Exploit Development Tutorial for Hackers and Pentesters

Explore how the stack allocates a dedicated memory region for a function's temporary variables, created on call and discarded on exit during runtime, shaping the exploitation process.

Visualize how the stack stores the main function’s data, including argv and argc, return addresses, the base pointer, and local variables, with practical examples and gdb demonstrations.

Explore the stack in a binary with gdb, examining the main function's stack frame, locals x, y, z, and hello world string, argv, esp, and return address in 32-bit mode.

Learn how the linker converts object files into a runnable binary by resolving library addresses and data, illustrated with a practical hello world example distinguishing object files from linked executables.

Explore how symbols in a binary represent functions and variables, and use the symbol table to differentiate local and system symbols for debugging.

Explore the dangers of setuid files and how the setuid bit can grant a normal user root privileges, risking privilege escalation and security breaches.

Import the lab .ova into Oracle VM VirtualBox, enable host-only networking, log in as professor with password toor, find the IP with ifconfig, and update ssh_Ubuntu.sh.

Explore the exploitation roadmap: understand buffer overflow on the stack, how the return address is targeted, and how crafted inputs and no operation bytes lead to shellcode execution.

This lecture demonstrates buffer overflow exploitation on a simple C program, guiding you to map the stack, overwrite the return address, and inject shellcode to spawn a shell.

Develops a stack buffer overflow exploit using an environment variable, teaching how to identify overflow size, craft shell code, and overwrite the return address to gain control.

Discover a fast method to locate the shellcode address stored in an environment variable with a simple one-line C program using getenv, eliminating manual searches during exploit development.

Learn to exploit a vulnerable binary without using nop sleds by placing shell code in an environment variable, locating stack address, and aligning program names to overwrite the return address.

Explains the concept of bypassing dep protection in binaries by leveraging the libc system function and exit, crafting a payload that redirects execution via the return address.

Discover how the stack cookie (canary) is stored and tracked in a protected binary by analyzing the stack and disassembly, then compare with an unprotected build.

Explain relocation read-only (relro) protection, the role of the global offset table in function calls, and how overwriting that table entry with the system function enables a shell.

explains how attackers bypass relro protections in a binary to exploit a memory boundary, analyze stack and got entries, and trigger a system call to spawn a shell.

Explore return oriented programming (ROP) and how to chain small code snippets on the stack to execute multiple functions, such as printf and system, to reach a shell.

Learn ROP-based exploit development on a vulnerable program, using a buffer overflow, system calls, and printf to spawn a shell. This hands-on lecture covers gadget chaining and practical proof-of-concept techniques.

Learn how ROP chaining of libc functions can yield a specific user shell by exploiting setuid and system calls with pop three return gadgets.

Master the basics of format specifiers in C, using printf with %d, %s, %x, and %n to print values and illustrate format string exploitation.

Explore format string vulnerabilities using a hands-on C example, showing how unsafely printing user input reveals stack values and secrets, and how to exploit printf without a format string.

Master the method of writing data to arbitrary memory addresses using format specifiers in C, covering single-byte and two-byte writes, crafting input, and exploiting format string vulnerabilities.

Exploit development tutorial demonstrates overwriting the global offset table exit address with shellcode via a printf vulnerability to gain a system shell.