11–15 of 15 posts
* I haven't played with exploit-exercises yet (definitely will when I get some downtime), but I've had a blast solving the challenges at http://io.smashthestack.org:84 . They are hosted so no need to download VMs. They have a several more here that I haven't played with: http://smashthestack.org/ * I recently came across a computer security course which used CTF virtual machines for an assignment (you can download th…
I've never really had much luck with stuff like this. Whenever I have tried to write code in the C to be deliberately vulnerable and have tried to overwrite memory etc it never seems to work in the way I expect. For example I will have two arrays that are contiguous in memory (checking this with gdb) and I will then write a big set of values into one array that should overflow into the other. Then try and do somethin…
Also, be sure to turn off Write^Execute memory pages and ASLR as another commenter has suggested.
Alternatively, you could try your hand at defeating these protection mechanisms yourself with a number of (relatively) newfangled techniques.
JITSpray - http://dsecrg.com/pages/pub/show.php?id=22 ROP - http://cseweb.ucsd.edu/~hovav/talks/blackhat08.html
and more!
Awesome! I was always jealous of people who had problem sets like this in their CS curriculum.