Runnable, from-scratch local reproductions of the pwn.college CSE365 – Introduction to Cybersecurity dojo modules, part of a csdiy.wiki full-catalog build.
-brightgreen){kind=icon}
This repository is authorized self-study coursework for a public university security course. Every exercise here is a self-contained local reproduction that I built and run entirely inside my own WSL2 sandbox against my own intentionally-vulnerable targets and my own planted "flag" files. Nothing here targets any real, third-party, or remote system; there is no malware, no C2, no DoS, and no detection-evasion tooling. The insecure build flags and the disabled ASLR in the Memory Errors module are applied only inside the throwaway lab sandbox for teaching classic memory-safety concepts. Use it to learn.
Where the real flags live: the graded CSE365 challenges are hosted on pwn.college and their flags can only be captured on that platform (per-user binaries + a server-side
/flag). That hosted grading is a concrete partial — see Partial / hosted-only. Everything committed here is a faithful local analogue that actually runs and prints a locally-planted flag as proof of technique.
CSE365 teaches the foundations of offensive security as a sequence of CTF-style
modules. This repo mirrors the module topics with small, real, locally-runnable
labs — SUID privilege escalation, scripted program interaction, hand-written
x86-64 assembly, gdb-driven debugging, binary reverse engineering, a 32-bit
stack overflow, and a vulnerable web app — each with a working exploit/solver
verified by capturing real output into results/.
| # | Module | Local reproduction | Verified result |
|---|---|---|---|
| 01 | Program Misuse | root-only flag + 6 SUID-root coreutils | direct read denied; flag read by user hacker through all 6 SUID tools |
| 02 | Program Interaction | token handshake + 50 timed problems, pwntools solver | 50/50 problems answered, flag recovered |
| 03 | Assembly Crafting | 6 hand-written NASM programs + RWX runner | 8/8 checks; execve("/bin/sh") shellcode spawns a real shell (uid=0) |
| 04 | Debugging | runtime-keyed crackme, two gdb solutions | key JZL:=< recovered from live memory and comparison patched at runtime; flag captured both ways |
| 05 | Binary Reverse Engineering | key check reversed out of the ELF | 11-byte key recovered from .rodata + inverted transform; binary unlocked |
| 06 | Memory Errors | 32-bit ret2win → shell |
saved-EIP offset 76 (cyclic/core dump), ret2win@0x80491f6, flag + id via spawned shell |
| 07 | Web Security | vulnerable Flask app, 4 bug classes | 6/6 exploits: cmd-injection, SQLi bypass + UNION exfil, SSTI RCE, reflected XSS |
Latest full run: 7/7 modules PASS — see results/SUMMARY.txt
and the per-module logs in results/. Flags are randomized per run,
so each log shows a freshly-captured pwn.college{local_...} value.
- 01 · Program Misuse — GTFOBins-style SUID misuse (
cat,sed,awk,tail,cut,find). - 02 · Program Interaction — pwntools
recvuntil/regex/sendlineautomation. - 03 · Assembly Crafting — const/sum/max/memsum/popcount +
execve("/bin/sh")shellcode. - 04 · Debugging — gdb key recovery from memory + runtime comparison patch.
- 05 · Binary Reverse Engineering — invert
(k^0x5A)+i, readtarget[]from.rodata. - 06 · Memory Errors — cyclic-offset stack overflow,
ret2win, drive the spawned shell. - 07 · Web Security — command injection, SQLi (bypass + UNION exfil), Jinja2 SSTI RCE, reflected XSS.
asu-cse365/
├── run_all.sh # copies repo to an ext4 workdir, runs every module, writes results/
├── 01-program-misuse/ # setup.sh + solve.sh + run.sh
├── 02-program-interaction/ # interaction_challenge.c + solve.py
├── 03-assembly-crafting/ # sol_*.asm + runner.c + shellcode_runner.c + run.py
├── 04-debugging/ # license.c + solve_recover.gdb + solve_patch.gdb
├── 05-binary-reverse-engineering/ # crackme.c + solve.py
├── 06-memory-errors/ # vuln.c + solve.py
├── 07-web/ # app.py + solve.py
└── results/ # REAL captured output (committed as evidence)
Requires WSL2 Ubuntu with gcc (+ gcc-multilib), nasm, gdb, and a Python
venv holding pwntools, flask, requests. The venv is kept off C::
# one-time toolchain
sudo apt-get install -y build-essential gcc-multilib nasm gdb python3-venv
python3 -m venv /mnt/d/Project/security/.venv-cse365
/mnt/d/Project/security/.venv-cse365/bin/pip install -r requirements.txt
# run everything (as root, for SUID + ASLR toggling), capture results/
wsl -d Ubuntu -e bash -lc 'bash /mnt/d/Project/security/asu-cse365/run_all.sh'
# or a single module
bash 03-assembly-crafting/run.shThe labs must run on a real Linux filesystem (ext4).
run_all.shcopies the repo into/tmp/cse365-labfirst, because the/mnt/ddrvfs mount does not honor SUID or exec-stack bits.
Every module writes its real terminal output to results/<module>.txt, and
results/SUMMARY.txt records per-module PASS/FAIL. Each solver asserts on the
captured flag / expected value, so a green run is genuine (not a printed claim).
Re-running regenerates fresh random flags and re-derives them.
The graded pwn.college dojo (per-user challenge binaries and the real
server-side /flag) cannot be mirrored offline — that portion is a documented
partial. This repo reproduces the techniques of each module against local
analogues and verifies them end-to-end; it does not and cannot submit flags to
the hosted scoreboard. To earn dojo credit, run the same techniques on
pwn.college.
C (gcc, 32- and 64-bit), x86-64 assembly (NASM), Python 3 (pwntools, Flask, requests), gdb, objdump, on WSL2 Ubuntu.
- SUID binaries run with the file owner's effective UID — a single misused utility is a full privilege escalation.
- Scripting program I/O (parse-then-respond loops) beats any human at timed challenge-response.
- Writing shellcode by hand: the SysV calling convention, and
execve("/bin/sh")from raw bytes in an RWX page. - A debugger is an exploit primitive: read secrets from live memory, or rewrite memory/registers to bend control flow.
- Reversing a check means inverting its algorithm and pulling constants straight
from the binary's
.rodata. - Stack overflows: find the saved-return-address offset with a cyclic pattern,
overwrite it, and pivot to code execution (
ret2win→ shell). - The web "big four": OS command injection, SQL injection, template injection (SSTI), and reflected XSS — all rooted in unsanitized input crossing an interpreter boundary.
Based on the module topics of pwn.college / ASU CSE365 – Introduction to Cybersecurity by Yan Shoshitaishvili, Connor Nelson, and the pwn.college team. This repository is an independent educational reimplementation of the techniques against self-authored local targets; all course materials and the hosted dojo belong to their original authors. Original code here is released under the MIT License.