Welcome to The Pentester’s 64-Bit AppSec Primer and challenge.
Here at The Pentesters, we have a passion for application security and all that goes with it. We think that application security is an extremely important part of the field of information security and have, “made it our business” so to speak to provide a means of education into modern-day application security. With modern computing becoming more and more advanced, and the requirements for understanding the functionality and security behind said computing becoming equally as challenging to understand, we figured that perhaps giving a set of challenges dedicated to learning the mere basics of 64 bit appsec would be beneficial to the security community.
The 64-Bit AppSec Primer consists of 16 challenges, increasingly more difficult than the previous one, dedicated to learning the basics of 64 bit binary exploitation and reverse engineering. The x64 instruction set, as you would expect, has many new instructions, registers, and calling conventions in comparison to the traditional x86 instruction set. Our goal, with this challenge, is to get you inside a debugger with intentionally vulnerable binaries, and get you looking at the inner-workings of a 64 bit binary. Alongside the increasing complexity of the instruction set, is an equally complexity of exploitation, which as a penetration tester and security engineer, will prove useful to understand.
The challenges consist of varying vulnerabilities and anti-debugger tricks in binaries, such as:
- Stack-based Buffer Overflows
- Format String Vulnerabilities
- Heap-based Buffer Overflows
- Detection of tracing
- Insecure validation of credentials
- and more… don’t want to give you all the good details eh?
As a bonus, we would like to contribute back to the security community. We are donating the VM to Vulnhub, for all to have, and we are also offering prizes to three people who gives us the most robust and complete write-up for the challenges. In order to qualify for the prizes, you must post your write-up on either your personal blog, or website (your choice), and post a link to http://thepentesters.net/challenge/ along with your username. If you are unable to solve all of the challenges, that is okay, we will still accept your write-up for judging, we still want to see what you completed and how you did it. Here are the prizes:
- 1st Place gets $150.00
- 2nd Place gets $75.00
- 3rd Place gets $25.00
The challenge ends on August 31st, 2016. All write-ups must be submitted by then, whoever has written the best write-up with the most detailed explanations wins. The judging will be done by our pentesting team.
Also, I would like to note a couple rules for the reverse engineering challenges.
- The challenge must be solved without attacking the encryption of the flag. Spoiler, I used a basic XOR encryption for most of them so they do not show up in strings. So, that is off-limits. The goal is to break the logic of the application.
- Some challenges have several ways of solving and we would like to see how you did it. My C coding skills are most certainly not expertise, but I feel as if this will prove to be a good exercise for many in regards to exploit development and reverse engineering.
- All else is fair game!
Note: ASLR must be disabled, log in as level17:madpwnage, and run “echo 0 > /proc/sys/kernel/randomize_va_space”. Also, challenge 3, is only a DoS challenge. This is the beta, so there are still glitches. If you find any, please contact me at [email protected] with your discovery.
There are a couple challenges that don’t have “flags” but you will know when you have solved those, please note your findings and take screen-shots of them as well. As for the VM, you are to ssh in as user n00b and password n00b where you will find gdb-peda installed for you to make your life easier. The VM gets its IP through DHCP and is set to host-only adapter in VMware, so it should work for you straight out of the box so to speak. That is all I have for you and I hope you enjoy.
