dnrops
/
HITCON-Training
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
14 Commits 1 Branch 0 Tags 421 KiB
C 49.5%
Python 32.8%
C++ 10.5%
Shell 3.7%
Makefile 2.7%
Other 0.8%
Go to file
Angelboy cb60f23e44
Merge pull request #1 from danielhenrymantilla/master 
Added a script to create&run the env in a docker container
 		2018-03-27 01:51:01 +08:00
LAB add all lab 2016-11-30 22:51:16 +08:00
LICENSE Initial commit 2016-11-19 14:13:19 +08:00
README.md add outline 2016-11-21 21:59:14 +08:00
docker.sh Added a script to create&run the env in a docker container 2018-03-26 13:03:09 +02:00
env_setup.sh add lab1-lab4 2016-11-28 20:03:13 +08:00

README.md

HITCON-Training

For Linux binary Exploitation

Environment Setup

git clone https://github.com/scwuaptx/HITCON-Training.git ~/
cd HITCON-Training && chmod u+x ./env_setup.sh && ./env_setup.sh

Outline

  • Basic Knowledge

    • Introduction
      • Reverse Engineering
        • Static Analysis
        • Dynamic Analysis
      • Exploitation
      • Useful Tool
        • IDA PRO
        • GDB
        • Pwntool
      • lab 1 - sysmagic
    • Section
    • Compile,linking,assmbler
    • Execution
      • how program get run
      • Segment
    • x86 assembly
      • Calling convention
      • lab 2 - open/read/write
      • shellcoding

  • Stack Overflow

    • Buffer Overflow
    • Return to Text/Shellcode
      • lab 3 - ret2shellcode
    • Protection
      • ASLR/DEP/PIE/StackGuard
    • Lazy binding
    • Return to Library
      • lab 4 - ret2lib

  • Return Oriented Programming

    • ROP
      • lab 5 - simple rop
    • Using ROP bypass ASLR
      • ret2plt
    • Stack migration
      • lab 6 - migration

  • Format String Attack

    • Format String
    • Read from arbitrary memory
      • lab 7 - crack
    • Write to arbitrary memory
      • lab 8 - craxme
    • Advanced Trick
      • EBP chain
      • lab 9 - playfmt

  • x64 Binary Exploitation

    • x64 assembly
    • ROP
    • Format string Attack

  • Heap exploitation

    • Glibc memory allocator overview
    • Vulnerablility on heap
      • Use after free
        • lab 10 - hacknote
      • Heap overflow
        • house of force
          • lab 11 - 1 - bamboobox1
        • unlink
          • lab 11 - 2 - bamboobox2

  • Advanced heap exploitation

    • Fastbin attack
      • lab 12 - babysecretgarden
    • Shrink the chunk
    • Extend the chunk
      • lab 13 - heapcreator
    • Unsortbin attack
      • lab 14 - magicheap

  • C++ Exploitation

    • Name Mangling
    • Vtable fucntion table
    • Vector & String
    • New & delete
    • Copy constructor & assignment operator
      • lab 15 - zoo

  • 那些 Pwning 的奇淫技巧: