Attack Lab

The Attack Lab was divided into five phases, each focusing on different aspects of security exploits, from basic code injection to advanced return-oriented programming (ROP). The goal was to understand how attackers exploit weaknesses in software and to gain the skills necessary to write more secure code. Below I will describe the puzzles and the technical skills and tools I've utilized.

Code Injection Attacks:

• Phase 1: Redirected program execution to an existing function (touch1) by manipulating the return address on the stack.
• Phase 2: Injected code to call another function (touch2) with a specific argument, modifying the stack to pass the correct value.
• Phase 3: Injected code to call a third function (touch3) with a string argument, ensuring the string was correctly placed on the stack.

Return-Oriented Programming (ROP):

• Phase 4: Used gadgets (existing instruction sequences ending in ret) from the program’s code to replicate the Phase 2 attack without injecting new code.
• Phase 5: Performed a complex ROP attack to call touch3 with a string argument, using a sequence of gadgets to manipulate the stack and registers.

Completing the Attack Lab has equipped me with a solid foundation in cybersecurity and low-level programming. The skills and knowledge I gained are essential for identifying and mitigating security vulnerabilities in software. This experience not only strengthened my technical abilities but also underscored the importance of writing secure and reliable code.

• Cybersecurity
• Buffer Overflow Exploits
• Code Injection
• Return-Oriented Programming (ROP)
• x86-64 Machine Code
• Stack Manipulation
• Programming Security
• Assembly Language