Exploit › Module 10 › Lesson 4
Lab — Capstone
Execute capstone on $PWN_LAB — protections + safe build + crash note + finding draft; pack sealed, zero weapon files.
Visual · t24_capstone_lab
Capstone: checklist × $PWN_LAB literacy evidence. Original Cyberlium.
Opening
Close the memory-safety literacy loop — buggy toy observed, fixed, reported — without a single exploit weapon.
Walk Topic 24 checklist on YOUR $PWN_LAB capstone toy chain: verify source and hashes, lab path current, checksec and safe build comparison, crash repro + GDB observe linked, triage refusing weaponize, CTF awareness notes, CVE/history tie-in, finding + remediation verified, evidence pack indexed, scan for weapon files (must be zero). Update index with capstone UTC completion. Purple paragraph: patch/detection insight from YOUR path. No ROP, shellcode, pwntools exploit, stranger targets, public 0-day. Optional mentor review — three clarity questions.
1. Execute checklist
Check each row; link artifact or N/A; confirm zero refused techniques in any file.
Scan sealed pack for shellcode/ROP/pwntools exploit — remove before handoff.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Capstone literacy — https://pwn.college/ (authorized advanced track after this topic) CWE-119 — https://cwe.mitre.org/data/definitions/119.html docs.pwntools.com — https://docs.pwntools.com/en/stable/ (tool literacy recap) Microsoft SDL — https://learn.microsoft.com/en-us/security/sdl/ (defender capstone)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential sudo apt install gdb pipx install checksec.py # or: sudo apt install checksec sudo apt install openssl
macOS:
Command — copy this
xcode-select --install # or brew install gcc brew install gdb pipx install checksec.py
Windows: Use WSL or MinGW Use WSL gdb Use WSL: pipx install checksec.py
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Optional command
sudo apt install build-essential binutils gdb # gcc gdb checksec/readelf
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
gcc -Wall -Wno-deprecated-declarations -O0 -g -o "$LAB_PWN/bin/cap_vuln" "$LAB_PWN/src/bof_vuln.c"
gcc -Wall -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE -pie -Wl,-z,relro,-z,now -O0 -g \
-o "$LAB_PWN/bin/cap_safe" "$LAB_PWN/src/bof_safe.c"
if command -v checksec >/dev/null 2>&1; then checksec --file="$LAB_PWN/bin/cap_vuln" "$LAB_PWN/bin/cap_safe"; else readelf -l "$LAB_PWN/bin/cap_safe" | grep GNU_STACK; fiobserve crash; do NOT develop exploit
Command — copy this
gdb -q -batch -ex 'run' -ex 'bt' -ex quit "$LAB_PWN/bin/cap_vuln" <<< "$(printf '%88s' | tr ' ' 'A')" 2>&1 | head -15 | tee "$LAB_PWN/report-capstone.txt" printf 'lab ' | "$LAB_PWN/bin/cap_safe" | tee -a "$LAB_PWN/report-capstone.txt" openssl dgst -sha256 "$LAB_PWN/bin/cap_vuln" "$LAB_PWN/bin/cap_safe" | tee -a "$LAB_PWN/report-capstone.txt" cat >> "$LAB_PWN/report-capstone.txt" <<'EOF' capstone: compile vuln+safe, checksec delta, gdb crash observe, hash evidence scope: LAB_PWN YOUR toys — literacy + remediation; never weaponized PoCs EOF
Command — copy this
grep -E 'capstone|SIGSEGV|sha256|never|safe' "$LAB_PWN/report-capstone.txt" "$LAB_PWN/roe.txt" | head -15
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t24-pwn/roe.txt | Select-String never Get-ChildItem $HOME/cyberlium-lab/t24-pwn/evidence -ErrorAction SilentlyContinue | Select-Object Name
Primary tools to practice this lesson: gcc, gdb, checksec, openssl, grep. Reference sites: Capstone literacy (https://pwn.college/); CWE-119 (https://cwe.mitre.org/data/definitions/119.html); docs.pwntools.com (https://docs.pwntools.com/en/stable/); Microsoft SDL (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Purple paragraph
Protections + remediation key → defender detection or dev hardening idea.
Name what breaks if you skip authorization or ship weapon PoC — integrity tie-in.
3. Shutdown
Notes secured chmod 600; index signed complete UTC.
Ready for Topic 25 Active Directory Attacks on separate authorized track.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed literacy pack + purple paragraph + zero weapon scan.
5. What you record before the next lesson
Capstone pack path. $PWN_LAB quiet.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone includes working exploit against remote host.
Right
Capstone complete on $PWN_LAB with full teardown. Next: topic quiz.
Mission: Topic 24 capstone
1) Walk checklist with evidence links. 2) Purple paragraph from your path. 3) Seal pack — zero weapon files. 4) Sign index UTC complete.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Shellcode capstone deliverable earns credit.
True or False
Knowledge Check
APPLY: Capstone teardown includes:
Multiple choice