ABE – Applied Binary Exploitation
Contact
For questions, remarks and complaints, please contact placeholder@example.com.
Administrative notes
This is the website for the module MA-INF 3322 Applied Binary Exploitation.
You may take this course even if you have passed BA-INF 148 Program Analysis and Binary Exploitation (PABE) during your bachelor’s.
You cannot take this course if you have already passed MA-INF 3322 Program Analysis and Binary Exploitation (PABE).
Note: This time the lecture will be hybrid. The lectures will be recorded. Exercise meetings will not be recorded.
Time and Location
The lectures take place on Fridays 12-14 CEST. The first lecture takes place on Friday, 2023-04-14.
Tutorials take place on Fridays 14-16 CEST. The first tutorial takes place on Friday, 2023-04-21.
Note that tutorials only take place every other week (see schedule below).
Online participation is possible via BBB.
Lectures and tutorials take place in Hörsaal 4 / HS IV in the Geozentrum. The lecture hall is located on the second floor / top floor of the Geozentrum building at Meckenheimer Allee 176, directly above Hörsaal 2. Sadly, the available floor plans do not include the second floor, and sometimes only Hörsaal 2 is mentioned on the signs in the building.
Floor plans and location (scroll down to “Geozentrum”): https://www.geographie.uni-bonn.de/en/department-1/sites/sites
The entrance to the stairwell to the lecture hall is located at the back of the building, and only accessible from the backyard. You cannot access the lecture hall from inside the building. You can enter the backyard directly from Katzenburgweg, or you can enter the building at the front from Meckenheimer Allee and exit at the back again.
Schedule
This preliminary schedule is of course subject to change.
| Nr | Date | Lecture Topics | Exercises |
|---|---|---|---|
| 0 | 2023-04-14 | Welcome! Administrative Remarks; Binary Analysis Recap | Sheet 0 released |
| 1 | 2023-04-21 | Vulnerability Research and Bug Hunting (source code) | Sheet 0 Tutorial, Sheet 1 released |
| 2 | 2023-04-28 | Vulnerability Research and Bug Hunting (binaries) | |
| 3 | 2023-05-05 | Basic Binary Exploitation: Stack-based Buffer Overflows, Overwrite, Calling Convention, ret2libc | Sheet 1 Tutorial, Sheet 2 released |
| 4 | 2023-05-12 | Basic Binary Exploitation: ROP | |
| 5 | 2023-05-19 | Advanced Binary Exploitation: SROP, ret2csu, ASLR | Sheet 2 Tutorial, Sheet 3 released |
| 6 | 2023-05-26 | Advanced Binary Exploitation: Shellcode | |
| 2023-06-02 | - no lecture - | ||
| 7 | 2023-06-09 | Format strings, Heap internals | Sheet 3 Tutorial, Sheet 4 released |
| 8 | 2023-06-16 | Heap use-after-free | |
| 9 | 2023-06-23 | Heap glibc | Sheet 4 Tutorial, Sheet 5 released |
| 10 | 2023-06-30 | Heap glibc | |
| 11 | 2023-07-07 | Heap glibc; Exim exploit | Sheet 5 Tutorial |
| 12 | 2023-07-14 | Exim exploit |
Exams
The information in this section is definitive, and only subject to change if either external forces demand it, or if a typo is spotted. In that case, changes will explicitly be announced on the mailing list.
- The exams will be oral exams.
- The exams will take place at Zanderstraße 5, 53177 Bonn-Bad Godesberg.
- There will be two exam periods.
- The first exam period will be during calendar week 32, on the dates 2023-08-07, 2023-08-08, and 2023-08-09 (Monday to Wednesday).
- Timeslots will be assigned after the last exercise sheet has been graded. You will receive an email asking you for your availability.
- The second exam period will be during calendar week 36, on the dates 2023-09-04 and 2023-09-05 (Monday and Tuesday).
- Timeslots will be assigned after the first exam period. You will receive an email asking you for your availability.
Exam location
The exam takes place at the Fraunhofer FKIE, Zanderstraße 5, 53177 Bonn-Bad Godesberg. Map of the location
You probably want to take the public transport to Bad Godesberg Stadthalle and walk the ~350m to the building.
You have been assigned a time slot for your oral exam and received it via email. Please arrive a few minutes before your slot starts, and plan your travels accordingly. If you know you are running late and have the means to send us an email, please do.
Once you arrive, ring the doorbell left of the revolving door, and the doorkeeper will let you in. Tell the doorkeeper that you are here for the ABE exam. They will direct you towards the exam room “Gronau”, which is located at the ground floor on the left side from the entrance.
Exam procedure
If the door of the exam room is closed, please wait in front of the room until you are invited in.
There will be multiple people: The professor, a second interviewer, and a third person who types the examination protocol.
At the very beginning, we will check your student ID and ID card or passport. So remember to bring those with you :)
We will spend about 20 minutes quizzing you about the lecture contents (might be a bit more or less depending on how it goes). This is aided by some slides (usually from the lecture material) that we can put on a display in the room. It is always a good idea to let us know what you think (instead of saying nothing) even if you don’t have the answer yet. It’s also okay to honestly say that you did not learn a specific topic, so we can move on to something else.
Once the exam is over, we send you out of the room for a short while to discuss your grade.
Then you may come back in, collect your grade, chat a bit, and leave again through the same door you came in.
What kind of questions will be asked?
-
We show you an exploit (probably in Python) and you have to explain what kind of exploit it is and how it works, what the bug class is and how exploits of that kind work in general.
-
We show you some code (C or ASM), you tell us what it does and how to find an exploit. Also, what is special about this kind of exploit? What are the constraints?
To summarize: We will mostly ask technical questions instead of broad and generic questions. The code snippets will have a manageable size! Just have a look at this example: https://godbolt.org/z/nq6GYK. Check out the C code and the Assembly. Use the colors to match the C code to the machine code instructions.
How do I know if I am well prepared?
If you invested the time to do the exercises you should be safe. If not, try to solve some of them before the exam and really understand what you are doing. It’s also a very good idea to imagine what we could ask you and try to answer the question to yourself. Often you will notice if you are able to explain everything smoothly or if you still have a knowledge gap.
Description
Our computers run a lot of closed source binary programs meaning that the source code of those programs is not available. Naturally, those programs contain bugs, mistakes that the programmer made during the development. Those bugs could (under certain circumstances) be exploited by attackers and thus may lead to arbitrary code execution. In this lecture we aim to teach you how to find well known exploitable bugs and how to exploit them. After a brief recap of basic binary program analysis such as static and dynamic analysis, we will talk about vulnerability discovery in general, meaning that you will learn how to find exploitable bugs by yourself. Next we move on to basic stack-based buffer overflows and add mitigation techniques (stack cookies, NX, ASLR, RELRO, …) as we progress and exploit them as well. After we finished the topic of stack-based buffer overflows we move on to more advanced topics such as heap exploitation, use-after-free exploits and others. The lecture ends with an analysis of a sophisticated real-world exploit.
Between the first and the second exam phase there will be a guest lecture from a renowned expert. Past guest lecturers were:
2023: Robert Xiao (@nneonneo): Exploiting a Filesystem Driver in a Kernel CTF Challenge
2021: Claudio Guarnieri (@botherder): A talk about journalists, human rights defenders and dissidents that face increasingly sophisticated digital threats and what to do about it.
2020: Maddie Stone (@maddiestone): Reversing the Root: Identifying the Exploited Vulnerability in 0-days Used In-The-Wild
2019: Gynvael Coldwind (@gynvael): Notes on Computer Hardware and Security
2018: Thomas Dullien (@halvarflake): Fundamentals of Security Exploits