admin/cyber-defence-campus-netgear_r6700v3_circled
1
0
Fork 0
mirror of https://github.com/cyber-defence-campus/netgear_r6700v3_circled synced 2026-08-09 12:29:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Minor fixes

Browse Source
This commit is contained in:
Damian Pfammatter
2024-04-17 12:24:03 +02:00
parent b5d3fb81e4
commit cb172b00ba
2 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/3_tracing.md
+3 -3
View File
@@ -164,18 +164,18 @@ instructions.
Use the following steps to create a **trace** of the binary _circled_, while it is targeted with a
_proof-of-vulnerability (PoV)_ payload (as for instance being identified by a fuzzer):
1. Start a HTTP server, delivering PoV payloads:
- System: [Guest](./1_setup.md)
- System: [ARMHF Guest](./1_setup.md#armhf-guest-system)
- Command:
```
python3 server/circled.server.py --payload "pov"
```
2. Emulate the binary _circled_ with GDB attached (and therefore not using ASRL):
- System: [Guest (chroot)](./1_setup.md)
- System: [ARMHF Guest (chroot)](./1_setup.md#armhf-guest-system)
- Command:
```
/circled.driver.sh --gdb
3. Collect an execution trace of the binary _circled_:
- System: [Host (morion)](./1_setup.md)
- System: [Analysis / Host (morion)](./1_setup.md#analysis--host-system)
- Command:
```
cd morion/; # Ensure to be within the correct directory
docs/4_symbex.md
+8 -8
View File
@@ -56,7 +56,7 @@ Use the following step to **symbolically execute** a previously collected trace
execution run of binary _circled_:
1. Use _morion_ to execute the collected trace symbolically:
- System: [Host (morion)](./1_setup.md)
- System: [Analysis / Host (morion)](./1_setup.md#analysis--host-system)
- Command:
```
cd morion/; # Ensure to be within the correct directory
@@ -355,13 +355,13 @@ control-flow.
[2024-04-11 10:47:23] [INFO] Start storing file 'circled.yaml'...
[2024-04-11 10:47:25] [INFO] ... finished storing file 'circled.yaml'.
```
In the next chapter about [Exploitation](./6_exploitation.md) we will see how symbolic execution
might help us to decide whether the crasher we traced might be **exploitable** or not, i.e.
corresponds to an actual security vulnerability or just an annoying bug. We will also see, how
symbolic execution can quickly give us a first high-level intuition about what **capabilities**
(e.g. arbitrary read/write, control-flow hijacking, etc.) one might gain with the underlying issue.
Also, we will show how symbolic execution might help us during the process of generating a working
**exploit** for the targeted vulnerability (CVE-2022-27646).
In chapter [Exploitation](./6_exploitation.md), we will see how symbolic execution might help us to
decide whether the crasher we traced might be **exploitable** or not, i.e. corresponds to an actual
security vulnerability or just an annoying bug. We will also see, how symbolic execution can quickly
give us a first high-level intuition about what **capabilities** (e.g. arbitrary read/write,
control-flow hijacking, etc.) one might gain with the underlying issue. Also, we will show how
symbolic execution might help us during the process of generating a working **exploit** for the
targeted vulnerability (CVE-2022-27646).
----------------------------------------------------------------------------------------------------
[Back-to-Top](./4_symbex.md#table-of-contents)