Added the advanced exercises, sections 9 and 10

Author: nnamon

cleanup.sh

@@ -1,4 +1,6 @@
 #!/bin/bash
 
-find . -name 'peda*.txt' | xargs -n 1 rm
-find . -name '.gdb_history' | xargs -n 1 rm
+find . -name 'peda*.txt' | xargs -t -n 1 rm
+find . -name '.gdb_history' | xargs -t -n 1 rm
+find . -name 'core' | xargs -t -n 1 rm
+

lessons/10_bypass_got/Makefile

@@ -0,0 +1,11 @@
+all: 1_records 2_event1
+
+1_records:
+	gcc -m32 -fno-stack-protector -znoexecstack -o ./build/1_records ./src/1_records.c
+
+
+2_event1:
+	gcc -m32 -znoexecstack -o ./build/2_event1 ./src/2_event1.c
+	cp ./build/2_event1 ./services/event1/event1
+
+

lessons/10_bypass_got/build/1_records

@@ -0,0 +1,17 @@
+FROM ubuntu:latest
+ENV user=event1
+RUN dpkg --add-architecture i386
+RUN sed -i -e 's/archive\.ubuntu\.com/mirror\.0x\.sg/g' /etc/apt/sources.list
+RUN apt-get update
+RUN apt-get install -y xinetd libc6:i386 libncurses5:i386 libstdc++6:i386
+RUN useradd -m $user
+RUN echo "$user     hard    nproc       20" >> /etc/security/limits.conf
+COPY ./event1 /home/$user/event1
+COPY ./event1service /etc/xinetd.d/event1service
+COPY ./flag /home/$user/flag
+RUN chown -R root:$user /home/$user
+RUN chmod -R 750 /home/$user
+RUN chown root:$user /home/$user/flag
+RUN chmod 440 /home/$user/flag
+EXPOSE 31337
+CMD ["/usr/sbin/xinetd", "-d"]

lessons/10_bypass_got/build/2_event1

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+docker build -t event1 .

lessons/10_bypass_got/services/event1/Dockerfile

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+docker run -dt -p 1902:31337 event1

lessons/10_bypass_got/services/event1/dockerbuild.sh

@@ -0,0 +1,12 @@
+service event1service
+{
+    disable = no
+    socket_type = stream
+    protocol    = tcp
+    wait        = no
+    user        = event1
+    bind        = 0.0.0.0
+    server      = /home/event1/event1
+    type        = UNLISTED
+    port        = 31337
+}

lessons/10_bypass_got/services/event1/dockerrun.sh

@@ -0,0 +1 @@
+flag{g0t_m1lk?}