Exploit › Module 4 › Lesson 4
Lab — Protections
Pack ASLR/NX/canary, PIE/RELRO, and checksec transcripts — secure vs contrast build on $PWN_LAB only.
Visual · pwn_protections_lab
Lab: protections pack. $PWN_LAB only. Original Cyberlium.
Opening
Protections pack proves hardening on YOUR toys — verify before M5 secure build module.
Lessons 4-1–4-3 named ASLR, NX, canary, PIE, RELRO, and checksec reading. This lab merges protection tables plus side-by-side checksec for secure build and optional intentional weak build kept inside $PWN_LAB VM. No bypass exercises. Next: Quiz — Protections Literacy.
1. Lab contract: protections pack
Create $HOME/cyberlium-lab/t24-m04-l04-protections-lab.txt merging trio table, PIE/RELRO card, checksec transcripts for secure toy (required) and weak contrast toy (optional, VM-only).
Include randomize_va_space level note from lab VM.
Command guide
Try these commands — Lab contract: protections pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
checksec — https://github.com/slimm609/checksec.sh GCC hardening — https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html CWE-119 — https://cwe.mitre.org/data/definitions/119.html (defense-in-depth context)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install build-essential pipx install checksec.py # or: sudo apt install checksec sudo apt install binutils
macOS:
Command — copy this
xcode-select --install # or brew install gcc pipx install checksec.py brew install binutils
Windows: Use WSL or MinGW Use WSL: pipx install checksec.py Use WSL binutils
═══ LINUX / macOS ═══
Command — copy this
export LAB_PWN=${LAB_PWN:-$HOME/cyberlium-lab/t24-pwn}
gcc -Wall -fstack-protector-strong -D_FORTIFY_SOURCE=2 -fPIE -pie -Wl,-z,relro,-z,now -O0 -g \
-o "$LAB_PWN/bin/bof_hardened" "$LAB_PWN/src/bof_safe.c"
if command -v checksec >/dev/null 2>&1; then
checksec --file="$LAB_PWN/bin/bof_noprotect"
checksec --file="$LAB_PWN/bin/bof_hardened"
else
readelf -l "$LAB_PWN/bin/bof_noprotect" "$LAB_PWN/bin/bof_hardened" | grep GNU_STACK
fi
echo 'protections lab: compare weak vs hardened YOUR toys — literacy only'═══ WINDOWS ═══
Command — copy this
Write-Output 'Windows: inspect YOUR lab .exe with dumpbin /headers — DEP/ASLR literacy via Microsoft SDL docs'
Primary tools to practice this lesson: gcc, checksec, readelf. Reference sites: checksec (https://github.com/slimm609/checksec.sh); GCC hardening (https://gcc.gnu.org/onlinedocs/gcc/Instrumentation-Options.html); CWE-119 (https://cwe.mitre.org/data/definitions/119.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check refusal
Grep for bypass, ROP, ret2libc recipes — remove. Pack stays defender verification only.
Weak build must never leave VM or ship to production-like hosts.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Secure Build Hygiene.
Protections literacy feeds compiler flag lessons in M5.
4. What you ship: protections verification pack for $PWN_LAB
Merged protection tables + checksec transcripts + ASLR sysctl note. $PWN_LAB named. NO bypass content. chmod 600.
5. What you record before the next lesson
Date. Protections pack path. $PWN_LAB named. File t24-m04-l04-protections-lab.txt chmod 600.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include ret2libc steps. Export weak build to daily driver.
Right
Write YOUR protections pack for $PWN_LAB toys. chmod 600. Next: Quiz — Protections Literacy.
Mission: freeze YOUR protections pack
1) Merge M4 tables and checksec outputs. 2) Note ASLR sysctl value. 3) Confirm no bypass sections. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Secure vs weak checksec diff is the whole lesson.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Weak contrast builds stay inside $PWN_LAB VM only.
True or False
Knowledge Check
APPLY: checksec in this pack should document:
Multiple choice