Lab — Crash Observe
End-to-end crash observation on $PWN_LAB — reproduce, GDB observe, triage card; no exploit payload.
Visual · t24_crash_lab
Lab: crash observe pipeline on YOUR $PWN_LAB toy. Original Cyberlium.
Close one crash loop — repro, GDB snapshot, triage card — without a single exploit byte.
On YOUR $PWN_LAB intentional buggy toy per brief: (1) verify source, hash, compiler flags; (2) reproduce crash with documented input and signal; (3) GDB session — bt, info registers, redacted memory peek if needed; (4) triage row — bug class, protections from checksec, impact literacy, remediation; (5) explicit refuse block — no ROP, shellcode, pwntools exploit; (6) chmod 600 lab pack. No stranger targets, no production fuzzing, no weaponized deliverables. Stop if binary lacks source or is not YOUR toy/instructor lab.
1. Lab pipeline
Repro → GDB observe → triage → remediation note — same order every time.
Header: toy name, SHA256, $PWN_LAB VM, UTC session, compiler/sanitizer flags.
Command guide
Try these commands — Lab pipeline
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GDB manual — https://sourceware.org/gdb/current/onlinedocs/gdb.html/ checksec — https://github.com/slimm609/checksec.sh CWE-120 — https://cwe.mitre.org/data/definitions/120.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install gdb sudo apt install build-essential pipx install checksec.py # or: sudo apt install checksec
macOS:
Command — copy this
brew install gdb xcode-select --install # or brew install gcc pipx install checksec.py
Windows: Use WSL gdb Use WSL or MinGW Use WSL: pipx install checksec.py
═══ LINUX / macOS ═══
Optional command
sudo apt install gdb binutils # gdb checksec/readelf
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}observe crash; do NOT develop exploit
Command — copy this
gdb -q -batch -ex 'run' -ex 'info registers rip eip' -ex 'bt' -ex quit \ "$LAB_PWN/bin/build_vuln" <<< "$(printf '%96s' | tr ' ' 'A')" 2>&1 | grep -E 'Program received|SIGSEGV|#0|rip|bt' | head -12 printf 'ok ' | "$LAB_PWN/bin/build_safe" if command -v checksec >/dev/null 2>&1; then checksec --file="$LAB_PWN/bin/build_safe"; fi echo 'crash lab complete: observed segfault on vuln, safe build accepts bounded input'
Primary tools to practice this lesson: gdb, gcc, checksec. Reference sites: GDB manual (https://sourceware.org/gdb/current/onlinedocs/gdb.html/); checksec (https://github.com/slimm609/checksec.sh); CWE-120 (https://cwe.mitre.org/data/definitions/120.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence rows
Each row: step, command, observed output, link to Module 2 class name.
Honest N/A if toy uses only abort() — still valid crash observation.
3. Stop conditions
Stop if undocumented binary or brief forbids file class.
Zero exploit bytes in pack — scan before submit.
4. What you ship: crash lab pack
Repro log + GDB snapshot + triage card + refuse block — chmod 600.
5. What you record before the next lesson
Crash lab pack path.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Crash lab deliverable includes pwntools exploit script.
- Right: Crash lab pack on YOUR $PWN_LAB toy. Next: quiz.
Mission: crash lab
1) Verify hash and scope. 2) Reproduce with signal log. 3) GDB bt/registers redacted. 4) Triage card + refuse block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum GDB proof for triage?”
APPLY: Crash lab scope:
APPLY: True or False: ROP recipe in crash lab earns credit.
APPLY: Crash lab pack includes: