Four threats and the controls that stop them, on a machine you own: a buffer overflow, an SQL injection, password hashes, and a small honeypot that logs a scanner on the peer.

Before you start

Setup made /root/threats with greet.c, a small program that copies its first argument into a 16-byte buffer with no length check. It also made a user hashdemo with a password. The peer, at 10.99.0.2 (name peer), plays the scanner; it sits on this VM's second network, where this VM is 10.99.0.1 on interface le-host. Run commands there with sudo ip netns exec lepeer COMMAND.

The firewall, if it's running, is yours to open. Work in /root/threats. The honeypot only runs until you stop it or reboot.

Tasks

Install a C compiler. Build greet from greet.c with -O0 -fstack-protector-strong, and greet-fortify with -O2 -D_FORTIFY_SOURCE=2. Both must greet Alice normally; given 64 characters, greet must die with stack smashing detected and greet-fortify with buffer overflow detected. Write the system's ASLR setting (kernel.randomize_va_space) to /root/lab-answers/1.
Make users.db, an SQLite database with a table users(name, secret) holding the users alice and bob. Write lookup.py, which takes a name and prints the matching rows twice: first from a query built as a string (string-built: ...), then from a parameterized query (parameterized: ...). The name x' OR '1'='1 must return every row from the first and none from the second.
Find the hashing method of hashdemo's password and write its marker from /etc/shadow (the part between the first two $ signs, with them, like $1$ ) to /root/lab-answers/3.
Run a fake Telnet honeypot on 10.99.0.1 port 2323: it answers each connection with a login prompt (one that says login:) and appends a line to /root/threats/honeypot.log with the client's address and what it sent.
From the peer, install the tools and play the attacker: scan ports 22, 23 and 2323 of 10.99.0.1 with nmap and save the output in /root/threats/scan.txt, then try to log in to the honeypot as root and as admin. Find the MAC address that answers ARP for 10.99.0.1 on the peer and write it to /root/lab-answers/5.

Hints

gcc; ./greet "$(printf 'A%.0s' {1..64})"; cat /proc/sys/kernel/randomize_va_space.
sqlite3 (sqlite on RHEL relatives), or Python's sqlite3 module. An f-string query versus db.execute("... WHERE name = ?", (name,)).
getent shadow hashdemo. Never print a real password.
socket.bind(("10.99.0.1", 2323)), listen(), accept(), sendall, recv, and a log file opened with buffering=1; setsid -f python3 honeypot.py; ss -ltn.
nmap and nc (nmap-ncat on RHEL relatives, netcat-openbsd on Ubuntu), arping (iputils-arping on Ubuntu); ip neigh. As root, nmap sends a SYN scan, which never completes a connection, so the honeypot doesn't see it; -sT makes full connections it will log.
printf 'root\r\n' | nc -w 3 10.99.0.1 2323.