https://security.cs.pub.ro/summer-school/wiki/ 2026-10-05T04:01:35+00:00 https://security.cs.pub.ro/summer-school/wiki/ https://security.cs.pub.ro/summer-school/wiki/_media/wiki/dokuwiki.svg text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/01?rev=1595152140&do=diff 0x01. Exploration Tools Resources Session 1 slides Session's tutorials and challenges archive Tutorials When faced with a binary with no source or parts of the source missing you can infer some of its functionalities based upon some basic reconnaisance techniques using various tools. 01. Tutorial - Poor man's technique: strings text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/02?rev=1595152140&do=diff Refresher. Assembly Language Resources Session slides Session's tutorials and challenges archive Session's solutions Tutorials This session will serve as a quick refresher of basic computer architecture and assembly language. For the sake of brevity, we are going to focus on x86. Also, people are generally more familiar with this one. text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/03?rev=1595152140&do=diff 0x02. Executable File Formats Resources Session 2 slides Session's tutorials and challenges archive Tutorials This session is meant to be a quick intro into how ELF files are structured from the perspective of how it all fits into creating a process.We will also analyze how the ELF structure evolves when going from object file to executable or shared library as well as how various elements get interpreted by the linker and the text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/04-gdb?rev=1595152140&do=diff Refresher. Taming GDB Although it is a powerful tool, gdb is pretty cumbersome to use by itself. Even simple tasks such as execution tracing are made difficult by the lack of “friendliness”.To overcome this, we're going to use a wrapper over gdb that greatly enhances its default functionality. This tool is called text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/04?rev=1595152140&do=diff 0x03. Static Analysis Resources Session 3 slides Get the tasks by cloning Public GitHub Repository. Setup For the tutorial and tasks below we will use GDB with PEDA (Python Exploit Development Assistance) and IDA. Configure GDB locally with PEDA by following the instructions on the GitHub page. Download text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/05?rev=1595152140&do=diff 0x04. Dynamic Analysis Resources Session 4 slides Get the tasks by cloning Public GitHub Repository. Tutorials Refresher. Taming GDB The first part of this session will give you a walkthrough of the most common GDB principles that we are going to use in exploitation. We are going to use these concepts in practice to evade a basic key evaluation program. text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/06?rev=1595152140&do=diff 0x05. Buffer Exploitation Resources Session 5 slides Session's tutorials and challenges archive Session's code snippets. Tutorials Buffers A buffer is an area of contiguous data in memory, determined by a starting address, contents and length. Understanding how buffers are used (or misused) is vital for both offensive and defensive purposes. text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/07?rev=1595152140&do=diff 0x06. Shellcodes 1 Resources To work this session, first clone/update the repository and navigate to the 07-shellcodes folder. Other resources: * Shellcode repository Initial info When creating an attack vector the attacker would usually aim to run a shellcode. However, due to program specifics and modern attack prevention mechanisms, it is uncommon for an attack to consist of a single step. There is no recipe, and an attacker will combine multiple steps and actions for the attack to be … text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/08?rev=1595152140&do=diff 0x07. Shellcodes 2 (advanced) Resources Activities repo Shellcode repository Reminder: Shellcode A shellcode is a little piece of binary data that is meant to be executed by a process as part of an attack vector. An attacker would usually place a shellcode in the process memory and aim to execute it to trigger an advantageous effect for the attacker. text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/09?rev=1595152140&do=diff 0x08. Return Oriented Programming Resources Session 08 slides Session's tutorials and challenges repo Session's solutions PLT and GOT ASLR is not the only feature that prevents the compiler and the linker from solving some relocations before the binary is actually running. Shared libraries can also be combined in different ways, so the first time you actually know the address of a shared library is while the loader is running. The ASLR feature is orthogonal to this - the loader could choos… text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/10?rev=1595152140&do=diff 0x09. Defense Mechanisms Resources Slides Get the tasks by cloning Public GitHub Repository. Tutorials The previous sessions (0x06. Shellcodes 1 and 0x07. Shellcodes 2 (advanced)) presented an exploitation scenario that is based on the assumption that machine instructions can be executed from any memory segment belonging to the process. As you can recall from text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/11?rev=1595152140&do=diff 0x0A: Information Leaks Slides Resources Session 10 slides Session's tutorials and challenges archive Stack Protection (Canaries) The name comes from canaries (birds) that were used by mining workers when entering mines and were affected by any deadly gases such as methane before humans were. In our case, stack canaries are used to check if a buffer overflow of a stack variable resulted in overriding the return address. The mechanism is based on a (sometimes random) value that is placed on… text/html 2020-07-20T14:34:54+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/12?rev=1595255694&do=diff 0x0B. Return Oriented Programming (advanced) Slides Session 12 slides Session's tutorials and challenges archive Session's solutions Setup The ROPgadget version installed in the Kali virtual machine needs to be upgraded to work properly. Please use the command below (as root) before starting this session and using ROPgadget: pip install --upgrade ropgadget text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/ctf-final?rev=1595152140&do=diff Final CTF The final CTF for the 2nd edition of the Security Summer School will take place on Saturday, July 23, 2016, from 9:30am to 9:30pm. You will have access to drinks and food in room PRECIS 706. We will order food for lunch. You may also work remote. text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/mid-ctf?rev=1595152140&do=diff Mid-term CTF Teams During the CTF, you will be divided in teams. The list of teams is available in the Participants page. Tasks The tasks for the CTF are available in the CTF Platform. Each team must create only one account and all the members of the team will use the account to login and submit solutions. text/html 2020-07-19T09:49:00+00:00 Anonymous (anonymous@undisclosed.example.com) https://security.cs.pub.ro/summer-school/wiki/session/start?rev=1595152140&do=diff Sessions session index