exploit_me
Very vulnerable ARM/ARM64[AARCH64] application (CTF style exploitation tutorial, portable to other platforms) (c) B.Kerler 2018-2020 Why: Some of my friends asked me if I could do some examples of exploitable stuff I've seen in real-world the past years for ARM/ARM64[AARCH64]/others. So, for training purposes, I thought: Why not :) Current vulnerabilities: Level 1: Integer overflow Level 2: Stack overflow Level 3: Array overflow Level 4: Off by one Level 5: Stack cookie Level 6: Format string Level 7: Heap overflow Level 8: Structure redirection / Type confusion Level 9: Zero pointers Level 10: Command injection Level 11: Path Traversal Level 12: Return oriented programming (ROP) Level 13: Use-after-free Level 14: Jump oriented programming (JOP) Install on Debian/Ubuntu System: Download the repo git clone https://github.com/bkerler/exploit_me Install needed tools on host (Ubuntu) ~$ cd exploit_me ~/exploit_me $ ./script/setup.sh Usage hints: See hints.txt for a start. For trying if it works : *** 32-Bit: $ ./bin/exploit *** 64-Bit: $ ./bin/exploit64 Example debugging session: $ sudo ./scripts/disableaslr.sh (Disable aslr, don't run if you want more fun) (Path dir1/dir2 n
FEATURES
ALTERNATIVES
An image with commonly used tools for creating a pentest environment easily and quickly, with detailed instructions for launching in a VPS.
A tool for interacting with Exchange servers remotely and exploiting client-side Outlook features.
Adversary emulation framework for testing security measures in network environments.
Abusing SCF files to gather user hashes from an unauthenticated writable Windows-based file share.
A collection of payloads and methodologies for web pentesting.
A blog post about abusing exported functions and exposed DCOM interfaces for pass-thru command execution and lateral movement
Interactive online malware sandbox for real-time analysis and threat intelligence
PINNED
InfoSecHired
An AI-powered career platform that automates the creation of cybersecurity job application materials and provides company-specific insights for job seekers.
Fabric Platform by BlackStork
Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.
Mandos Brief Newsletter
Stay ahead in cybersecurity. Get the week's top cybersecurity news and insights in 8 minutes or less.
System Two Security
An AI-powered platform that automates threat hunting and analysis by processing cyber threat intelligence and generating customized hunt packages for SOC teams.
Aikido Security
Aikido is an all-in-one security platform that combines multiple security scanning and management functions for cloud-native applications and infrastructure.
Permiso
Permiso is an Identity Threat Detection and Response platform that provides comprehensive visibility and protection for identities across multiple cloud environments.
Wiz
Wiz Cloud Security Platform is a cloud-native security platform that enables security, dev, and devops to work together in a self-service model, detecting and preventing cloud security threats in real-time.
Adversa AI
Adversa AI is a cybersecurity company that provides solutions for securing and hardening machine learning, artificial intelligence, and large language models against adversarial attacks, privacy issues, and safety incidents across various industries.