Abstract

This class is organized and planned to provide students with a solid introduction to exploit development and associated details with focus on Windows sytems. Additionally, this class is focused exclusively on writing exploits using WinDbg as supporting debugger.

During this class we will teach details about Windows exploit development, covering different aspects about buffer overflow since its starting aspects. Class attendees will learn about SEH Exploitation and will face different challenges involved with the process of writing a functional exploits in distinct scenarios. To bypass some hurdles, students will learn how to write an egg hunter for different Windows versions as well as perform a customization of such egg hunters. In the next section class attendees will learn how to handle with Unicode applications, which present a complex challenge. Finally, we will explorer details about ROP (Return Oriented Programming), which is a key topic and valid for modern exploits. In the ROP sections, we will provide students with all necessary concepts and techniques to generate gadgets to bypass DEP protection.

This class will focus on x86/x64 Windows sytems.

Who Should Attend

This class is designed and organized for professionals interested in entering in the exploit development world as well as learning multiple techiques since the beginning. Class attendees coming from different areas such as incident response, threat hunting, digital forensics and cyber defense will benefit from this course because it shows a completely new world within information security area.

Key Learning Objectives

Students attending this class will:

  • Learn about existing basic protections on Windows.
  • Learn how to setup an appropriate lab environment to write exploits.
  • Learn critical fundamentals and concepts involved with writing basic buffer overflow.
  • Understand details associated with exceptions to leverage SEH while writing stack exploits.
  • Learn how to create egg hunters for different Windows versions.
  • Learn details about egg hunter customization.
  • Learn how to write exploits for Unicode applications.
  • Master ROP techniques and how to write exploits involving all these techniques.
  • Learn how to fix ROP chains.

Prerequisite Knowledge

The recommended prior knowledge and experience for attending this class follows below:

  • Knowledge on Windows systems and associated administrative commands.
  • Prior experience with debuggers could be useful.
  • Knowledge on Assembly language could be useful.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • Two virtual machines running: Windows 7 x86 and Windowns 7 x64.
  • One virtual machine running Windows 10 x64 or Windows 11 x64.
  • One virtual machine running Kali Linux x64.
  • Visual Studio and SDK installed (with WinDbg) on both Windows machines.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class follows:

  • Introduction
  • Windows Protections
  • Lab Setup
  • Basic Buffer Overflow
  • SEH Exploitation
  • Challenges
  • Egg Hunter: Win7 x86
  • Egg Hunter: Win7 x64
  • Egg Hunter: Win10 x64
  • Customizing Egg Hunters
  • Protections: Epilog
  • Unicode Exploits
  • ROP: General Concepts
  • ROP: Automated
  • ROP: Manual
  • ROP: Final Thoughts

Note: Topics can be added, merged or removed without prior notice!