项目说明
on-pwning
This repository contains my solutions to some CTF challenges and a list of interesting resources about pwning stuff.
Write-Ups/PoCs
365 Days Later: Finding and Exploiting Safari Bugs using Publicly A Tools | googleprojectzero.blogspot.com • fuzzing7zip C HFS+ Code Execution | talosintelligence.comA cache in bug in Linux memory management | googleprojectzero.blogspot.comA collection of Ja engine CVEs with PoCs | github.com/tunzA Methodical Approach to Browser Exploitation | blog.ret2.io - Discovery Against Apple Safari | blog.ret2.io
- Timeless Debugging of Complex Software | blog.ret2.io
- Weaponization of a Ja | blog.ret2.io
- Cracking the Walls of the Safari Sandbox | blog.ret2.io • Frida, fuzzing
- Exploiting the macOS WindowServer for root | blog.ret2.io • Frida
A Pwn2Own exploit chain | github.com/saeloA Story About Three Bluetooth in AndroidAll Your Docs Are Belong To Us › re an a to compose signatures capable of detecting classified documents | objecti.comAvast Antivirus: Remote Stack Buffer O with Magic Numbers | landave.ioBack to 28: Grub2 Authentication 0-Day | hmarco.orgBetter slow than sorry – 3D acceleration considered harmful | phoenhex.reBrowser security beyond sandboxing | microsoft.comCo Ian Beer's exploit techniques for get bug (iOS 11-11.3.1) | 4ldebaran.blogspot.comC: exploit the race condition in the n_hdlc Linux kernel dri SMEP | a13xp0p0.ioDisabling MacOS SIP via a kext | mdsec.co.ukeBPF and Analysis of the get-rekt-linux-hardened.c Exploit for C | ricklarabee.blogspot.comExploiting C | reverse.put.asExploring 6 Pre Unknown Remote Kernel Bugs Affecting Android Phones | pleasestopnaming.comExtracting a 19 Year Old Code Execution from WinRAR | checkpoint.comFrag Grenade! A Remote Code Execution in the Steam Client | contextis.comFrom fuzzing Apache httpd server to C and a $1500 bounty • AFL, rr, Fuzzing Counter-Strike: Global Offensive maps files with AFL | phoenhex.reFuzzing CS:GO BSP Files | path.networkGame hacking rein? – A cod exploit | momo5502.comgeohot presents an e writeup | geohot.comIOHIDeous | IOHIDFamily 0day | siguza.github.ioiOS 11 Jailbreak | github.com/Coalfire-ResearchIPC UaF Remote Jailbreak Stage 2 | 360.cn.html)Jailbreaks Demystified | geosn0w.github.ioKernel RCE caused by buffer o in Apple's ICMP packet-handling code (C) • QLMeltdown Proof-of-Concept | github.com/iaikPwn2Own: Safari sandbox part 1 – Mount yourself a root shell | phoenhex.re - Pwn2Own: Safari sandbox part 2 – Wrap your way around to root | phoenhex.re
Over The Air - Vol. 2, Pt. 1: Exploiting The Wi-Fi Stack on Apple Devices | googleprojectzero.blogspot.comReading Backwards – Controlling an Integer Underflow in Adobe Reader | zerodayinitiative.comRemote LD_PRELOAD Exploitation | elttam.com.auSystem Down: A systemd-journald exploit | openwall.comTaking a page from the kernel's book: A TLB issue in mremap() | googleprojectzero.blogspot.comThe First PS4 Kernel Exploit: Adieu | fail0.com | IOSurface exploit | siguza.github.io/ VRDP Guest-to-Host Escape | securiteam.com | github.com/MorteNoir1Xen SMEP (and SMAP) bypass | nccgroup.trust#### CTFs
0CTF 2017 Quals | BabyHeap2017 | uaf.io33C3 CTF 2016 | babyfengshui | galhacktictrendsetters.wordpress.com33C3 CTF 2016 | hohoho | github.com/InfoSecIITR • bash35C3 CTF 2018 | newphonewhodis | mhackeroni.itAtredis BlackHat CTF 2018 | msre.comCSAW 2017 Finals | kws2 | s3.eurecom.frCSAW 2017 Quals | FuntimeJS | rpis.ecDEF CON 2018 Finals | Doublethink | robertxiao.caFAUST CTF 2017 | Alexa | secgroup.github.ioGoogle CTF 2017 Quals | Inst Prof | secgroup.github.ioGoogle CTF 2017 Quals | Primary | da.blogspot.comGoogle CTF 2018 Quals | Sandbox Compat | da.blogspot.comHack.lu CTF 2014 | OREO | wapiflapi.github.io • ret2dl-resolveHack.lu CTF 2018 | Baby Kernel | Rusty Codepad | maltekraus.deHITCON CTF 2017 Quals | E Imaginative Void | pwning.funHITCON CTF 2017 Quals | Real Ruby Escaping | da.blogspot.comHXP CTF 2017 | Flag Store | pwning.re • FORTIFY_SOURCE, seccompnoxCTF 2018 | PSRF | github.com/seadog007 • SSRFPwn2Win 2017 | Shift Register | dragonsector.plRingZer0 Team Online CTF | Shellcoding | github.com/TokyoWesterns CTF 2018 | EscapeMe | da.blogspot.comTokyoWesterns/MMA CTF 2016 | Diary | uaf.io • seccompReadings
50 CVEs in 50 Days: Fuzzing Adobe Reader | checkpoint.com • WinAFL6.828: Operating System Engineering | mit.eduA binary analysis, count me if you can | shell-storm.org • PinA Eulogy for Format Strings | phrack.orgA Memory Allocator | g.oswego.edu • dlmallocAd Doug Lea's malloc exploits | phrack.orgAd in format string exploitation | phrack.orgAEG: Automatic Exploit Generation • NDSS 2011Almost booting an iOS kernel in QEMU | worthdoingbadly.comAn updated collection of resources targeting browser-exploitation | github.com/m1ghtym0AnC | vusec.net • ASLR⊕CacheASLR on the Line: Practical Cache Attacks on the MMU • NDSS 2017, ASLR⊕CacheASLR Protection for Statically Linked Executables | le.com • ELF, RELROAttacking a co-hosted VM: A hacker, a hammer and two memory modules | thisissecurity.stormshield.comATtention Spanned: Comprehensi Analysis of AT Commands Within the Android Ecosystem | atcommands.orgAwesome Fuzzing | github.com/secfigoBeware of strncpy() and strncat() | eklitzke.orgBinary fuzzing strategies: what works, what doesn't | lcamtuf.blogspot.comBlueBorne Information from the Research Team | armis.comBot vs. Bot: E Machine Learning Malware Detection • Black Hat USA 2017Broadpwn: Remotely Compromising Android and iOS via a Bug in Broadcom's Wi-Fi Chipsets | exodusintel.comBypassing clang’s SafeStack for Fun and Profit • Black Hat Europe 2016Cisco ASA series part four: dlmalloc-2.8.x, libdlmalloc, & dlmalloc on Cisco ASA | nccgroup.trustCommon Pitfalls When Writing Exploits | mathy.comControlling uninitialized memory with LD_PRELOAD | .orgCPU.fail | cpu.failCross debugging for MIPS ELF with QEMU/toolchain | re.stackexchange.comCyber Security Base • courseDirty COW and why lying is bad even if you are the Linux kernel | chao-tic.github.ioDrammer: Deterministic Rowhammer Attacks on Mobile Platforms • CCS 2016Dynamic Binary Instrumentation Primer | deniable.org • DynamoRIO, Frida, PinEducational Heap Exploitation | github.com/shellphishEffective file format fuzzing • Black Hat Europe 2016ELF Binary Code Injection, Loader/'Decrypter' | pinkstyle.orgEndpoint Security Self-Protection on MacOS | mdsec.co.ukExploit writing tutorial part 11 : Heap Spraying Demystified | corelan.beExploiting Format String | crypto.stanford.eduExploiting the DRAM rowhammer bug to gain kernel pri | googleprojectzero.blogspot.comExtra Exploitation Technique 1: _dl_open | dangokyo.meFile Stream Pointer O | ouah.orgFILE Structure Exploitation ('' check bypass) | dha.comFinding Function's Load Address | uaf.io • DT_STRTABFirst Steps in Hyper- | microsoft.comFrom Heap to RIP | frizn.fr • dlmalloc, ptmalloc2Fully undetectable backdooring PE files | haiderm.comFun with FORTIFY_SOURCE | .orgFuzzing arbitrary functions in ELF binaries | blahcat.github.io • LIEFFuzzing with AFL is an Art | moyix.blogspot.comFuzzing workflows; a fuzz job from start to finish | foxglo.com • AFLGenerating Software Tests | fuzzingbook.orgGetting Physical: Extreme abuse of Intel based Paging Systems - Part 1 | secureauth.comGLIBC MALLOC FOR EXPLOITERS | yannayl.github.ioGOT and PLT for pwning. | systemo.comGrand Pwning Unit: Accelerating Microarchitectural Attacks with the GPU | cs.vu.nlGTFOBins | gtfobins.github.ioHacking a game to learn FRIDA basics (Pwn Ad 3) | x-c3ll.github.ioHacking Blind • S&P 2014, BROPHardening C/C++ Programs Part II – Executable-Space Protection and ASLR | producti.comHardening ELF binaries using Relocation Read-Only (RELRO) | redhat.comHardware backdoors in some x86 CPUs | github.com/xoreaxeaxeaxHeap Exploitation | dha.comHeap Feng Shui in Ja • Black Hat Europe 2007House of Einherjar — Yet Another Heap Exploitation Technique on GLIBC • CODE BLUE 2016How main() is executed on Linux | tldp.orgHow programs get run: ELF binaries | lwn.netHow the ELF Ruined Christmas • USENIX 2015, \_dl\_runtime\_resolveHow to build a C program using a custom of glibc and static linking? | stacko.comHow to Create a Virus Using the Assembly Language | cranklin.wordpress.com • ELFInjecting missing methods at runtime | hopperapp.com • Mach-OiOS Hacking Resources | github.com/SiguzaiOS kernel exploitation archaeology • 34C3Jump Over ASLR: Attacking Branch Predictors to Bypass ASLR • MICRO 2016Keygenning with KLEE | doar-e.github.ioldd arbitrary code execution | catonmat.netLearning KVM - implement your own Linux kernel | da.blogspot.comLinux x86 Program Start Up | dbp-consulting.comlinux-insides | 0xax.gitbooks.ioLinux/x86 - sockfd trick + dup2(0,0), dup2(0,1), dup2(0,2) + execve /bin/sh - 50 bytes | shell-storm.orgmacOS Security and Privacy Guide | github.com/drduhMaking a low level (Linux) debugger, part 3: our first program | asrpo.comMeltdown and Spectre | meltdownattack.comMemory Corruption Attacks: The (almost) Complete History • Black Hat USA 2010Mental Snapshot - _int_free and unlink | uaf.ioMultiple glibc libraries on a single host | stacko.comNamed and their practical impact | github.com/hannobNew bypass and protection techniques for ASLR on Linux | ptsecurity.comOn the Effecti of Address-Space Randomization • CCS 2004, ASLROn and the vDSO | lwn.netOnce upon a free()... | phrack.orgOSDev Wiki | osdev.orgO (some) Spectre browser mitigations | alephsecurity.comFILE Structures: Another Binary Exploitation Technique • HITB GSEC 2018Playing with canaries | elttam.com.auPlaying with signals : An o on Sigreturn Oriented Programming | thisissecurity.stormshield.comPractical C++ Decompilation • REcon 2011Programming Z3ptmalloc fanzine | tukan.farmPwning (sometimes) with style - Dragons' notes on CTFs • Insomni'hack 2015Pwning coworkers thanks to LaTeX | scumjr.github.iopwnlib.dynelf — Resolving remote functions using leaks | pwntools.comRadare2 of the Lost Magic Gadget | 0xabe.ioReading pri memory with a side-channel | googleprojectzero.blogspot.comRecommended compiler and linker flags for GCC | redhat.comReturn to VDSO using ELF Auxiliary | .inRe C++ programs with IDA pro and Hex-rays | 0xbadc0de.beSAT/SMT by example | yurichev.comSo you want to work in security? (and for some reason ended up here rather than reading other people’s posts on the topic). | ifsec.blogspot.comSome uni gadget sequence for Linux x86_64 ROP payload | .inSmashing The Stack For Fun And Profit | phrack.orgSuper Awesome Fuzzing, Part One | f-secure.comSymbolic Execution: Intuition and ImplementationTearing apart printf() | maizure.orgTechnical aspects of CTF contest organization| cert.plThe ad return-into-lib(c) exploits: PaX case study | phrack.org • ret-into-dlThe Malloc Maleficarum | phrack.orgThe one-gadget in glibc | da.blogspot.comThe real power of Linux executables | ownyourbits.comThe Stack Clash | qualys.comThe single instruction C compiler | github.com/xoreaxeaxeaxTransforming an ELF executable into a libraryUnderstanding L1 Terminal Fault aka Foreshadow: What you need to know | redhat.comUNIX Syscalls | john-millikin.comVudo - An object superstitiously believed to embody magical powers | phrack.org hunting with Semmle QL, part 1 | microsoft.comWhat is an ELF Export? | m4b.ioWhy is My Perfectly Good Shellcode Not Working?: Cache Coherency on MIPS and ARM | senr.ioTalks/Presentations
From Kernel to VMM by Jacob Torrey ()$hell on Earth: From Browser to System Compromise by Matt Molinyawe, Jasiel Spelman, Abdul-Aziz Hariri and Joshua Smith • Black Hat USA 2016A Christmas Carol - The Spectres of the Past, Present, and Future by Moritz Lipp, Michael Schwarz, Daniel Gruss and Claudio Canella • 35C3Attacking The XNU Kernel In El Capitan by Luca Todesco () • Black Hat Europe 2015Behind the Scenes with iOS Security by Ić • Black Hat USA 2016Breaking the x86 Instruction Set by Christopher Domas () • Black Hat USA 2017Browser bug hunting - Memoirs of a last man standing by Atte Kettunen • 44CON 2013Fixing/Making Holes in Binaries by Shaun Clowes • Black Hat USA 2002Infosec and failure by Ange Albertini • Hack.lu 2017Jailbreaking iOS by tihmstar • 35C3Linux Windows Exploits: Escalating Pri with WSL by Saar Amar () • BlueHat IL 2018Modern Windows Userspace Exploitation by Saar Amar () • 35C3Pwned By The Owner: What Happens When You Steal A Hacker's Computer by Zoz • DEF CON 18The Layman's Guide to Zero-Day Engineering by Markus Gaasedelen and Amy () • 35C3Unexpected Stories From a Hacker Inside the Go by Mudge • DEF CON 21Unlocking secrets of proprietary software using Frida by Ole André Vadla Ravnås • NDC 2018Why Do Keynote Speakers Keep Suggesting That Improving Security Is Possible? by James MickensTools
AFL | lcamtuf.coredump.cxangr | angr.ioBinNavi | github.com/googleBootlin | bootlin.combowkin | github.com/integeruserBuildroot | buildroot.orgca | github.com/Antonin-DeniauCling | cern.chCompiler Explorer | godbolt.orgcrashwalk | github.com/bnagycrosstool-NG | crosstool-ng.github.iodockcross | github.com/dockcrossExodus | github.com/intoliFLARE VM | github.com/fireeyeFrida | frida.reGEF | github.com/hugsyghidra | github.com/NationalSecurityAgencyHackSys Extreme Driver | github.com/hacksysteamKLEE | klee.github.ioLIEF | github.com/lief-projectlinux-kernel-module-cheat | github.com/cirosantilliMcSema | github.com/trailofbitsODA | onlinedisassembler.comone_gadget | github.com/daosxcross | github.com/tpoechtragerpatchelf | github.com/NixOSpreeny | github.com/zarduspwndbg | github.com/pwndbgpwnjs | github.com/theori-ioPyREBox | github.com/Cisco-TalosQIRA | github.com/geohotRetDec | github.com/arr | rr-project.orgseccomp-tools | github.com/da | github.com/wapiflapiWoboq | woboq.orgZ3 | github.com/Z3Prover#### IDA
A list of IDA Plugins | github.com/onethawtA set of exploitation/re aids for IDA | github.com/1111joe1111An IDA Pro plugin to examine the glibc heap, focused on exploit de | github.com/danigarguCollaborati Engineering plugin for IDA Pro & Hex-Rays | github.com/IDArlingTeamHex-Rays Decompiler plugin for better code na | github.com/REhintsHexRaysPyTools | github.com/igogo-x86IDA 2016 plugin contest winner! Symbolic Execution just one-click away! | github.com/illera88IDA Pro utilities from FLARE team | github.com/fireeyeMake your IDA Lazy! | github.com/L4ysMulti-architecture assembler for IDA Pro. Powered by Keystone Engine. | github.com/keystone-engine项目信息
开发语言：Python
Star 数：111
技术要点
该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕My solutions to some CTF challenges and a list of interesting resources about pwning stuff展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。