Exploit › Module 1 › Lesson 2
Lab Toys Only
Compile and crash YOUR toy C programs inside $PWN_LAB — snapshots, source beside binary, no daily-driver fuzzing.
Visual · pwn_lab_toys_only
Lab toy hygiene. $PWN_LAB only. Original Cyberlium.
Opening
A toy program you wrote is the safest teacher — you chose the bug, you own the VM.
Lab toys are small C programs you compile with deliberate unsafe patterns for observation: narrow buffers, missing bounds checks, or double-free demos. Store source, Makefile, compiler flags, and sha256 in $PWN_LAB. Run only inside a snapshotted VM — never on your host banking session or a classmate's machine. Cyberlium treats lab toys as the foundation before reading public CVEs. You will NOT drop course binaries on production or fuzz neighbor services. Next: No Weapon PoCs.
1. Toy program requirements
Keep source, build script, compiler version, and debug/strip variants under $PWN_LAB. Name artifacts t24-toy-* with date. One bug class per lesson when possible — stack overflow demo, UAF demo, format misuse demo.
Document gcc/clang command lines and sha256 in chmod 600 notes. Rebuild after toolchain updates and re-log hashes.
Command guide
Try these commands — Toy program requirements
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
pwn.college — https://pwn.college/ (CTF authorization model literacy) CWE-120 — https://cwe.mitre.org/data/definitions/120.html (classic buffer overflow class) NVD — https://nvd.nist.gov/ (CVE reading literacy, not weaponization)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t24-pwn/src" "$HOME/cyberlium-lab/t24-pwn/bin" "$HOME/cyberlium-lab/t24-pwn/notes" cat > "$HOME/cyberlium-lab/t24-pwn/roe.txt" <<'EOF' LAB_PWN=$HOME/cyberlium-lab/t24-pwn targets: YOUR gcc toys / authorized CTF literacy only never: weaponized PoCs, ROP chains, shellcode, stranger targets observe: crashes on YOUR toys — do NOT develop exploit chains EOF
Command — copy this
grep -E 'LAB_|never|observe|targets' "$HOME/cyberlium-lab/t24-pwn/roe.txt" curl -sS https://pwn.college/ | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: pwn.college (https://pwn.college/); CWE-120 (https://cwe.mitre.org/data/definitions/120.html); NVD (https://nvd.nist.gov/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. VM boundary and snapshots
Daily driver holds notes and static copies — not crashing binaries against real services. Debugging and intentional overflows happen inside $PWN_LAB VM with snapshots you can revert.
Network egress from the lab VM stays minimal — no scanning campus or cloud targets 'to test the bug.'
3. Intake you must refuse
Unknown exploit binaries from forums, live malware samples marketed as 'pwn practice,' or binaries targeting software you do not own. If you did not compile it or receive it explicitly as course material in $PWN_LAB, do not run it.
Ship: lab toy inventory — three toy targets with source paths and sha256. Next: No Weapon PoCs.
4. What you ship: lab toy inventory for $PWN_LAB
Inventory: toy C programs with source, build flags, sha256 each. $PWN_LAB VM only. NEVER host fuzzing. chmod 600.
5. What you record before the next lesson
Date. Lab toy inventory. $PWN_LAB named. File t24-m01-l02-lab-toys-only.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run a forum 'pwn' binary on host Desktop. Crash-test against a live website.
Right
Write lab toy inventory for $PWN_LAB. Next: No Weapon PoCs.
Mission: inventory YOUR lab toys
1) List one toy C program you will compile with source path. 2) Name VM snapshot rule before first crash. 3) Add sha256 logging rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Authoring a toy bug beats downloading someone else's weapon binary.
Knowledge Check
APPLY: Lab toys on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Intentional crashes belong inside $PWN_LAB VM with snapshots.
True or False
Knowledge Check
APPLY: Best first pwn literacy target is often:
Multiple choice