Court of Analysis and Testing

meme source: https://www.mememaker.net/meme/if-you-practice-4240 No matter how far you go, it is important to always practice the concept over and over again by giving yourself a new challenge in every opportunity. So in this post, we are going to take a look at another good challenge for practicing Linux exploitation which is SmashTheTux that come from "Vulhub" platform but because I don't want you guys to be overwhelmed with the material I will cut the writeup into several parts. VM can be download from this link: https://www.vulnhub.com/entry/smashthetux-101,138/ Warm-up -> 0x00: Once you installed and started the VM in your VirtualBox, the machine will offer us 9 challenged in the home directory, each of them contains a common vulnerability in the Linux binary that we can exploit to take control the program the first challenge 0x00, give use the following piece of vulnerable code: If you are already indulged with binary exploitation long enou...

Disclaimer: This post is only for education only and not for causing destruction to a lived system. Be smart! In every exploit development process, the shellcode is one of the vital components to making your exploit reliable. Shellcode itself is just basically an assembly instruction that converted into opcodes (the hexadecimal thingy) "\x6a\x66\x58\x99\x6a\x01\x5b\x52\x53\x6a\x02\x89" "\xe1\xcd\x80\x89\xc6\x5f\xb0\x66\xb3\x04\x52\x56" "\x89\xe1\xcd\x80\xb0\x66\x43\x89\x54\x24\x08\xcd" "\x80\x93\x59\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b" "\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89" "\xe3\x52\x53\xeb\xca"; that will instruct the program what to do next after the exploitation process is done But when it comes to creating it not many people willing to devote their time to learn it, they rather to just used a precompiled shellcode for example that come from http://shell-storm.org/  because they think that is some...