Faculty of engineering,

Environment and Computing

Module: 6048CEM Exploit Development

Assignment Brief

Module Learning Outcomes Assessed

• 1. Examine, analyse and test programs for security vulnerabilities

• 2. Evaluate the features of an operating system or programming language that can mitigate the impact of a security exploit.

• 3. Make use of existing "off the shelf" exploits and shell code to compromise a program.

• 5. Design, develop and implement programs in different programming language for exploiting vulnerabilities in various platforms

Task and Mark Distribution

CW2: Report Providing a security assessment of a piece of vulnerable software, and development and evaluation of Proof Of Concept Exploit, with code for this exploit

Coursework Overview

For this coursework you are required to develop exploits for three target applications, providing exploit code for each of the targets. You will also need to produce a short report, giving details of the exploit code you have developed.

Target Machine.

You can download the target machine using the link on Aula.

When configuring the machine you must use your university email address failing to do this may result in 0 marks being awarded.

Exploit Development

For each of the targets you will need to develop an appropriate exploit, this should be in the form of an automated solve script (using pwntools or similar).

The solve script should automate the exploit process, dropping a shell on the remote target, and retrieving the flag.

The solve script should be well commented, and run (as much as possible) without requiring user intervention. If user input is required, there should be clear instructions on how the required information can be found.

Flags are text files, and can either be found in:

• /

• /root

Report

As well as individual exploit scripts, you will need to include a brief overview of the exploit development process, as well as instructions for running the exploit against the target.

The report will include instructions for setting up and running the script (for example, finding relevant offsets). You should also include a demonstration of the script running along with details of any flags found.

Submission Instructions

Your Final Submission should consist of

• Solve Scripts for Each of the Exploits (3 python files)

• Summary Report (word / pdf)

Marking Scheme

Overall Marking Scheme

100         Working Exploit Script provided, Clear documentation on setting up and running the script