Welcome to the CreativePwning Project!

Note

This project is under active development.

Contents

• Introduction
  • What is this about?
  • Who is this for?
  • How this book is organized
  • What architecture(s) this book covers
  • What you need to try the exercises
  • Reporting Bugs, errors, etc.
• Chapter 1: Setting arbitrary values into registers
  • Introduction
  • Setting an arbitrary value into RAX
    • Re-purposing a function within the binary
    • Re-purposing a libc6 function
    • Leveraging function side-effects
    • List of common libc6 functions that sets RAX to a certain value
• Chapter1: Exercises
  • Exercise1 (creativepwning/chapter1/ex1)
  • Exercise2 (creativepwning/chapter1/ex2)
  • Exercise3 (creativepwning/chapter1/ex3)
  • Exercise4 (creativepwning/chapter1/ex4)
  • Exercise5 (creativepwning/chapter1/ex5)
• Chapter 2: Spawning shells creatively
  • Introduction
  • Spawning a shell when leaking is not an option without using ret2dlresolve
    • 1. Have a look at the got table
    • 2. Search for a function that has the syscall opcode
    • 3. Pick one that does not crash the program and overwrite its got entry
    • 4. Find a way to set 0x3b into RAX
    • Good libc6 stubs with syscall
  • Dumping code
    • Dumping code with puts
    • Inputting addresses to leak with gets
    • What to look for
  • Overwriting functions in the got to “transform” one into another without leaks
    • Libc6 functions and their offsets
• Chapter2: Exercises
  • Exercise1 (creativepwning/chapter2/ex1)
  • Exercise2 (creativepwning/chapter2/ex2)
  • Exercise3 (creativepwning/chapter2/ex3)
  • Exercise4 (creativepwning/chapter2/ex4)
  • HTB Finale
  • HTB Void from CyberApocalypse 2023
• HTB active challenge LoginSimulator
• Writeups
  • Contents
    • HTB Void writeup
      • Challenge
      • Intended way
      • My way
        • Analysis
        • Overwriting read
        • Adding instead of overwriting
        • Exploit