Exploit › Module 7 › Lesson 4
Lab — CTF Notes
CTF awareness lab on $PWN_LAB — notes on pwn types, pwntools named, checksec on YOUR toys; no exploit scripts.
Visual · t24_ctf_lab
Lab: CTF awareness + checksec on YOUR toys. Original Cyberlium.
Opening
Document what kind of pwn challenge your toy would be — and what protections checksec shows — without firing a payload.
On YOUR $PWN_LAB toy binaries from Modules 4–5: (1) run checksec-class review (readelf, hardening flags) per toy; (2) label each toy with pwn CTF type name if it were a challenge (stack/heap/format/misc); (3) one-page CTF rules acknowledgment; (4) pwntools awareness note — library named, not used for weapon script here; (5) link toys to Module 6 crash observation if crashed; (6) chmod 600 pack. Optional: read one public CTF pwn writeup abstract for vocabulary — no copying exploit steps. No remote attacks, no pwntools deliverable, no shellcode.
1. checksec on toys
Table: toy name, NX, PIE, canary, RELRO — from Module 4 literacy commands.
Relate protections to crash observation: canary caught toy overflow — document.
Command guide
Try these commands — checksec on toys
═══ LINUX (Binary Analysis & Reverse Engineering) ═══
Disassemble main function using Intel assembly syntax
Command — copy this
objdump -d -M intel -j .text ./target_binary 2>/dev/null | head -30
Check binary security mitigations (NX, Canary, ASLR, PIE)
Command — copy this
checksec --file=./target_binary 2>/dev/null || readelf -l ./target_binary | grep GNU_STACK
Generate unique cyclic pattern for buffer overflow offset calculation
Command — copy this
python3 -c "
from itertools import product
chars = [b'A', b'B', b'C']
pattern = b''.join(b''.join(p) for p in product(b'ABCDEFGHIJKLMNOPQRSTUVWXYZ', b'abcdefghijklmnopqrstuvwxyz', b'0123456789'))[:128]
print('Cyclic Test Pattern (128 bytes):', pattern.decode())
"GDB debugging session quick start gdb -q ./target_binary (gdb) disassemble main (gdb) info registers
Primary tools to practice this lesson: curl, python3, grep. Reference sites: pwn.college (https://pwn.college/); docs.pwntools.com (https://docs.pwntools.com/en/stable/); LiveOverflow (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. CTF type labels
Assign literacy label per toy — 'would be stack pwn toy if published as CTF' — no remote service.
Cross-link Module 2 corruption class name.
3. Integrity
Rules checklist signed; pwntools: named not shipped; zero exploit scripts in folder.
Honest N/A if no CTF enrollment yet — awareness notes still valid.
4. What you ship: CTF awareness lab pack
checksec table + CTF type labels + rules ack + pwntools awareness — chmod 600.
5. What you record before the next lesson
CTF awareness lab pack path.
6. Wrong vs right: weaponized exploits vs memory-safety literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
CTF lab deliverable is pwntools remote exploit script.
Right
CTF awareness lab pack on $PWN_LAB toys. Next: quiz.
Mission: CTF lab
1) checksec table for ≥2 toys. 2) CTF type label each. 3) Rules checklist signed. 4) pwntools awareness note; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “checksec N/A on bare metal toy?”
Knowledge Check
APPLY: CTF lab includes:
Multiple choice
Knowledge Check
APPLY: True or False: Shellcode required in CTF awareness lab.
True or False
Knowledge Check
APPLY: pwntools in this lab is:
Multiple choice