Skip to content

Commit c0f6b7a

Browse files
nnamonnnamon
committed
Added new details
1 parent d877ff4 commit c0f6b7a

File tree

6 files changed

+134
-27
lines changed

6 files changed

+134
-27
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
*.pyc
22
.vagrant
3+
ubuntu-xenial-16.04-cloudimg-console.log

‎README.md

+18-15
Original file line numberDiff line numberDiff line change
@@ -10,23 +10,26 @@ expected of the following topics:
1010

1111
1. An Understanding of x86-64 Assembly
1212
2. Familiarity with GDB
13-
3. Familiarity with C
13+
3. Familiarity with C and Python
1414
4. Familiarity with the Standard Jump to Shellcode Exploits
1515

1616
## Syllabus
1717

18-
1. [Setting Up the
19-
Environment](./lessons/0_setting_up_environment/lessonplan.md)
18+
1. [Setting Up the Environment]
2019
2. How Does a Linux Binary Work?
21-
3. Classic Exploitation Theory
22-
4. Linux Binary Protections
23-
5. The Classic Exploitation Technique
24-
6. Bypassing NX with Return Oriented Programming
25-
7. ASLR in Depth
26-
8. Bypassing ASLR with NX Disabled
27-
9. Bypassing ASLR/NX with Ret2GOT
28-
10. Bypassing ASLR/NX with Ret2Libc
29-
11. Memory Leaks
30-
12. Multi-Stage Ret2Libc
31-
13. Format String Vulnerabilties
32-
14. Bypassing Stack Canaries with Format String Bugs
20+
3. Introduction to PEDA and Pwntools
21+
4. Classic Exploitation Theory
22+
5. Linux Binary Protections
23+
6. The Classic Exploitation Technique
24+
7. Bypassing NX with Return Oriented Programming
25+
8. ASLR in Depth
26+
9. Bypassing ASLR with NX Disabled
27+
10. Bypassing ASLR/NX with Ret2GOT
28+
11. Bypassing ASLR/NX with Ret2Libc
29+
12. Memory Leaks
30+
13. Multi-Stage Ret2Libc
31+
14. Format String Vulnerabilties
32+
15. Bypassing Stack Canaries with Format String Bugs
33+
34+
35+
[Setting Up The Environment]: ./lessons/1_setting_up_environment/lessonplan.md

‎Vagrantfile

+11-4
Original file line numberDiff line numberDiff line change
@@ -64,8 +64,15 @@ Vagrant.configure("2") do |config|
6464
# Enable provisioning with a shell script. Additional provisioners such as
6565
# Puppet, Chef, Ansible, Salt, and Docker are also available. Please see the
6666
# documentation for more information about their specific syntax and use.
67-
# config.vm.provision "shell", inline: <<-SHELL
68-
# apt-get update
69-
# apt-get install -y apache2
70-
# SHELL
67+
config.vm.provision "shell", inline: <<-SHELL
68+
dpkg --add-architecture i386
69+
apt-get update
70+
apt-get install -y libc6:i386 libncurses5:i386 libstdc++6:i386 gdb python python-pip libssl-dev gcc git
71+
pip install --upgrade pip
72+
pip install pwntools
73+
pip install ipython
74+
pip install ropper
75+
git clone https://github.com/longld/peda.git /home/ubuntu/peda
76+
echo "source ~/peda/peda.py" >> /home/ubuntu/.gdbinit
77+
SHELL
7178
end

‎lessons/0_setting_up_environment/lessonplan.md

-8
This file was deleted.

‎lessons/1_setting_up_environment/lessonplan.md

+99
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# Setting Up the Environment
2+
3+
We will be using vagrant to standardise the environment so following the lesson
4+
plan is easy. The Vagrantfile will provision the appropriate pre-requisites but
5+
please go through this document to get an understanding of the steps required to
6+
prepare the testing environment.
7+
8+
## Mandatory Steps
9+
10+
First, install vagrant and virtualbox. Vagrant can be downloaded from [this
11+
link](vagrantdl). Virtualbox can be downloaded from [here](virtualboxdl).
12+
13+
Next, clone the repository onto your host machine.
14+
15+
```shell
16+
amon@bethany:~$ git clone https://github.com/nnamon/linux-exploitation-course.git
17+
Cloning into 'linux-exploitation-course'...
18+
remote: Counting objects: 19, done.
19+
remote: Compressing objects: 100% (14/14), done.
20+
remote: Total 19 (delta 2), reused 15 (delta 1), pack-reused 0
21+
Unpacking objects: 100% (19/19), done.
22+
Checking connectivity... done.
23+
amon@bethany:~$
24+
```
25+
26+
Now, bring the vagrant box up.
27+
28+
```shell
29+
amon@bethany:~/sproink/linux-exploitation-course$ vagrant up
30+
Bringing machine 'default' up with 'virtualbox' provider...
31+
==> default: Importing base box 'ubuntu/xenial64'...
32+
==> default: Matching MAC address for NAT networking...
33+
==> default: Checking if box 'ubuntu/xenial64' is up to date...
34+
==> default: Setting the name of the VM: linux-exploitation-course_default_1483872823092_95278
35+
==> default: Clearing any previously set network interfaces...
36+
==> default: Preparing network interfaces based on configuration...
37+
default: Adapter 1: nat
38+
==> default: Forwarding ports...
39+
default: 22 (guest) => 2222 (host) (adapter 1)
40+
==> default: Running 'pre-boot' VM customizations...
41+
==> default: Booting VM...
42+
==> default: Waiting for machine to boot. This may take a few minutes...
43+
default: SSH address: 127.0.0.1:2222
44+
default: SSH username: ubuntu
45+
default: SSH auth method: password
46+
default:
47+
default: Inserting generated public key within guest...
48+
default: Removing insecure key from the guest if it's present...
49+
default: Key inserted! Disconnecting and reconnecting using new SSH key...
50+
... snip ...
51+
```
52+
53+
Once the provisioning finishes, you can ssh into the vagrant box.
54+
55+
```shell
56+
amon@bethany:~/linux-exploitation-course$ vagrant ssh
57+
Welcome to Ubuntu 16.04.1 LTS (GNU/Linux 4.4.0-57-generic x86_64)
58+
59+
* Documentation: https://help.ubuntu.com
60+
* Management: https://landscape.canonical.com
61+
* Support: https://ubuntu.com/advantage
62+
63+
Get cloud support with Ubuntu Advantage Cloud Guest:
64+
http://www.ubuntu.com/business/services/cloud
65+
66+
0 packages can be updated.
67+
0 updates are security updates.
68+
69+
70+
ubuntu@ubuntu-xenial:~$ ls -la
71+
total 28
72+
drwxr-xr-x 4 ubuntu ubuntu 4096 Jan 8 10:54 .
73+
drwxr-xr-x 3 root root 4096 Jan 8 10:54 ..
74+
-rw-r--r-- 1 ubuntu ubuntu 220 Aug 31 2015 .bash_logout
75+
-rw-r--r-- 1 ubuntu ubuntu 3771 Aug 31 2015 .bashrc
76+
drwx------ 2 ubuntu ubuntu 4096 Jan 8 10:54 .cache
77+
-rw-r--r-- 1 ubuntu ubuntu 655 Jun 24 2016 .profile
78+
drwx------ 2 ubuntu ubuntu 4096 Jan 8 10:54 .ssh
79+
-rw-r--r-- 1 ubuntu ubuntu 0 Jan 8 10:54 .sudo_as_admin_successful
80+
ubuntu@ubuntu-xenial:~$
81+
```
82+
83+
## What Was Installed?
84+
85+
This is the entire provisioning script:
86+
87+
```ruby
88+
config.vm.provision "shell", inline: <<-SHELL
89+
dpkg --add-architecture i386
90+
apt-get update
91+
apt-get install -y libc6:i386 libncurses5:i386 libstdc++6:i386 gdb python python-pip libssl-dev gcc
92+
pip install --upgrade pip
93+
pip install pwntools
94+
pip install ipython
95+
SHELL
96+
```
97+
98+
[vagrantdl]: https://www.vagrantup.com/downloads.html
99+
[virtualboxdl]: https://www.virtualbox.org/wiki/Downloads

‎lessons/3_intro_to_tools/lessonplan.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Introduction to PEDA and Pwntools
2+
3+
GDB with PEDA and Pwntools are two tools that we will be using extensively
4+
throughout the course. This section is designed to run through their basic use
5+
and to work out any possible kinks that might arise.

0 commit comments

Comments
 (0)