Exploit Development Tutorial for Hackers and Pentesters

Identify target information first using tools to gather data about the target for hacking and exploit development. Preview the tools and methods used in the exploitation process.

Install and configure the gdb peda plugin for exploit development in linux, enabling the gdb-peda prompt. Clone peda, update gdbinit with source peda.py, and verify plugin loads.

Learn the basics of using GDB to examine binaries, disassemble the main function, set breakpoints, and inspect registers and strings to understand exploit development concepts.

Explore how a binary is loaded into memory, including text and data sections, auto data section, and the role of heap and stack in process memory, essential for exploit development.

Explore how the stack allocates a dedicated memory region for a function's temporary variables, created on call and discarded on exit during runtime, shaping the exploitation process.

Explore memory segmentation of a binary in RAM, covering text, data, heap, and the stack with runtime stack frames for each function.

Visualize how the stack stores the main function’s data, including argv and argc, return addresses, the base pointer, and local variables, with practical examples and gdb demonstrations.

Explore the stack in a binary with gdb, examining the main function's stack frame, locals x, y, z, and hello world string, argv, esp, and return address in 32-bit mode.

Explore how the stack is created across multiple functions, tracing main and function one arguments, return addresses, and local variables with gdb to understand stack frames in binary execution.

Learn how the linker converts object files into a runnable binary by resolving library addresses and data, illustrated with a practical hello world example distinguishing object files from linked executables.

Explore how symbols in a binary represent functions and variables, and use the symbol table to differentiate local and system symbols for debugging.

Identify plt and got sections inside a binary using gdb, trace a call from main to puts via plt and got, and verify the puts address with info functions.

Explore the dangers of setuid files and how the setuid bit can grant a normal user root privileges, risking privilege escalation and security breaches.

Explore how a startup library loads the main function, how the stack stores the return address, and how control returns to the caller after main finishes, with a gdb demo.

Import the lab .ova into Oracle VM VirtualBox, enable host-only networking, log in as professor with password toor, find the IP with ifconfig, and update ssh_Ubuntu.sh.

Learn to determine the stack size, locate the stack frame, and track local variables in a running binary using gdb, including base pointer and stack pointer relationships.

Track and locate the return address inside a function's stack frame using gdb, base pointer, and function arguments, and apply this method to understand exploit development concepts in memory.

Practice a stack memory exploitation by overflowing a 64-byte buffer with input via strcpy, overriding the i variable, and using gdb breakpoints to map the stack and return address.

Explore the exploitation roadmap: understand buffer overflow on the stack, how the return address is targeted, and how crafted inputs and no operation bytes lead to shellcode execution.

This lecture demonstrates buffer overflow exploitation on a simple C program, guiding you to map the stack, overwrite the return address, and inject shellcode to spawn a shell.

Learn how environment variables work in Linux, how to view, create, and delete them, and how they can be located on the stack using gdb to assist exploit development.

Develops a stack buffer overflow exploit using an environment variable, teaching how to identify overflow size, craft shell code, and overwrite the return address to gain control.

Learn how to exploit a tiny eight-byte buffer by using environment variables to place shell code and overwrite the return address, enabling code execution.

Discover a fast method to locate the shellcode address stored in an environment variable with a simple one-line C program using getenv, eliminating manual searches during exploit development.

Learn to exploit a vulnerable binary without using nop sleds by placing shell code in an environment variable, locating stack address, and aligning program names to overwrite the return address.

Learn a reliable technique to determine the actual address of the shell code by adjusting pointers and environment variable handling, demonstrated through a practical exploit against a vulnerable program.

Explains the concept of bypassing dep protection in binaries by leveraging the libc system function and exit, crafting a payload that redirects execution via the return address.

Discover how the stack cookie (canary) is stored and tracked in a protected binary by analyzing the stack and disassembly, then compare with an unprotected build.

Demonstrate locating and tracking the stack cookie in the binary using gdb, placing breakpoints, and observing how input overwrites the cookie to trigger stack protection and program termination.

Explain relocation read-only (relro) protection, the role of the global offset table in function calls, and how overwriting that table entry with the system function enables a shell.

explains how attackers bypass relro protections in a binary to exploit a memory boundary, analyze stack and got entries, and trigger a system call to spawn a shell.

Explore return oriented programming (ROP) and how to chain small code snippets on the stack to execute multiple functions, such as printf and system, to reach a shell.

Learn ROP-based exploit development on a vulnerable program, using a buffer overflow, system calls, and printf to spawn a shell. This hands-on lecture covers gadget chaining and practical proof-of-concept techniques.

Learn how ROP chaining of libc functions can yield a specific user shell by exploiting setuid and system calls with pop three return gadgets.

Master the basics of format specifiers in C, using printf with %d, %s, %x, and %n to print values and illustrate format string exploitation.

Explore format string vulnerabilities using a hands-on C example, showing how unsafely printing user input reveals stack values and secrets, and how to exploit printf without a format string.

Learn to use direct parameter access and field width in format strings to exploit a vulnerable buffer and read stack memory addresses, key steps in exploit development.

Master the method of writing data to arbitrary memory addresses using format specifiers in C, covering single-byte and two-byte writes, crafting input, and exploiting format string vulnerabilities.

Discover how to use percent and format specifiers to overwrite a target memory address two bytes at a time, crafting inputs and managing addresses to write precise values.

Exploit development tutorial demonstrates overwriting the global offset table exit address with shellcode via a printf vulnerability to gain a system shell.