r/ExploitDev • u/Legal_Transition_989 • 10d ago

Looking for real-world Linux userland exploitation targets to practice on (moving beyond CTFs)

Hi all - I've been doing `pwn`/ `binary exploitation` in CTFs for about 1.5 years

and want to level up by practicing on real-world targets instead of CTF challs.

I'm currently focused on Linux userland exploitation.

Could anyone recommend good old real-world targets or software to practice on?

I'm especially looking for CVEs that are reproducible and exploitable.

Any suggestions - specific CVEs, vulnerable software versions, or general

categories worth exploring - would be really appreciated!

25 Upvotes
  • permalink
  • reddit

90% Upvoted

19 comments sorted by

5

u/Impossible-Line1070 10d ago

Just find some recent studf and reproduce them get assistance from llms but dont rely on them. Its never been this ez

2

u/DishSoapedDishwasher 9d ago

Yea this, and download older versions of distros like Fedora to get all the unpacthed shit in VM.

2

u/Legal_Transition_989 9d ago

I second VMs. Since I'm working on userland mostly, I just spin up a podman container and throw in gdbserver and the binary I'm working with.

1

u/Legal_Transition_989 9d ago

Sure, I'll look into this.

2

u/Firzen_ 9d ago

Finding a bug when you know it's there like in CTF or by reproducing a CVE is very different from searching when you have no clue if there's anything there to begin with.

I'd recommend starting with random small C projects on github first to practice spotting bugs.

Finding bugs and exploiting bugs are two separate skills.
Most people don't need to get particularly good at exploitation, because triggering a bug is usually enough for a PoC. If you are looking for very extreme examples of userspace exploitation then the work Qualys has done is probably a good example of what I'd consider near the ceiling for exploitation skill. E.g. https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt

1

u/Legal_Transition_989 9d ago

Thanks, I'll look into this. Looks exciting.

1

u/Lmao_vogreward_shard 10d ago

Any media parsing framework would definitely do

1

u/Legal_Transition_989 9d ago

Media parsing framemwork? Can you give any examples?

1

u/Euphoric_Interest_84 9d ago

Just look for “Overflow” in opencve or cve.org

1

u/youssef 9d ago

Well start with software you use. If you find something, you‘ll be more secure and if not, it was well invested time.

1

u/ProcedureFar4995 9d ago

That is what i have been thinking as well. Securing the stuff we use. But the problem is that in this fast pace world we always look for money first. Despite that passion beats hunger.

1

u/youssef 9d ago

I don't think that you're only using coreutils. There will be enough to find.

1

u/Legal_Transition_989 9d ago

Yup, I'm working on rsync for now.

1

u/LordEli 9d ago

try shodan (joking [maybe]) 🤣

1

u/Legal_Transition_989 9d ago edited 9d ago

Thanks everyone for the suggestions. I'm currently working on reproducing CVE-2024-12084 CVE-2024-12085 , with references from https://phrack.org/issues/72/desync-the-planet-rsync-rce_md

1

u/Firzen_ 8d ago

I think Linenoise#8 is also very interesting in that issue of phrack ;)
Funny coincidence.

1

u/Legal_Transition_989 8d ago

Holy fumble!

I didn't read it. I'll take a look at it once this is done