary Exploitation

Environment Setup

git clone https://github.com/scwuaptx/HITCON-Training.git ~/
cd HITCON-Training && chmod u+x ./env_setup.sh && ./env_setup.sh

Outline

• Basic Knowledge

  • Introduction
    • Reverse Engineering
      • Static Analysis
      • Dynamic Analysis
    • Exploitation
    • Useful Tool
      • IDA PRO
      • GDB
      • Pwntool
    • lab 1 - sysmagic
  • Section
  • Compile,linking,assmbler
  • Execution
    • how program get run
    • Segment
  • x86 assembly
    • Calling convention
    • lab 2 - open/read/write
    • shellcoding

• Stack Overflow

  • Buffer Overflow
  • Return to Text/Shellcode
    • lab 3 - ret2shellcode
  • Protection
    • ASLR/DEP/PIE/StackGuard
  • Lazy binding
  • Return to Library
    • lab 4 - ret2lib

• Return Oriented Programming

  • ROP
    • lab 5 - simple rop
  • Using ROP bypass ASLR
    • ret2plt
  • Stack migration
    • lab 6 - migration

• Format String Attack

  • Format String
  • Read from arbitrary memory
    • lab 7 - crack
  • Write to arbitrary memory
    • lab 8 - craxme
  • Advanced Trick
    • EBP chain
    • lab 9 - playfmt

• x64 Binary Exploitation

  • x64 assembly
  • ROP
  • Format string Attack

• Heap exploitation

  • Glibc memory allocator overview
  • Vulnerablility on heap
    • Use after free
      • lab 10 - hacknote
    • Heap overflow
      • house of force
        • lab 11 - 1 - bamboobox1
      • unlink
        • lab 11 - 2 - bamboobox2

• Advanced heap exploitation

  • Fastbin attack
    • lab 12 - babysecretgarden
  • Shrink the chunk
  • Extend the chunk
    • lab 13 - heapcreator
  • Unsortbin attack
    • lab 14 - magicheap

• C++ Exploitation

  • Name Mangling
  • Vtable fucntion table
  • Vector & String
  • New & delete
  • Copy constructor & assignment operator
    • lab 15 - zoo

• 那些 Pwning 的奇淫技巧: