Exploit Linux Machines Through Fun Challenges
exploit-exercises.com
Exploit Linux Machines Through Fun Challenges
1–10 of 15 posts
Re: Exploit Linux Machines Through Fun Challenges
#2it's down :/
Re: Exploit Linux Machines Through Fun Challenges
#3it's down :/
Works for me. Anyways, the torrent for the beginner VM is magnet:?xt=urn:btih:77cfd777dd287da30dcdc5c82aa72f0ffb6c67eb
Re: Exploit Linux Machines Through Fun Challenges
#4This looks awesome. I've taken a large interest in security over the last couple years and am always looking for ways to increase my knowledge in this space (FWIW, the Stanford crypto course has been great so far). This will be a good follow-on to that.
Re: Exploit Linux Machines Through Fun Challenges
#5* I haven't played with exploit-exercises yet (definitely will when I get some downtime), but I've had a blast solving the challenges at http://io.smashthestack.org:84. They are hosted so no need to download VMs. They have a several more here that I haven't played with: http://smashthestack.org/
* I recently came across a computer security course which used CTF virtual machines for an assignment (you can download the VM and see how you do against Tufts University students): http://www.cs.tufts.edu/comp/116/assignments/a04.php
* Offensive Security's "Penetration Testing with BackTrack" (PWB) course uses a series of CTF challenges as the final exam.
* Any recommendations on any encryption challenges in this style?
We are seeing a return to the old guild system of masterpieces as proof of ability and learning aid. I couldn't be happier. I'd love to see a mash up between stackoverflow's gamification and Offensive Security certification/teaching process.
Re: Exploit Linux Machines Through Fun Challenges
#6Awesome! I was always jealous of people who had problem sets like this in their CS curriculum.
Re: Exploit Linux Machines Through Fun Challenges
#7I've never really had much luck with stuff like this.
Whenever I have tried to write code in the C to be deliberately vulnerable and have tried to overwrite memory etc it never seems to work in the way I expect.
For example I will have two arrays that are contiguous in memory (checking this with gdb) and I will then write a big set of values into one array that should overflow into the other. Then try and do something like print the values that should have been overflowed into but I often find I either get a segfault or that the values that are printed are actually the correct values assigned the the array that should be overwritten.
I haven't tried these specific puzzles with the VMs though. I always do -fno-stack-protector when compiling but I don't know if there is some other security mechanism that could be stopping it from working?
Re: Exploit Linux Machines Through Fun Challenges
#8* I haven't played with exploit-exercises yet (definitely will when I get some downtime), but I've had a blast solving the challenges at http://io.smashthestack.org:84 . They are hosted so no need to download VMs. They have a several more here that I haven't played with: http://smashthestack.org/ * I recently came across a computer security course which used CTF virtual machines for an assignment (you can download th…
I second the encryption request and specifically a request for RNG issues.
Re: Exploit Linux Machines Through Fun Challenges
#9I've never really had much luck with stuff like this. Whenever I have tried to write code in the C to be deliberately vulnerable and have tried to overwrite memory etc it never seems to work in the way I expect. For example I will have two arrays that are contiguous in memory (checking this with gdb) and I will then write a big set of values into one array that should overflow into the other. Then try and do somethin…
One thing to note is that gdb screws with memory allocation. Just because it looked that way while running gdb does not mean it will look that way when run normally.
Re: Exploit Linux Machines Through Fun Challenges
#10I've never really had much luck with stuff like this. Whenever I have tried to write code in the C to be deliberately vulnerable and have tried to overwrite memory etc it never seems to work in the way I expect. For example I will have two arrays that are contiguous in memory (checking this with gdb) and I will then write a big set of values into one array that should overflow into the other. Then try and do somethin…
Linux 2.6.12 an up implements address space randomization (randomly varies the location of the stack over a 8MB range) which could explain what you're seeing.