Evidence Pack
Bundle Topic 24 literacy evidence from $PWN_LAB — protections, safe build, crash notes, finding draft; no weapon files.
Visual · t24_evidence_pack
Evidence pack = mentor handoff from $PWN_LAB literacy. Original Cyberlium.
One indexed pack beats scattered crash logs — and never includes shellcode.bin.
Assemble evidence pack: toy source chain, checksec outputs, unsafe vs safe build hashes, crash repro + GDB observe, triage card, CTF awareness notes, historic/CVE worksheet, finding + remediation + disclosure skeleton, integrity statement ($PWN_LAB only, no weapon PoC, observe-not-attack). Directory chmod 600 — index.md lists contents UTC redactions. Mentor copy: report + hashes, not live exploit artifacts. Gap paragraph for Topic 25 Active Directory Attacks — separate authorized track. Scan folder for pwntools exploit, shellcode, ROP text — zero tolerance.
1. Pack contents
Minimum: source, checksec, crash observe, triage, build compare, CVE/history, report, index, integrity.
Optional: CTF rules ack — no remote attack logs.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Evidence pack — https://cwe.mitre.org/ (CWE IDs + hashes) NVD — https://nvd.nist.gov/ (reference CVEs in appendix) checksec — https://github.com/slimm609/checksec.sh
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl pipx install checksec.py # or: sudo apt install checksec
macOS:
Command — copy this
pipx install checksec.py
Windows:
Command — copy this
choco install openssl
Use WSL: pipx install checksec.py
═══ LINUX / macOS ═══
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
mkdir -p "$LAB_PWN/evidence"
openssl dgst -sha256 "$LAB_PWN/bin/"{build_vuln,build_safe,remediation_demo} | tee "$LAB_PWN/evidence/binaries.sha256"
if command -v checksec >/dev/null 2>&1; then checksec --file="$LAB_PWN/bin/build_vuln" "$LAB_PWN/bin/remediation_demo" | tee "$LAB_PWN/evidence/checksec.txt"; fi
cp "$LAB_PWN/notes/crash-bt.txt" "$LAB_PWN/evidence/" 2>/dev/null || echo 'run 9-4 first for crash-bt.txt'
grep -E 'sha256|checksec|crash' "$LAB_PWN/evidence/"* 2>/dev/null | head -10
wc -l "$LAB_PWN/evidence/"* 2>/dev/nullPrimary tools to practice this lesson: openssl, grep, checksec. Reference sites: Evidence pack (https://cwe.mitre.org/); NVD (https://nvd.nist.gov/); checksec (https://github.com/slimm609/checksec.sh). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Checklist row ↔ index row accountability.
3. Integrity
$PWN_LAB only, YOUR toys, no weapon files, share-safe export.
Scan before seal — remove accidental exploit drafts.
4. What you ship: literacy evidence pack
Bundled deliverables + index + integrity — chmod 600, hash not weapon default.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Evidence pack includes shellcode and pwntools exploit.py.
- Right: Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle checksec crash report index. 2) Integrity statements. 3) Confirm zero weapon files. 4) Gap note for Topic 25 AD track.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
APPLY: Evidence pack includes:
APPLY: True or False: pwntools exploit in pack by default.
APPLY: Integrity line states: