Cyberlium

Exploit › Module 2 › Lesson 4

BeginnerModule 2Lesson 4/5

Lab — Classes

Pack BOF, UAF, and format-string class cards — one observation each from $PWN_LAB toys, no exploit bytes.

25 min+40 XP3 quiz
Module progress4 of 5

Visual · pwn_classes_lab

Lab: corruption class pack. $PWN_LAB only. Original Cyberlium.

Opening

Class pack ties named bugs to YOUR toy observations — vocabulary before protections module.

Lessons 2-1–2-3 named BOF, UAF, and format-string classes with defender notes. This lab merges three class cards plus one-line crash or sanitizer observation per toy compiled in $PWN_LAB. No payload construction — classification paperwork only. Next: Quiz — Corruption Classes Named.

1. Lab contract: corruption class pack

Create $HOME/cyberlium-lab/t24-m02-l04-classes-lab.txt merging BOF, UAF, and format-string cards with toy sha256 and one observation sentence each.

Optional: table mapping bug class → unsafe API → mitigation → YOUR toy filename.

Command guide

Try these commands — Lab contract: corruption class pack

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

CWE memory corruption — https://cwe.mitre.org/data/definitions/119.html pwn.college — https://pwn.college/ (class names map to authorized labs) Microsoft SDL — https://learn.microsoft.com/en-us/security/sdl/ (fix-first mindset)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install build-essential

macOS:

Command — copy this

xcode-select --install  # or brew install gcc

Windows: Use WSL or MinGW Use WSL or install file for Windows

═══ LINUX / macOS ═══

Command — copy this

export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
cat > "$LAB_PWN/src/strcpy_vuln.c" <<'EOF'
#include <stdio.h>
#include <string.h>
int main(void) {
    char dst[16];
    char src[64];
    if (!fgets(src, sizeof(src), stdin)) return 1;
    src[strcspn(src, "
")] = 0;
    strcpy(dst, src);  /* BUG: unbounded copy — literacy demo */
    printf("copied: %s
", dst);
    return 0;
}
EOF

Command — copy this

cat > "$LAB_PWN/src/strcpy_safe.c" <<'EOF'
#include <stdio.h>
#include <string.h>
int main(void) {
    char dst[16];
    char src[64];
    if (!fgets(src, sizeof(src), stdin)) return 1;
    src[strcspn(src, "
")] = 0;
    strncpy(dst, src, sizeof(dst) - 1);
    dst[sizeof(dst) - 1] = 0;
    printf("copied: %s
", dst);
    return 0;
}
EOF

Command — copy this

gcc -Wall -O0 -g -o "$LAB_PWN/bin/strcpy_vuln" "$LAB_PWN/src/strcpy_vuln.c"
gcc -Wall -O0 -g -o "$LAB_PWN/bin/strcpy_safe" "$LAB_PWN/src/strcpy_safe.c"
file "$LAB_PWN/bin/"{bof_vuln,bof_safe,strcpy_vuln,strcpy_safe,uaf_named,fmt_vuln,fmt_safe}
grep -E 'BUG|SAFE|gets|strcpy|printf\(buf' "$LAB_PWN/src/"*.c | head -12

═══ WINDOWS ═══

Command — copy this

Get-ChildItem $HOME/cyberlium-lab/t24-pwn/src -ErrorAction SilentlyContinue | Select-Object Name

Primary tools to practice this lesson: gcc, file, grep. Reference sites: CWE memory corruption (https://cwe.mitre.org/data/definitions/119.html); pwn.college (https://pwn.college/); Microsoft SDL (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Cross-check refusal boundaries

Grep pack for shellcode, ROP, %n write recipes, or production URLs — remove. Observations stay crash/sanitizer summaries.

Rebuild toys after source edits and update sha256.

3. Lock the proof

chmod 600 on the pack. Quiz next — then Stack and Heap Literacy.

Class naming feeds stack/heap layout lessons in M3.

4. What you ship: corruption class pack for $PWN_LAB

Three class cards merged with toy sha256 and observations. $PWN_LAB named. NO exploit bytes. chmod 600.

5. What you record before the next lesson

Date. Class pack path. $PWN_LAB named. File t24-m02-l04-classes-lab.txt chmod 600.

6. Wrong vs right: weaponized exploits vs memory-safety literacy

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

  • Wrong

    Include ROP notes in pack. Skip sha256 on toys.

  • Right

    Write YOUR corruption class pack for $PWN_LAB toys. chmod 600. Next: Quiz — Corruption Classes Named.

Mission: freeze YOUR class pack

1) Merge BOF, UAF, format-string sections. 2) Log sha256 per toy. 3) Confirm zero payload/ROP content. 4) chmod 600.

Stuck? Ask Cyberlium AI Mentor

Three one-line crash notes beat one long exploit writeup.

Knowledge Check

1

APPLY: This lab requires:

Multiple choice

Knowledge Check

2

APPLY: True or False: Class pack should log sha256 per toy binary.

True or False

Knowledge Check

3

APPLY: Each class card should include:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)