无心插柳

AboutThere is a security check that prevents the program from continuing execution if the user invoking it does not match a specific user id.To do this level, log in as the level13 account with th

AboutThere is a backdoor process listening on port 50001.To do this level, log in as the level12 account with the password level12 . Files for this level can be found in /home/flag12. 1local

The flag07 user was writing their very first perl program that allowed them to ping hosts to see if they were reachable from the web server.To do this level, log in as the level07 account with the p

Aboutstrace the binary at /home/flag15/flag15 and see if you spot anything out of the ordinary.You may wish to review how to "compile a shared library in linux" and how the libraries are loaded an

http://www.exploit-exercises.com/nebula/level16AboutThere is a perl script running on port 1616.To do this level, log in as the level16 account with the password level16 . Files for this lev

AboutAnalyse the C program, and look for vulnerabilities in the program. There is an easy way to solve this level, an intermediate way to solve it, and a more difficult/unreliable way to solve it.

详细分解Hydra用于测试 DVWA Brute Force模块， 清晰解析了如何使用Hydra来进行http的暴力美学破解

通过protostar stack7来入门最简单的ROP exploit

黑客入门基本技能，重要的是思想和思考问题的方法，通过做题来一步一步达到一个脚本小子的水平。

Level 02 introduces nonexec stack and heap to go with the ASLR.#include "../common/common.c" #define XORSZ 32void cipher(unsigned char *blah, size_t len){ static int keyed; static unsign

sqlmap初步使用，测试环境为dvwa

AboutThe /home/flag11/flag11 binary processes standard input and executes a shell command.There are two ways of completing this level, you may wish to do both :-)To do this level, log in as the lev

http://exploit-exercises.com/nebula/level10AboutThe setuid binary at /home/flag10/flag10 binary will upload any file given, as long as it meets the requirements of the access() system call.T

http://exploit-exercises.com/nebula/level09There's a C setuid wrapper for some vulnerable PHP code...To do this level, log in as the level09 account with the password level09 . Files for this

esp是栈指针，是CPU机制决定的，push、pop指令会自动调整esp的值又因为函数的参数和局部变量，其实是与进入函数那时的esp相关的，但由于esp在函数运行中会不停的变，因此保存当前esp到一个ebp中保持不变，后续用ebp来访问参数和局部变量就很清楚。而且还方便于调试器分析函数调用过程中的堆栈情况。这个ebp也不是必须的，实际esp虽然不停在变，但具体变化编译器是可

Zuckerberg如此定义“The Hacker Way（黑客之道）”：黑客之道是持续进步和创新之道。黑客永远相信更好，没有什么是完美的。黑客要做的就是“修补”，尤其是当直面众人质疑的时候，然后告诉他们：黑客的字典中没有“不可能”和“满足现状”这两个词。

There is a vulnerability in the below program that allows arbitrary programs to be executed, can you find it?To do this level, log in as the level02 account with the password level02 . Files for t

http://exploit-exercises.com/nebula/level04This level requires you to read the token file, but the code restricts the files that can be read. Find a way to bypass it :)To do this level, log

http://exploit-exercises.com/nebula/level05From the description we get one hint: weak permissions. And this is sufficient to easily solve this challenge.First things first navigate to /home/flag05

最近发现了一个练习漏洞发掘的好东西exploit-exercises，走进去看了看，恰好适合我这种什么都不懂的新手有对此特别感兴趣的，就打算跟着一步一步的开始练习了。如果全部练习都能通过的话，也可以算linux hack 入门了 。首先介绍一下这个练习的环境以及方向，需要具备的基本知识体系。网站提供的练习平台是在虚拟机下的ubuntu 字符界面。1.只有字符界面而没有图形界面，所以

“(…) account credentials came from a legacy unix system” mhm:$ cat /etc/passwd(...)flag06:ueqwOCnSGdsuM:993:993::/home/flag06:/bin/sh(...)Ah, good old DES:$ echo ueqwOCnSGdsuM

首先从nebula开始，nebula设置了19个level，level00-level19，每一个level对应系统中的一个登陆账号，每一个level也对应home目录下的flag00-flag19这些账号。一般来说如果你能用levelXX登陆，经过提权你的账号变成了flagXX，就表示你过关了。下面会将每一个level的要求以及相关的代码列出来，我自己的解决办法和涉及到得知识点也会列出来

There is a vulnerability in the below program that allows arbitrary programs to be executed, can you find it?To do this level, log in as the level01 account with the password level01 . Files for t

http://exploit-exercises.com/nebula/level08World readable files strike again. Check what that user was up to, and use it to log into flag08 account.To do this level, log in as the level08 acco

http://exploit-exercises.com/nebula/level03Check the home directory of flag03 and take note of the files there.There is a crontab that is called every couple of minutes.To do this level, l

Openssl 漏洞POC学习