Dummy Vulnerable C App

This repository is an intentionally vulnerable local training target. It builds a tiny C program with a stack overflow and a hidden win() function that spawns /bin/sh when reached.

Use it only in an authorized local lab.

Build

make

The binary is written to build/vuln.

Run

./build/vuln

The program prints the address of win() and then reads too much input into a fixed-size stack buffer. The build disables common protections that would otherwise make this beginner lab less predictable:

• no stack canary
• no PIE
• executable stack
• debug symbols enabled

Exploitation Direction

This is a ret2win-style challenge:

1. Find the offset from the start of the input to the saved return address.
2. Overwrite that saved return address with the printed win() address in little-endian form.
3. Return from vulnerable() into win() to spawn a shell.

On a typical x86_64 build of this program, the offset is expected to be 72 bytes: 64 bytes for the buffer plus 8 bytes for the saved frame pointer.

Python PoC

Run the included local exploit proof of concept:

make exploit

The PoC uses pwntools, parses the printed win() address, sends 72 bytes of padding plus that address, and then drops into an interactive shell. Type exit to quit.

For automated proof runs, you can execute a single shell command instead:

python3 exploits/poc.py --command 'whoami'