Exploit › Module 2 › Lesson 4
Lab — Classes
Pack BOF, UAF, and format-string class cards — one observation each from $PWN_LAB toys, no exploit bytes.
Visual · pwn_classes_lab
Lab: corruption class pack. $PWN_LAB only. Original Cyberlium.
Opening
Class pack ties named bugs to YOUR toy observations — vocabulary before protections module.
Lessons 2-1–2-3 named BOF, UAF, and format-string classes with defender notes. This lab merges three class cards plus one-line crash or sanitizer observation per toy compiled in $PWN_LAB. No payload construction — classification paperwork only. Next: Quiz — Corruption Classes Named.
1. Lab contract: corruption class pack
Create $HOME/cyberlium-lab/t24-m02-l04-classes-lab.txt merging BOF, UAF, and format-string cards with toy sha256 and one observation sentence each.
Optional: table mapping bug class → unsafe API → mitigation → YOUR toy filename.
Command guide
Try these commands — Lab contract: corruption class pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CWE memory corruption — https://cwe.mitre.org/data/definitions/119.html pwn.college — https://pwn.college/ (class names map to authorized labs) Microsoft SDL — https://learn.microsoft.com/en-us/security/sdl/ (fix-first mindset)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential
macOS:
Command — copy this
xcode-select --install # or brew install gcc
Windows: Use WSL or MinGW Use WSL or install file for Windows
═══ LINUX / macOS ═══
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
cat > "$LAB_PWN/src/strcpy_vuln.c" <<'EOF'
#include <stdio.h>
#include <string.h>
int main(void) {
char dst[16];
char src[64];
if (!fgets(src, sizeof(src), stdin)) return 1;
src[strcspn(src, "
")] = 0;
strcpy(dst, src); /* BUG: unbounded copy — literacy demo */
printf("copied: %s
", dst);
return 0;
}
EOFCommand — copy this
cat > "$LAB_PWN/src/strcpy_safe.c" <<'EOF'
#include <stdio.h>
#include <string.h>
int main(void) {
char dst[16];
char src[64];
if (!fgets(src, sizeof(src), stdin)) return 1;
src[strcspn(src, "
")] = 0;
strncpy(dst, src, sizeof(dst) - 1);
dst[sizeof(dst) - 1] = 0;
printf("copied: %s
", dst);
return 0;
}
EOFCommand — copy this
gcc -Wall -O0 -g -o "$LAB_PWN/bin/strcpy_vuln" "$LAB_PWN/src/strcpy_vuln.c"
gcc -Wall -O0 -g -o "$LAB_PWN/bin/strcpy_safe" "$LAB_PWN/src/strcpy_safe.c"
file "$LAB_PWN/bin/"{bof_vuln,bof_safe,strcpy_vuln,strcpy_safe,uaf_named,fmt_vuln,fmt_safe}
grep -E 'BUG|SAFE|gets|strcpy|printf\(buf' "$LAB_PWN/src/"*.c | head -12═══ WINDOWS ═══
Command — copy this
Get-ChildItem $HOME/cyberlium-lab/t24-pwn/src -ErrorAction SilentlyContinue | Select-Object Name
Primary tools to practice this lesson: gcc, file, grep. Reference sites: CWE memory corruption (https://cwe.mitre.org/data/definitions/119.html); pwn.college (https://pwn.college/); Microsoft SDL (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check refusal boundaries
Grep pack for shellcode, ROP, %n write recipes, or production URLs — remove. Observations stay crash/sanitizer summaries.
Rebuild toys after source edits and update sha256.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Stack and Heap Literacy.
Class naming feeds stack/heap layout lessons in M3.
4. What you ship: corruption class pack for $PWN_LAB
Three class cards merged with toy sha256 and observations. $PWN_LAB named. NO exploit bytes. chmod 600.
5. What you record before the next lesson
Date. Class pack path. $PWN_LAB named. File t24-m02-l04-classes-lab.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include ROP notes in pack. Skip sha256 on toys.
Right
Write YOUR corruption class pack for $PWN_LAB toys. chmod 600. Next: Quiz — Corruption Classes Named.
Mission: freeze YOUR class pack
1) Merge BOF, UAF, format-string sections. 2) Log sha256 per toy. 3) Confirm zero payload/ROP content. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Three one-line crash notes beat one long exploit writeup.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Class pack should log sha256 per toy binary.
True or False
Knowledge Check
APPLY: Each class card should include:
Multiple choice