Exploit Development

Assignment Task

Coursework Overview

Assignment Type: Standard

For this coursework you are required to develop exploits for three target applications, providing exploit code for each of the targets. You will also need to produce a short report, giving details of the exploit code you have developed.

Learning Outcome 1: Examine, analyse and test programs for security vulnerabilities

Learning Outcome 2: Evaluate the features of an operating system or programming language that can mitigate the impact of a security exploit.

Learning Outcome 3: Make use of existing "off the shelf" exploits and shell code to compromise a program.

Learning Outcome 5: Design, develop and implement programs in different programming language for exploiting vulnerabilities in various platforms

Target Machine.
When configuring the machine, you must use your university email address failing to do this may result in 0 marks being awarded.

Exploit Development
For each of the targets you will need to develop an appropriate exploit, this should be in the form of an automated solve script (using pwntools or similar).

The solve script should automate the exploit process, dropping a shell on the remote target, and retrieving the flag.

The solve script should be well commented, and run (as much as possible) without requiring user intervention. If user input is required, there should be clear instructions on how the required information can be found.

Flags are text files, and can either be found in:
•/
• /root

Report
As well as individual exploit scripts, you will need to include a brief overview of the exploit development process, as well as instructions for running the exploit against the target.

The report will include instructions for setting up and running the script (for example, configuring addresses for remote shells etc.)

You should also include a demonstration of the script running along with details of any flags found.

Submission Instructions
Your Final Submission should consist of:

- Solve Scripts for Each of the Exploits (3 python files)
- Summary Report (word / pdf) Marking Summary

Element Marks Available
Exploit for Target 1 40
Exploit for Target 2 30
Exploit for Target 3 30

Submission Instructions:

Submit the coursework by the due date using the link on Aula.

Your assignment should be submitted as a single document (i.e. Word, PDF or Markdown)

If you make use of additional materials (such as GitHub, or supporting videos) you should include a clear link to the supporting material in your report.

Important: In the case of GitHub repositories, they should be set to private, with the relevant teaching staff added as collaborators. Having a publicly available repository could lead to an academic misconduct case being raised against you, as people have been known to steal work from other students repost.