Abstract

This class is planned, produced and meant for professionals interesting is a solid approach about exploit development, and that want to learn how to leverage heap vulnerabilities for exploitation of applications like browsers. This class offers a logic continuation of the Exploit Development 1 course.

We will provide students with details about how to manage writing exploits using heap spraying techniques. During the course, we will introduce class attendees to details about as memory management works on Windows 7. The focus on Windows 7 is because this course is a preparation to the next course (Windows Exploit Development 3), which is based on Windows 10/11. Additionally, we will provide a review about foundation topics such as ASLR, DEP and ROP. The class continues by offering a detailed chapter about WinDbg, Windows Exploit Protections and Windows Security. and covering all associated concepts involving heap spraying technique and UAF (Use-After-Free). At the second part of the course, we will deep dive into Windows Kernel Driver Foundations and Kernel Shellcode. Finally, in the third part of the course, which is most important of the course, we offers a practical approach on Kernel Driver Exploitation, when we show how to exploit different vulnerability classes.

This class will focus exclusively on Windows operating system, and it is a demanding and time consuming course.

Who Should Attend

This class was designed for professionals that hold a prior knowledge on exploit development through stack overflow vulnerabilities, and want to expand their knowledge by including different exploitation techniques of kernel drivers through multiple vulnerability classes. Students from different areas such as malware analysis, incident response, threat hunting, pentesting and cyber defense will enjoy and benefit from this training.

This a challenging and demanding course, and students should be prepared.

Key Learning Objectives

Students attending this class will:

  • Review key topics such as ASLR, DEP and ROP.
  • Learn about Windows exploit protections.
  • Learn about internals of heap management on Window 7.
  • Understand and learn how to use WinDbg and associated practical operations in an exploitation’s context.
  • Learn details about heap spraying and UAF techniques.
  • Learn about Windows kernel driver foundations.
  • Learn how to write exploits for kernel drivers through different vulnerability classes.

Prerequisite Knowledge

The recommended prior knowledge for attending this class follows below:

  • Knowledge on Windows systems and associated administrative commands.
  • Solid knowledge on stack exploitation.
  • Good understanding about how to ROP works, and how to write and fix ROP chains.
  • Knowledge on WinDbg could benefit class attendees.
  • Have attended “Windows Exploit Development 1” course.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • One virtual machine running Windows XP SP2/SP3.
  • Two virtual machines running: Windows 7 x86 and Windowns 7 x64.
  • One virtual machine running Kali Linux x64.
  • Visual Studio, SDK and WDK installed (with WinDbg) on both Windows machines.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

The list of sections presented in this class follows:

  • Introduction
  • Lab Setup
  • Kernel Debugging
  • Windows Exploit Protections
  • WinDbg Operations
  • Windows Memory Management
  • Use-After-Free (UAF)
  • Kernel Drivers Foundations
  • Kernel Shellcode
  • Kernel Driver Exploitation (Part 1)

Note: Topics can be added, merged or removed without prior notice!