VulnLab — Vulnerability Analysis Simulator

01

OS Privilege Escalation

SUID abuse, sudo misconfigurations, kernel exploits — identifying and mitigating local privilege escalation vectors

Critical

Pending

▾

Scenario: You are a junior security analyst at MidWest Financial. A contractor account with limited access is found to be running commands as root. Investigate how privilege escalation occurred.

CVE Reference

CVE-2021-4034 (PwnKit)

CVSS Score

7.8 HIGH

Attack Vector

Local → Root

Affected Systems

Linux (pkexec)

How It Works

Privilege escalation allows an attacker with low-level access to gain administrative (root/SYSTEM) privileges. Common vectors include:

SUID/GUID Bit Abuse: Executables with the SUID bit run as the file owner. If root owns a SUID binary and it is exploitable, attackers gain root.
Misconfigured sudo: Overly permissive sudoers entries allow users to run privileged commands.
Writable PATH Entries: If a privileged script calls binaries without absolute paths, attackers inject malicious binaries.
Kernel Vulnerabilities: Unpatched kernel flaws (e.g., Dirty COW, PwnKit) allow direct privilege escalation.

BASHSUID Enumeration
# Find SUID binaries — attacker reconnaissancefind / -perm-4000-type f 2>/dev/null

# Dangerous result — /usr/bin/find has SUID set-rwsr-xr-x 1 root root 220416 /usr/bin/find# Exploit via GTFOBins technique/usr/bin/find . -exec /bin/sh -p \; -quit# Attacker now has root shell — # prompt

⚠️

Educational Simulation OnlyThis simulation models privilege escalation behavior in a controlled environment. No real commands are executed.

Interactive Privilege Escalation Simulator

Target System Attacker Privilege Level

Running Processes (pre-attack)

PID	User	Command
1	root	/sbin/init
452	root	sshd
891	user	bash
892	www-data	apache2
—	SET-UID	/usr/bin/find ⚠️

VulnLab Privilege Escalation Simulator — ready Select an attack vector and click Simulate Attack ▶

Identify Misconfigurations

Review the sudoers file excerpt below. Check all entries that represent a security risk:

CONFIG/etc/sudoers
# Line 1
root    ALL=(ALL:ALL) ALL
# Line 2contractor ALL=(ALL) NOPASSWD: /bin/bash# Line 3
deploy  ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart apache2
# Line 4%webteam ALL=(ALL) NOPASSWD: ALL# Line 5
backup  ALL=(ALL) NOPASSWD: /usr/bin/rsync
        

☐ Line 2: contractor has NOPASSWD access to /bin/bash (gives full shell)
☐ Line 3: deploy can restart apache2 (service management, acceptable)
☐ Line 4: %webteam has unrestricted NOPASSWD sudo (ALL commands)
☐ Line 5: backup uses rsync for file sync (scoped, lower risk)

Knowledge Check — 3 Questions (2 pts each)

02

Race Conditions & TOCTOU

Time-of-Check to Time-of-Use flaws, symlink attacks, and filesystem race condition exploits

High

Pending

▾

Scenario: An ATM application checks an account balance (Time of Check), then processes a withdrawal (Time of Use). An attacker triggers simultaneous withdrawals to double-spend.

TOCTOU Explained

A TOCTOU vulnerability exists when a program checks a resource's state and then uses that resource, but an attacker can change the resource between those two operations.

CVulnerable Code
inttransfer_funds(int amount) {
    // TIME OF CHECK — reads balanceint balance = get_balance(account_id);

        // ← WINDOW: attacker triggers another thread here!// TIME OF USE — uses the stale balance valueif (balance >= amount) {
        deduct(account_id, amount);   // runs with old balancereturn SUCCESS;
    }
}
        

🕐

The Race WindowThe gap between check and use is the attack surface. Even microseconds create exploitable windows in concurrent systems.

📁

Symlink Attack VariantA process checks if /tmp/file is safe, then opens it. Attacker replaces it with a symlink to /etc/passwd before the open() call.

TOCTOU Timing Visualizer

Simulate the timing relationship between legitimate and attacker threads. Adjust the window size to see when the race condition becomes exploitable.

Thread Timeline

Legit Thread

Attacker Thread

Race Window Size: 50ms

TOCTOU Simulator — adjust window size, then Run Race

Defense: Atomic Operations

CFixed — Atomic Compare-and-Swap
// Use database transactions — atomic check + useBEGIN TRANSACTION;
    SELECT balance FOR UPDATE;   // locks row    UPDATE accounts SET balance = balance - :amount    WHERE balance >= :amount AND id = :account_id;COMMIT;  // atomic — no window exists

Knowledge Check — 3 Questions (2 pts each)

03

Buffer Overflows

Stack/heap overflows, return address corruption, NOP sleds, and memory-safe countermeasures

Critical

Pending

▾

Scenario: A legacy VPN appliance uses strcpy() to handle user authentication tokens. Security researchers discover that sending a 512-byte token crashes the device and achieves remote code execution.

Stack Layout

Stack — Local Variables / Buffer

Saved Frame Pointer (EBP)

Return Address (EIP) ← TARGET

Attacker Shellcode / Payload

Caller's Stack Frame

CVulnerable — strcpy
voidauthenticate(char *token) {
    char buf[64];          // fixed 64-byte buffer    strcpy(buf, token);    // NO bounds check!// token = 512 bytes → overwrites EIP!
}
        

🛡️

Safe Alternative: Use strncpy(buf, token, sizeof(buf)-1) or, better, snprintf(). In modern C++, use std::string. Enable ASLR, Stack Canaries, and NX/DEP at compile time.

Stack Buffer Overflow Visualizer

Input → Stack State

Payload Length (bytes): 0

Stack Memory (Buffer: 8 cells, EBP: 2, EIP: 2)

Buffer (safe) Overflow EIP Corrupted

Move slider right to fill buffer — watch for overflow...

Countermeasures Checklist

☐ Enable ASLR (Address Space Layout Randomization) — randomizes memory addresses
☐ Compile with Stack Canaries (-fstack-protector) — detects EBP overwrite
☐ Enable NX/DEP — marks stack non-executable, prevents shellcode execution
☐ Disable firewall logging — reduces attack surface (incorrect action)
☐ Replace unsafe functions: strcpy→strncpy, gets→fgets, sprintf→snprintf

Knowledge Check — 3 Questions (2 pts each)

04

Side-Channel Attacks

Timing attacks, cache analysis, power analysis — extracting secrets from observable system behavior

High

Pending

▾

Scenario: Spectre (CVE-2017-5753) allowed attackers to read kernel memory from user-space by exploiting CPU speculative execution — a hardware-level side channel invisible to the OS.

Attack Types

Timing, Cache, Power, EM

Famous Examples

Spectre, Meltdown, FLUSH+RELOAD

Target

Crypto keys, Passwords, Data

Observable Signal

Time, Power, Cache state, EM

Timing Attack on Password Comparison

PYTHONVulnerable — Early Exit
defcheck_password(stored, attempt):
    for i in range(len(stored)):
        if stored[i] != attempt[i]:    # exits early!            return False               # leaks how many chars matchedreturnTrue# Fix — constant-time comparisonimport hmac
def safe_check(stored, attempt):    return hmac.compare_digest(stored, attempt)

Timing Oracle Simulator

Exercise: A login API returns slightly different response times based on how many characters of the password matched. Use the timing oracle to discover the 4-character PIN.

Timing Attack Interface

Enter a 4-character guess. The server response time reveals information about correct characters. Analyze patterns to deduce the PIN.

Timing Oracle ready — try guessing the 4-char PIN Hint: characters are digits 1–4 only

Attempts: 0

Countermeasures

⏱️

Constant-Time AlgorithmsUse hmac.compare_digest() (Python), crypto/subtle.timingSafeEqual (Node.js). Never short-circuit secret comparisons.

🔀

Add JitterIntroduce random delays to mask timing signals. Ensure minimum response time is always met regardless of outcome.

Knowledge Check — 3 Questions (2 pts each)

05

Unpatched Services & EOL Systems

End-of-life OS/software risks, patch management failures, and legacy system isolation strategies

High

Pending

▾

Scenario: A hospital network scan reveals Windows 7 workstations processing patient data. No security patches have been issued since January 2020. The system is fully connected to the internet and running outdated SMB services.

EOL Software Status Dashboard

System / SoftwareEOL DateStatusAction Required

Windows 7 SP1Jan 14, 2020⛔ EOLMigrate or air-gap

Windows Server 2008 R2Jan 14, 2020⛔ EOLMigrate immediately

Windows 10 22H2Oct 14, 2025⚠️ ExpiringUpgrade to Win 11

Windows 11 23H2Nov 11, 2025⚠️ ExpiringUpdate to 24H2

Windows 11 24H2Oct 2026+✅ SupportedKeep patched

OpenSSL 1.0.2Dec 31, 2019⛔ EOLUpgrade to 3.x

Apache 2.4.x (latest)Active✅ SupportedApply monthly patches

PHP 7.4Nov 28, 2022⛔ EOLMigrate to PHP 8.3+

☢️

EternalBlue (MS17-010) exploits SMBv1 on unpatched Windows. WannaCry ransomware (2017) infected 200,000+ systems in 150 countries. EOL systems never received the MS17-010 patch.

Patch Gap Risk Calculator

Asset Risk Assessment

Operating System Patch Lag (months behind) Network Exposure

Configure asset properties and click Calculate Risk

Mitigation Strategy Matrix

☐ Segment EOL systems into isolated VLANs with strict firewall rules
☐ Implement application whitelisting on EOL systems to restrict execution
☐ Enable auto-updates on EOL software (updates no longer available — ineffective)
☐ Deploy compensating controls: IDS/IPS monitoring for known EOL exploits
☐ Create migration plan with target architecture and timeline for EOL replacement

Knowledge Check — 3 Questions (2 pts each)

06

Insecure Data Storage

Cleartext credentials, weak encryption, unprotected databases, and mobile storage misconfigurations

Medium

Pending

▾

Scenario: A mobile banking app stores authentication tokens in SharedPreferences (Android) without encryption. A physical device compromise or backup extraction exposes all customer tokens.

Storage Vulnerability Map

Mobile (Android)

⛔ SharedPreferences (plaintext) ⛔ SQLite without encryption ✅ Android Keystore API ✅ EncryptedSharedPreferences

Web / Cloud

⛔ Passwords in localStorage ⛔ S3 bucket — public access ✅ Secrets Manager (AWS/Azure) ✅ AES-256 at rest + TLS in transit

KOTLINAndroid — Vulnerable vs Secure
// ❌ VULNERABLE — plaintext SharedPreferencesval prefs = getSharedPreferences("auth", MODE_PRIVATE)prefs.edit().putString("token", authToken).apply()// ✅ SECURE — EncryptedSharedPreferencesval masterKey = MasterKey.Builder(context)    .setKeyScheme(MasterKey.KeyScheme.AES256_GCM).build()val prefs = EncryptedSharedPreferences.create(    context, "auth", masterKey,    AES256_SIV, AES256_GCM)

Data Storage Security Auditor

Simulated Credential Store — Rate Each Entry

Classify each storage entry: Secure, Insecure, or Needs Review.

config.json → password "Admin123!"

DB → passwords column bcrypt($2b$12$...)

AWS S3 bucket public-read ACL + no encryption

API Key → env variable process.env.API_KEY

Mobile → Android Keystore AES-256-GCM

Browser localStorage "jwt=eyJhbGci..."

Rate each storage entry above — 6 items total

Knowledge Check — 3 Questions (2 pts each)

Thread Timeline

Input → Stack State

Timing Attack Interface

Asset Risk Assessment

Simulated Credential Store — Rate Each Entry

VulnLab Complete!