Exploit › Module 9 › Lesson 2
Remediation First
Remediation-first reporting — safe APIs, compiler flags, patch order before disclosure timing; fix YOUR toy on $PWN_LAB.
Visual · t24_remediation_first
Remediation first = fix before fame. Original Cyberlium.
Opening
The best finding includes a merged fix on your toy — not a Twitter thread with exploit GIF.
Remediation-first culture: recommend specific fixes — replace unsafe copy with bounds-checked API, enable stack protector and FORTIFY, add sanitizer in CI, bump dependency per CVE worksheet, retest on $PWN_LAB. For YOUR toy: ship patched source rebuild showing crash no longer reproduces or aborts safely under canary. Report structure lists remediation before optional coordinated disclosure timeline. Cyberlium refuses 'finding without fix recommendation' or 'disclosure for clout without patch effort' on toys YOU maintain. Do not advise disabling NX/ASLR as 'fix.' Link Module 5 secure build commands as evidence.
1. Fix categories
Source: safe string functions, length checks, free-after-null. Build: -fstack-protector, -D_FORTIFY_SOURCE=2, PIE. Dependency: patched libc/OpenSSL version.
Verify: rerun Module 6 repro — expect fix or safe abort.
Command guide
Try these commands — Fix categories
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GCC fortify — https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html CWE-120 remediation — https://cwe.mitre.org/data/definitions/120.html Microsoft SDL banned APIs — https://learn.microsoft.com/en-us/security/sdl/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential pipx install checksec.py # or: sudo apt install checksec
macOS:
Command — copy this
xcode-select --install # or brew install gcc pipx install checksec.py
Windows: Use WSL or MinGW Use WSL: pipx install checksec.py
═══ LINUX / macOS ═══
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
gcc -Wall -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE -pie -Wl,-z,relro,-z,now -O0 -g \
-o "$LAB_PWN/bin/remediation_demo" "$LAB_PWN/src/bof_safe.c"
if command -v checksec >/dev/null 2>&1; then checksec --file="$LAB_PWN/bin/remediation_demo"; fi
cat >> "$LAB_PWN/notes/findings-template.txt" <<'EOF'
remediation: replace gets→fgets; enable stack-protector+FORTIFY+PIE+RELRO
verification: safe binary accepts bounded input; checksec shows canary/PIE/NX/RELRO
EOFCommand — copy this
grep -E 'remediation|verification|gets' "$LAB_PWN/notes/findings-template.txt"
Primary tools to practice this lesson: gcc, grep, checksec. Reference sites: GCC fortify (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html); CWE-120 remediation (https://cwe.mitre.org/data/definitions/120.html); Microsoft SDL banned APIs (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Report ordering
Impact → root cause class → remediation steps → verification → disclosure timeline stub.
Remediation before attacker recipe — always.
3. Refused
Recommend WAF-only without memory fix, disable protections, 'accept risk' on trivial toy without documentation.
Weaponized PoC is not remediation.
4. What you ship: remediation-first template
Fix categories + verify steps + report section order + toy patch evidence rule.
5. What you record before the next lesson
Remediation-first template path.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Report recommends disabling stack canary so 'exploit won't work.'
Right
Remediation-first template with toy fix evidence. Next: Responsible Disclosure.
Mission: remediation-first template
1) List three fix categories. 2) Write verify-after-fix steps. 3) Patch YOUR toy and log hash. 4) Report section order.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Sanitizer in CI — one line policy?”
Knowledge Check
APPLY: Remediation first means:
Multiple choice
Knowledge Check
APPLY: True or False: Disable canary as remediation.
True or False
Knowledge Check
APPLY: Toy fix evidence includes:
Multiple choice