-
-
Notifications
You must be signed in to change notification settings - Fork 156
Expand file tree
/
Copy pathhints.txt
More file actions
185 lines (123 loc) · 4.51 KB
/
Copy pathhints.txt
File metadata and controls
185 lines (123 loc) · 4.51 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
!!!! Replace xxx with your obtained level password !!!!
LEVEL 1 - Integer Overflow
-------
./exploit hello [Integer value]
Hint: Signed or unsigned, that's the question
LEVEL 2 - Stack Overflow
-------
./exploit xxx [username] [password]
Hint: try admin as username
I'm sure they didn't expect a username or password to be very long :)
Try to run the function level3password
LEVEL 3 - Array Overflow
-------
./exploit xxx [arraynumber] [content]
Hint: You have a maximum of 32 slots to store content.
Try to run the function level4password
LEVEL 4 - Off by One
-------
./exploit xxx [magic]
Hint: Magic happens if there are enough null bytes
LEVEL 5 - Stack Cookie
-------
./exploit xxx [magic]
Hint: There might be a stack cookie preventing you to have success
LEVEL 6 - Format String
-------
./exploit xxx
Hint: r should return Y instead of N. But sometimes codes don't want you to reach a simple 'Y'.
But maybe a print function is buggy ?
LEVEL 7 - Heap Overflow
-------
[32-Bit]
./exploit xxx [text]
Hint: Success will be for those to change the magic to 0x6763
LEVEL 8 - Type Confusion
-------
./exploit xxx [cmd]
Hint: How can we set the pointer of g to be the pointer of b, in order to get a pointer that is executed ?
LEVEL 9 - Zero Pointers
-------
./exploit xxx [addr] [flag1] [flag2]
Hint: Try some address with flag1=0 and flag2=0
LEVEL 10 - Command Injection
--------
./exploit xxx [Cmd]
Hint: This will run "man Cmd". How can we run our own command, maybe a ; is helpful ?
LEVEL 11 - Path Traversal
--------
./exploit xxx [Directory]
Hint: Only ./dir1/dir2/ may be accepted, but maybe there is a trick to access a lower directory ?
LEVEL 12 - Return Oriented Programming (ROP)
--------
./exploit xxx
Hint: How can we change the flag 1234 to 5678 using some string ?
The compare helper is near 0x13470 (32bit) / 0x40347c (64bit) in the current qemu-tested build.
LEVEL 13 - Use after Free
--------
./exploit xxx [options]
Hint: Maybe a destroyed mapping can be reused to our advantage ?
LEVEL 14 - Jump Oriented Programming (JOP)
--------
./exploit xxx token.bin
Hint: Craft a token.bin that will allow you to do your stuff. First integer is total length (little endian), and the current cmp helper is near 0x1063c (32bit) / 0x400990 (64bit).
LEVEL 15 - Stable Format String Write
--------
./exploit xxx [format]
Hint: This time the vulnerable printf receives a stable pointer argument. Use %n to write 75.
LEVEL 16 - Double Free
--------
./exploit xxx [text]
Hint: The same tiny chunk is freed twice and then allocated twice. One write controls both aliases.
LEVEL 17 - Signedness Bug
--------
./exploit xxx [length]
Hint: A negative signed value can become very large when interpreted as unsigned.
LEVEL 18 - Integer Multiplication Overflow
--------
./exploit xxx [count]
Hint: A large element count can wrap a 16-bit allocation size.
LEVEL 19 - Null Pointer Bug
--------
./exploit xxx [mode]
Hint: A missing handler can be recovered into a useful control-flow path.
LEVEL 20 - Uninitialized Memory Read
--------
./exploit xxx [mode]
Hint: Reusing memory without initializing it can preserve old authorization data.
LEVEL 21 - Out-of-bounds Read
--------
./exploit xxx [index]
Hint: Read just past the visible table.
LEVEL 22 - TOCTOU Path Race
--------
./exploit xxx [checked_path] [opened_path]
Hint: The checked name and the opened name are not guaranteed to stay the same.
LEVEL 23 - Insecure Temp File
--------
./exploit xxx
Hint: A predictable temp path can be redirected with a symlink.
LEVEL 24 - Environment Variable Injection
--------
./exploit xxx
Hint: The program trusts EXPLOIT_HELPER.
LEVEL 25 - Unsafe Parser
--------
./exploit xxx [packet]
Hint: A declared length controls a copy into a small packet buffer.
LEVEL 26 - Filtered Command Injection
--------
./exploit xxx [cmd]
Hint: Blocking semicolons does not block every shell expansion syntax.
LEVEL 27 - Heap Metadata Corruption
--------
./exploit xxx [metadata]
Hint: Overflow one chunk into the next chunk's size and in-use fields.
LEVEL 28 - ROP-style Control Flow
--------
./exploit xxx [chain]
Hint: A controlled chain can redirect a function pointer to the next-level function.
LEVEL 29 - Dangling Stack Pointer
--------
./exploit xxx [text]
Hint: A pointer to a dead stack buffer may later point at reused stack storage.