Court of Analysis and Testing

meme source: https://www.mememaker.net/meme/if-you-practice-4240 No matter how far you go, it is important to always practice the concept over and over again by giving yourself a new challenge in every opportunity. So in this post, we are going to take a look at another good challenge for practicing Linux exploitation which is SmashTheTux that come from "Vulhub" platform but because I don't want you guys to be overwhelmed with the material I will cut the writeup into several parts. VM can be download from this link: https://www.vulnhub.com/entry/smashthetux-101,138/ Warm-up -> 0x00: Once you installed and started the VM in your VirtualBox, the machine will offer us 9 challenged in the home directory, each of them contains a common vulnerability in the Linux binary that we can exploit to take control the program the first challenge 0x00, give use the following piece of vulnerable code: If you are already indulged with binary exploitation long enou...

For the past couple of months you guys see me doing lot of buffer overflow exploitation in Linux and Windows but buffer overflow itself is not the only approach in memory corruption attack. There are other techniques such as format string and heap overflow method But today we are going to focus on Format String attack. So what is it ? Format string attack is an attack that are taking an advantage on how the print function work in C. you guys already know some of them such as printf, sprintf and so on my point is any function from print family typically you use print function like this: void main(){ int a = 10; printf("%d\n",a) ; } notice that we parse a string format which is %d, that represent an integer so this telling the program to show the output of the program from variable a. But things to get little funny when we create program like this: void main() { char buffer[512]; fgets(buffer, sizeof(buffer), stdin); printf(buffer); } so whats ...