Exploit › Module 6 › Lesson 3
Triage Not Weaponize
Triage memory findings on $PWN_LAB — classify bug class, assess impact literacy, refuse weaponization and stranger targeting.
Visual · t24_triage_not_weaponize
Triage = classify and refuse weaponize. $PWN_LAB. Original Cyberlium.
Opening
Not every crash becomes an exploit — triage tells defenders what to fix first.
Triage transforms crash observation into defender-ready literacy: name corruption class (stack BOF, heap UAF, format string — from Module 2), note protections present (Module 4 checksec), estimate impact in plain language ('memory corruption on stack in toy — would need bypass of NX/canary for code exec — not demonstrated here'), recommend remediation (safe API, compiler flags from Module 5). Explicit refuse: weaponized PoCs, ROP recipes, shellcode, pwntools attack scripts against strangers, 'pop a shell' homework, publishing exploit bytes. Cyberlium teaches triage cards on YOUR $PWN_LAB toys — the output is a finding draft for reporting module, not a HackTheBox invasion kit. When asked to weaponize, answer: refused — triage and remediate on MY lab only.
1. Triage row template
Fields: bug class, repro input, signal, protections, impact literacy (no exploit proof), remediation first.
Severity for toy: learning severity — 'would be critical if shipped to prod without fix' without demonstrating takeover.
Command guide
Try these commands — Triage row template
═══ LINUX (Binary Analysis & Reverse Engineering) ═══
Disassemble main function using Intel assembly syntax
Command — copy this
objdump -d -M intel -j .text ./target_binary 2>/dev/null | head -30
Check binary security mitigations (NX, Canary, ASLR, PIE)
Command — copy this
checksec --file=./target_binary 2>/dev/null || readelf -l ./target_binary | grep GNU_STACK
Generate unique cyclic pattern for buffer overflow offset calculation
Command — copy this
python3 -c "
from itertools import product
chars = [b'A', b'B', b'C']
pattern = b''.join(b''.join(p) for p in product(b'ABCDEFGHIJKLMNOPQRSTUVWXYZ', b'abcdefghijklmnopqrstuvwxyz', b'0123456789'))[:128]
print('Cyclic Test Pattern (128 bytes):', pattern.decode())
"GDB debugging session quick start gdb -q ./target_binary (gdb) disassemble main (gdb) info registers
Primary tools to practice this lesson: grep, python3. Reference sites: CWE triage (https://cwe.mitre.org/data/definitions/119.html); NVD (https://nvd.nist.gov/); Microsoft SDL (https://learn.microsoft.com/en-us/security/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Refuse list (explicit)
ROP chains, shellcode, ret2libc step-by-step, pwntools interactive exploit, targeting production/strangers.
If CTF brief allows pwn later, it is separate authorized track — this topic stops at triage literacy.
3. Defender handoff
Triage card feeds Module 9 report: observed crash + class + fix recommendation.
Purple note: what detection or hardening would have shortened time-to-fix.
4. What you ship: triage-not-weaponize card
Triage row template + six-item refuse list + remediation-first line.
5. What you record before the next lesson
Triage-not-weaponize card path.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Submit triage card with shellcode appendix 'for completeness.'
Right
Triage card refusing weaponization on $PWN_LAB toy. Next: Crash Lab.
Mission: triage-not-weaponize card
1) Write triage row fields. 2) List six refused weaponization items. 3) Draft triage for YOUR toy crash. 4) Write refusal script for exploit request.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Impact sentence without exploit proof?”
Knowledge Check
APPLY: Triage on Cyberlium produces:
Multiple choice
Knowledge Check
APPLY: True or False: Shellcode appendix belongs in triage card.
True or False
Knowledge Check
APPLY: When asked to weaponize a toy crash you:
Multiple choice