Damn Vulnerable Linux - The most vulnerable and exploitable distro

http://www.damnvulnerablelinux.org/

by morazyx • 16 years ago

178 40 16 years ago

damnvulnerablelinux.org

sliverstorm• 16 years ago

> Damn Vulnerable Linux - The most vulnerable and exploitable operating system ever!

Wait, they topped Windows 95 and Windows ME?

Is that even possible?

pjscott• 16 years ago

I love how, on those OSes, you could freeze the whole thing solid with a three-byte program:

   cli   # clears interrupts
   loop: goto loop

This ballooned to a colossal four bytes if you put it in an EXE file, of course.

yesimahuman• 16 years ago

Technically speaking, how would an OS avoid that issue, without breaking compatibility (unless that is acceptable)?

mahmud6• 16 years ago

You could do it from debug.com but that one doesn't have labels, so you will need to use an explicit jmp.

  C:\hack\lisp\cl-gdata\base>debug
  -a
  13EA:0100 cli
  13EA:0101 jmp 101
  13EA:0103
  -g 0100

JoeAltmaier4• 16 years ago

Any OS on that early hardware had this problem, right?

wwortiz• 16 years ago

That actually sounds like a fun concept.

morazyx2• 16 years ago

Seems a decent educational tool too.. run in a virtual box and let your students go all out overflowing buffers and seeing the concepts in action. It comes with easy-to-follow guides.

JoeAltmaier4• 16 years ago

OK for learning about what has been solved; kind of hacking-101. BUt the exploits involved have all been fixed in the products in that distro. What to use for the advanced class?

Spoutingshite• 16 years ago

It looks like a honeypot on steroids!

mahmud6• 16 years ago

Securing this beast should serve as a nice training course for any sysadmin; bonus points if you start handing out shell accounts to anonymous people in certain neighborhoods of EFNet.

pavs2• 16 years ago

Just update packages to the latest, patched version. What so difficult about it?

mahmud6• 16 years ago

If this is based on a popular distro, maybe; but if you wanted to loosen up a Linux box, you can build a freak from pieces that no one would find lineage for, much less a repo.

ciupicri• 16 years ago

Not update, but upgrade to another more secure distribution.

joe_the_user• 16 years ago

I'm far from a security expert.

I have spent hundreds if not thousands of hours upgrading random packages in Linux for various reasons. Afterwards, I didn't feel any wiser in security or anything except how to build stuff (well, maybe a bit of systems stuff...).

If upgrading is main task here, what do you really learn? If upgrading isn't the main task here, what is?

nphase• 16 years ago

Or 4chan.

known• 16 years ago

http://en.wikipedia.org/wiki/Openbsd is the most secure OS.

nhnifong• 16 years ago

Whats with all the grammatical errors on that site? Is it a joke?

Damn Vulnerable Linux - The most vulnerable and exploitable distro

Related Stories