Exploit Development on Windows (W38)

Description

It’s time for a final sale of one of our older online courses - “Exploit Development on Windows”. Don’t be fooled though, as “older” doesn’t necessarily mean “outdated” or “not useful”. In fact, the course is FULL of practical knowledge that is always crucial and relevant for every pentester. What’s more, the final sale means that the last seats are available at a very special price!

---

This is a final sale. This course will only be available for purchase until March 19th. After that day enrollment will be open only to Premium subscribers.

---

This is an intermediate level course for exploit development. An introduction to X86 assembly language will be provided. Introduction to Stack Overflow, Heap Overflow, SEH based Overflow, and Format string vulnerabilities will be explained in detail and exploits will be developed for all types of vulnerabilities using real life applications. Introduction to stack protection, such as stack cookies, canary value, DEP, and ASLR, will be explained in detail. Each module will have hands on exercises of developing exploits. During the course, you will recreate exploits for RCE for the existing vulnerabilities for exploits that exist in public.

---

This course is self-paced and pre-recorded

18 CPE Credits

---

You will learn:

• How to exploit vulnerabilities
• How to write exploits
• How to convert exploits to Metasploit

---

You will need:

• Windows XP (Any SP) / Windows 7 and Kali Linux

---

Before you join you should be familiar with:

• Scripting language such as Python or Ruby will be helpful. Exploits will be developed using Python.
• TCP/IP, HTTP and basic networking will be helpful

---

---

SYLLABUS

---

MODULE 1: Revisit the basics

In this module, we will touch on the basic network monitoring tools, reverse engineering tools (Ida, Ollydbg, Immunity, etc.) and editing binary data. You will be introduced to x86 assembly language and basic introduction of buffer overflow vulnerabilities including stack, heap, use-after-free and format string vulnerabilities. You will be introduced to open source repositories of exploits and to Kali Linux and its basic usage.

1. Introduction to Tools

1. Wireshark
2. OllyDBG
3. Metasploit (Pattern create tools)
4. Binary Editor (Hex edit)

2. Introduction to x86 assembly language

1. Registers
2. Simple operation PUSH, POP, MOV, JUMP
3. Identifying machine code
4. Looking back C code in Assembly

3. Types of Vulnerabilities

1. Stack Overflow
2. Heap Overflow
3. Use After free vulnerability
4. Format String vulnerability

4. Exploit Building blocks

1. Python intro for Exploit development
2. Exploit Source
3. Introduction to Kali Linux

Exercises: (Duration: 1 hour)

• Read provided article
• Exploit configured Struts application using particular application

---

MODULE 2: Basic Stack Overflow Exploitation

In this module, we will look a little deeper into our journey of exploit development. You will be introduced to C construct to recognize the code in debugger. We will analyse crash in debuggers. You will be introduced to EIP overwrite, JMP instruction use case, methodology to eliminate bad characters from the shellcode. Introduction to Fuzzing, how to identify bad characters in shellcode. We will exploit building exercise for creating exploit for CesarFTP.

1. Identify C construct in Assembly
2. Introduction to Fuzzing
3. Analyzing the crash in debugger
4. What is EIP Overwrite
5. JMP instruction
6. Eliminate bad characters in shellcode
7. What is Shell Code
8. Exploitation of CesarFTP
9. Change the public Exploit to RCE
10. Solution of Exercise 1

Exercise: (Duration: 1 hour)

• Develop a step by step exploit for remote code execution for CVE-2017-6880 and FTPshell Server 6.56.

---

MODULE 3: Advanced Exploitation

In this module, we will learn about stack protection, SEH handler and SEH based exploitation. What is NOP, NOP Sled and how these are useful in developing exploit. Stack protection mechanism DEP and ASLR in action. You will be introduced to Return oriented programming. How to make ROP chain. SEH DEP, ASLR are stack protection techniques. DEP and ASLR are enabled in new Operating System. ROP is a way to overcome such protection.

1. Stack Protections
2. What is SEH
3. Breaking SEH Protection with real application
4. Understanding NOPsled
5. Writing Exploit for SEH based buffer overflow
6. DEP and ASLR
7. ROP Chain

Exercise: (Duration: 1 hour)

• Try to create a Remote Code execution exploit for particular POCs.

---

MODULE 4: Advanced Exploitation pt. 2

In this module, you will learn how to format String vulnerabilities and exploit format string vulnerability. You will be provided an introduction to the most successful penetration testing tool, ‘Metasploit’, and porting your own exploit to Metasploit. It is very important to know how to make use of Metasploit libraries for making a successful connection. Metasploit is an established penetration testing tool used heavily in industry.

1. Introduction to Format String vulnerability
2. Exploit Format string vulnerability in public software
3. Write new exploit for the vulnerability
4. Write Metasploit exploit

Exercises:

• Write Metasploit exploit for FTPGetter.
• Exploit Struts, analyse vulnerability in detail and try to find out new exploit vector.
• Develop own exploit for the XM Easy Personal FTP Server.

---

Your instructor: Virendra Bisht

I am a technology enthusiast and cyber security professional, I have a great interest in solving complex problems of Information security. I have 10 years of experience in exploit development, malware analysis, vulnerability analysis, and penetration testing.

https://www.linkedin.com/in/virendrasinghbisht/

 

 

 

---