Lion Cipher Lab
Understand a classic stack buffer overflow — hands-on, in your own lab
- Penetration Testing / Red Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Almost every serious remote-code-execution bug in history traces back to this one idea: a program wrote past the end of a fixed-size buffer and clobbered something important — often the address the CPU was going to 'return' to. You can read that sentence a hundred times and not feel it. This lab makes you feel it: you write twelve lines of C, feed it a long string, and watch the CPU jump wherever you tell it. Then — and this is the actual point — you recompile with the defenses that ship on by default today and watch the same attack die three different ways. That is the fastest route to…
What you'll learn
- writing a tiny deliberately-vulnerable C program (gets()/strcpy() into a fixed stack buffer) that you own and compile yourself
- compiling with protections DISABLED for teaching (-fno-stack-protector -z execstack -no-pie -m32) and knowing which real defense each flag turns off
- crashing the program with over-long input and reading the segfault as a symptom of an overwritten saved return address
- using gdb with a De Bruijn cyclic pattern to find the EXACT offset from the buffer to the saved return address, instead of guessing
- redirecting execution to a win() function already in the binary (a ret2win) by overwriting the return address — no shellcode required
- recompiling with modern defaults and watching the stack canary, NX/DEP and ASLR each defeat the naive exploit, and being able to say what each one does
- the judgment: why memory-unsafe languages produce this bug class, why fgets/bounds/std::string/Rust fix it, and where real exploitation goes next (ROP, info leaks)
Steps in this lab
- Read this first: the target is your own program, on your own machine
- What a stack buffer overflow actually is (in one breath)
- Get a Linux machine and the build tools
- Write the deliberately-vulnerable program
- Compile with the protections OFF — and know what each flag disables
- Crash it — and read the segfault as a clue
- Find the EXACT offset in gdb with a cyclic pattern
- Overwrite the return address — redirect execution into win() (ret2win)
- The defense half: recompile with modern defaults and watch it die three ways
- Why this bug class exists — and how it's actually fixed
- Where this goes next — and clean up