Where to practice

Label: practice-plan template. The worked names are fiction. Replace the blanks only when a platform, or your own machine, has assigned the target.
No challenge was opened. No account was created. No flag is printed here.

Worked grant, for the reading:
- Target file: desk-stack
- Machine family: Linux x86-64
- Where: the host that assignment names for that file
- Included: that one file
- Not included: the platform login, other challenges, other users, and the guest's kernel settings

Plan to copy for a real assignment. Leave a blank empty until you have the fact.

Target file: ________
Who assigned it, and the sentence that says so: ________
Machine family the assignment names: ________
Prerequisites you already have: Reversing, including the recommendation to read Compiled and interpreted first; this stage's four lessons; where-practice-is-allowed.
Isolated environment: an owned disposable guest, or the platform's assigned shell. Not your everyday host.
Helper tools: optional. A debugger can inspect a program you are allowed to run. pwntools is an optional library for starting that program. Neither one adds a target.

In scope:
- ________

Out of scope, unless a new sentence adds them:
- Platform login, account recovery, and status pages
- Any other challenge
- Any machine the assignment does not name
- Host mitigation settings and kernel policy

Stop if:
1. The next step is not named in the assignment sentence.
2. The next step changes a mitigation or a kernel policy.
3. You cannot yet read the model this stage uses, or the reversing lessons it assumes.
4. You are about to post a solution, flag, or writeup and the platform asks you not to.

Activity card, different from the worked grant:
- Target file: lamp-heap
- Machine family: Linux x86-64
- Included: lamp-heap only
- The account-recovery page is not named
- One stop already written on the card: stop if the next step names a different host

Check for the activity: the in-scope file is lamp-heap. The account-recovery page stays outside.

Download the practice-plan template and the worked grant

Label: activity grant. Fiction. Not an account you hold.

Assignment sentence: You may study the single file lamp-heap on the assigned Linux x86-64 host.

Named in that sentence: lamp-heap, Linux x86-64, the assigned host.
Not named: the account-recovery page, the platform login, any other file, any kernel setting.

Stop condition already on this card: if the next step names a different host, stop.

Write these four lines in your notes. They are not graded by the checker.
1. In-scope file: lamp-heap
2. Machine family: Linux x86-64
3. Prerequisite you are using: the bounds model and the mitigation roles from this stage
4. Stop: a different host, or a page this sentence does not name

Download the lamp-heap grant

#include <stdio.h>

/* Owned hello. Not compiled. Not run.
   Eight positions. fgets is documented to read at most one less than the
   size it is given, and to store a terminating null. Then the program
   prints a fixed word. The word does not depend on the characters read,
   as long as fgets succeeds.
*/

int main(void) {
  char line[8];
  if (fgets(line, 8, stdin) == NULL) {
    return 1;
  }
  puts("hello-from-owned");
  return 0;
}

Download the uncompiled owned hello

"""Optional primer. Not installed. Not run. Not an exploit.

The pwntools 4.15.0 introduction shows
`from pwn import *` and says that import brings in a large toolkit.
This file imports only process, which is the one function the lesson discusses.

process() is documented to spawn a process and wrap it for communication.
This script names ./owned-hello and nothing else. It does not change
address randomization. It does not attach to another user's program.

If you later install the library, use an isolated environment you control,
build owned-hello.c yourself, and stop if the path is not that file.
Do not point it at a platform login or at a challenge you were not assigned.
""",

from pwn import process

owned = process(["./owned-hello"])
owned.sendline(b"desk")
owned.close()

Download the unrun process primer

Label: reading notes for pwntools-demo.py and owned-hello.c.
Do not install pwntools for this page. Neither file was run. No pipe bytes were captured.

What the documentation supports, from the pages read:
- The stable introduction identifies itself as pwntools 4.15.0 documentation.
- It shows `from pwn import *` and says the library is a large toolkit.
- It says interacting with processes uses pwnlib.tubes.process.
- The process page says process() spawns a new process and wraps it for communication.
- The introduction's examples call sendline and recvline. Those examples are not this course's files.

What this course's files do, as source:
- owned-hello.c reads with fgets into an 8-byte array, then prints hello-from-owned if the read succeeds.
- The Linux fgets(3) page says fgets reads at most one less than the size it is given and stores a terminating null.
- pwntools-demo.py would start ./owned-hello and send the line desk. This note does not include captured pipe bytes. The script closes without receiving a line, so its source does not establish an observed greeting.
- A source trace, not a captured run: if fgets succeeds, the C file prints hello-from-owned.

What the primer does not do:
- It does not grant permission to start a program.
- It does not find a bug, change a mitigation, or finish a challenge.
- It does not include a setting that turns randomization off. The process page documents such a setting. This file does not use it, and this course does not ask you to.

Stop conditions if a later install is allowed on a machine you control:
- Stop if the program is not the owned hello you just built.
- Stop if you are about to change a host mitigation or a kernel policy.
- Stop if the platform forbids publishing what you did, and you were about to post it.

Download the reading notes for that primer

Label: ungraded stage case. Original fiction. Not a captured crash, scan, or challenge result.
Keep a private evidence note with source, reasoning and limits.

Piece 1. Bounds.
Buffer bin has 3 positions, indexed from 0.
Requested write: 4 bytes, and no extra terminator is requested.
The write needs more positions than bin has. Mark it as a bounds violation.

Piece 2. Mitigation.
Row on this card: the stack's model address differs across two ordinary runs.
Match that row to the role whose job is a layout that varies between runs.
The bounds violation in piece 1 remains. The match does not repair it.

Piece 3. Practice.
Assignment sentence: You may study the single file crate on the assigned Linux x86-64 host.
The status dashboard is not in that sentence.
In-scope file: crate.
Stop condition: stop when the next step is the status dashboard, another file, or a change to a host setting.

Rubric, for your own note. The site does not grade the note.
- Piece 1 says the 4-byte write does not fit in 3 positions.
- Piece 2 names the layout that varies between runs, and still calls the write wrong.
- Piece 3 keeps crate and leaves the status dashboard out.
- The note does not claim a program was run, a mitigation was changed, or a flag was found.

Download the ungraded stage case