hvoecking/exploit-exercises-solutions

Exploit Exercises Solutions

The Exploit Exercises are really fun to play with. I spent a few minutes up to a few hours on each of the levels. I created these scripts to keep a documentation as a working example at hand to know exactly which steps were necessary to solve each challenge. If you see any improvements to my solutions, feel free to suggest them ;)

Setup

Go to https://exploit-exercises.com/ and download the VM.

Network

One way to make the machine available over the network is to choose 'NAT', select 'cable connected' and forward the SSH port to your local network interface:

Name: SSH
Protocol: TCP
Host IP: 127.0.0.1
Host Port: 22022 (you are free to choose whichever free port between 1024 and 65535 you like)
Guest IP: You got to figure this one out yourself, eg. log into the machine and run 'ifconfig'.
Guest Port: 22

Run

E.g. to solve level nr 5 of the nebula challenge run:

./run localhost 22022 nebula 05

Disclaimer

I decided to script the solutions in bash because it's really straight forward to do. However, since we're talking about security here, bash is a very fragile language when it comes to security, as you will also learn during the challenges. I did not (yet) focus on making them safe, I might improve them in the future, but for now, if you want to use bash in the wild don't follow my sloppy code style here.