billy-ellis / exploit-challenges

A collection of vulnerable ARM binaries for practicing exploit development

Exploit-Challenges

Here are a collection of vulnerable ARM binaries designed for beginner vulnerability researchers & exploit developers to play around with and test their skills!

These binaries are all built as ARMv7 Mach-O executables (unless specified otherwise) so it is recommended that you use a 32bit jailbroken iOS device with radare2 or another debugging utility installed to test them.

ARM 32-bit

roplevel1 - simple introduction to Return Oriented Programming with a simple objective

roplevel2 - same idea as level 1 but with a new objective

roplevel3 - more advanced use of ROP

roplevel4 - dealing with ASLR (infoleak)

roplevel5 - same as lvl4 but requires exploitation of format string vuln for the info leak

roplevel6 - execute ROP chain by making use of a stack pivot

roplevel7 - off-by-one vulnerability

heaplevel1 - simple heap based overflow example

heaplevel2 - Use-After-Free exploit

heaplevel3 - double free()

Xylex - real-world(ish) example system

ARM 64-bit

roplevel1-64 - 64-bit version of roplevel1

roplevel6-64 - 64-bit version of roplevel6

Help & Guidance

Write-ups/explanations on some of the binaries can be found on my YouTube channel here or in my book Beginner's Guide to Exploitation on ARM.

If you have any questions or requests for future exploitation challenges, tweet me @bellis1000

exploit-challenges's Issues

Bad CPU type in executable

Prozessor : 2,3 GHz Intel Core i5

xylex not working

xylex isnt working at all,,,,, code looks weird

Convert the 32 bit executables to 64 for modern devices

[Title]

Where is HeapLevel4

In your book section Heap Feng Shui describes an attack on HeapLevel4 but there there is no code in the git ? Can you upload it ?

Killed 9

iPod-touch:/var/mobile/Developer root# ls
Xylex.zip __MACOSX/ readme.txt xylex*
iPod-touch:/var/mobile/Developer root# ./xylex
Killed: 9
iPod-touch:/var/mobile/Developer root#

What's going on?!

Book availability

re: https://www.reddit.com/r/ReverseEngineering/comments/151z0xe/looking_for_beginners_guide_to_exploitation_on/

@Billy-Ellis are your books still available ?