Advanced Exploit Development for Penetration Testers
Vulnerabilities in modern operating systems such as Microsoft Windows 7/8, Server 2012, and the latest Linux distributions are often very complex and subtle. Yet, they could expose organizations to significant attacks, undermining their defenses when wielded by very skilled attackers. Few security professionals have the skillset to discover let alone even understand at a fundamental level why the vulnerability exists and how to write an exploit to compromise it. Conversely, attackers must maintain this skillset regardless of the increased complexity. SANS SEC760: Advanced Exploit Development for Penetration Testers teaches the skills required to reverse engineer 32-bit and 64-bit applications, perform remote user application and kernel debugging, analyze patches for 1-day exploits, and write complex exploits, such as use-after-free attacks, against modern software and operating systems.
You Will Learn:
- How to write modern exploits against the Windows 7 and 8 operating systems.
- How to perform complex attacks such as use-after-free, Kernel exploit techniques, one-day exploitation through patch analysis, and other advanced topics.
- The importance of utilizing a Security Development Lifecycle (SDL) or Secure SDLC, along with Threat Modeling.
- How to effectively utilize various debuggers and plug-ins to improve vulnerability research and speed.
- How to deal with modern exploit mitigation controls aimed at thwarting success and defeating determination.
SEC760.1: Threat Modeling, Reversing and Debugging with IDA
Definition: Many penetration testers, incident handlers, developers, and other relative professionals lack reverse engineering and debugging skills. This is a different skill than reverse engineering malicious software. As part of the Security Development Lifecycle (SDL) and Secure-SDLC, developers and exploit writers should have experience using IDA Pro to debug and reverse their code when finding bugs or when identifying potential risks after static code analysis or fuzzing.
CPE/CMU Credits: 6
- Security Development Lifecycle (SDL)
- Threat Modeling
- Why IDA is the #1 tool for reverse engineering
- IDA Navigation
- IDA Python and the IDA IDC
- IDA Plug-ins and extensibility
- Local application debugging with IDA
- Remote application debugging with IDA
SEC760.2: Advanced Linux Exploitaiton
The ability to progress into more advanced reversing and exploitation requires an expert-level understanding of basic software vulnerabilities, such as those covered in SANS SEC660. Heap overflows serve as a rite of passage into modern exploitation techniques. This day is aimed at bridging this gap of knowledge in order to inspire thinking in a more abstract manner, necessary for continuing further with the course. Linux can sometimes be an easier operating system to learn these techniques, serving as a productive gateway into Windows.
CPE/CMU Credits: 6
- Linux heap management, constructs, and environment
- Navigating the heap
- Abusing macros such as unlink() and frontlink()
- Function pointer overwrites
- Format string exploitation
- Abusing custom doubly-linked lists
- Defeating Linux exploit mitigation controls
- Using IDA for Linux application exploitation
SEC760.3: Patch Diffing, One-Day Exploits, and Return Oriented Shellcode
It is well known that attackers download patches as soon as they are distributed by vendors such as Microsoft in order to find newly patched vulnerabilities. Often, vulnerabilities are disclosed privately, or even discovered in-house, allowing the vendor to more silently patch the vulnerability. This also allows the vendor to release limited or even no details at all about a patched vulnerability. Attackers are well aware of this and quickly work to find the patched vulnerability in order to take control of unpatched systems. This technique is also performed by incident handlers, IDS administrators and vendors, vulnerability and penetration testing framework companies, government entities, and others.
CPE/CMU Credits: 6
- The Microsoft patch management process and "Patch Tuesday"
- Obtaining patches and patch extraction
- Binary diffing with BinDiff, patchdiff2, turbodiff, and darungrim3
- Visualizing code changes and identifying fixes
- Reversing 32-bit and 64-bit applications and modules
- Triggering patched vulnerabilities
- Writing one-day exploits
- Handling modern exploit mitigation controls
SEC760.4: Windows Kernel Debugging and Exploitation
The Windows Kernel is very complex and intimidating. This day aims to help you understand the Windows kernel and the various exploit mitigations added into recent versions. You will perform Kernel debugging on various versions of the Windows OS, such as Windows 7 and 8, and learn to deal with its inherent complexities. Exercises will be performed to analyze vulnerabilities, look at exploitation techniques, and get a working exploit.
CPE/CMU Credits: 6
- Understanding theWindows Kernel
- Navigating the Windows Kernel
- Modern Kernel protections
- Debugging the Windows Kernel
- Analyzing Kernel vulnerabilities and Kernel vulnerability types
- Kernel exploitation techniques
SEC760.5: Windows Heap Overflows and Client-Side Exploitation
The focus of this section is primarily on Windows browser and client-side exploitation. You will learn to analyze C++ vftable overflows, one of the most common mechanisms used to compromise a modern Windows system. Many of these vulnerabilities are discovered in the browser and therefore, browser techniques will be taught, such as modern heap spraying to deal with IE 8/9/10 and other browsers such as FireFox and Chrome. You will work towards writing exploits in the Use-After-Free/Dangling Pointer vulnerability class.
CPE/CMU Credits: 6
- Windows heap management, constructs, and environment
- Browser-based and client-side exploitation
- Remedial heap spraying
- Understanding C++ vftable/vtable behavior
- Modern heap spraying to determine address predictability
- Use-After-Free attacks and dangling pointers
- Determining exploitability
- Defeating ASLR, DEP, and other common exploit mitigation controls
SEC760.6: Capture the Flag
Day 6 will serve as a capture the flag day with different types of challenges from material taught throughout the week.
CPE/CMU Credits: 6
- Test your reverse engineering, bug discovery, and expoit-writing skills in a full day of capture the flag exercises!
|Tue Jul 22nd, 2014||7:00 PM - 10:00 PM ET||Stephen Sims|
|Thu Jul 24th, 2014||7:00 PM - 10:00 PM ET||Stephen Sims|
|Tue Jul 29th, 2014||7:00 PM - 10:00 PM ET||Jake Williams|
|Thu Jul 31st, 2014||7:00 PM - 10:00 PM ET||Jake Williams|
|Tue Aug 5th, 2014||7:00 PM - 10:00 PM ET||Stephen Sims|
|Wed Aug 6th, 2014||7:00 PM - 10:00 PM ET||Stephen Sims|
|Tue Aug 12th, 2014||7:00 PM - 10:00 PM ET||Jake Williams|
|Thu Aug 14th, 2014||7:00 PM - 10:00 PM ET||Jake Williams|
|Tue Aug 19th, 2014||7:00 PM - 10:00 PM ET||Stephen Sims|
|Thu Aug 21st, 2014||7:00 PM - 10:00 PM ET||Stephen Sims|
You must bring and will use VMware to run multiple operating systems when performing class exercises. Linux VM's with all necessary tools will be provided on the first day. Tools needed for Windows will be issued in class; however, you are required to build and bring the Windows virtual machines as listed below under Option 1 or Option 2. The VM's must be unpatched as we will be installing and removing patches in class. If possible, please ensure you bring the English Language Pack versions of the designated Windows VMs so that everyone is running the same images. If you choose to, or are unable to bring the specified OS and/or Service Pack versions, you may experience different outcomes during exercises.
Ensure that you have the administrative ability to disable all security software and protections, including antivirus and personal firewalls. You will likely not be able to complete the exercises without this level of control. Also ensure that you can install software that may be blocked by administrative or security controls due to their nature. You will be installing various debuggers and vulnerable applications onto the VM's.
Adherence to the following requirements is mandatory!:
- A minimum of 4GB+ of Physical Memory (RAM), preferably 8GB - 16GB+.
- VMware Workstation, Fusion, or Player. A 30-day free trial is available at http://www.vmware.com. VirtualBox is also acceptable, though not thoroughly tested.
- The following three (Unpatched, base install) virtual machines. This is mandatory!
- Windows XP SP3, Windows 7 32-bit (SP0 or SP1), and Windows 7 64-bit (SP0 or SP1)
- Windows XP SP3, Windows 7 32-bit (SP0 or SP1, and Windows 8.0 64-bit - No Windows 8.1!
- Bring your own copy of Backtrack or Kali Linux.
- 50GB of free hard disk space.
- PIII 1Ghz CPU Minimum / M Series 1.5 GHz or higher is recommended
- It is strongly recommended that you bring a licensed version of IDA Pro. A 20% discount is available to students signing up for SEC760. Please e-mail the course author, Stephen Sims, at firstname.lastname@example.org. You may choose not to purchase a license and use only the trial and free versions; however, you will not be able to complete some of the exercises as these versions have limitations.
***Attention Mac/OSX and Linux Users***
Due to various difficulties when performing Windows Kernel debugging between VM's using VMware Fusion, we strongly recommend that you bring a laptop option with a Windows host OS either as your only device, or in addition to your Mac. If you choose to bring only a Mac, you are required to set up Kernel debugging before attending class. Specifically, you must have fully tested your ability to successfully run a Kernel debugging session from one Windows VM in Fusion to another Windows VM. You will need to be able to perform Kernel debugging against all systems named in Option 1 or Option 2 from above. This also applies to Linux users running VMware.
Please see the attached document for assistance. Note: Your experience with these instructions may vary, depending on your version of OSX, Fusion, and other factors.
If you have additional questions about the laptop specifications, please contact email@example.com.
Who Should Attend
- Senior Network and System Penetration Testers
- Secure Application Developers - (C & C++)
- Reverse Engineering Professionals
- Senior Incident Handlers
- Senior Threat Analysts
- Vulnerability Researchers
- Security Researchers
Previous exploit-writing experience is required, such as those techniques covered in SANS SEC660: Advanced Penetration Testing, Exploits, and Ethical Hacking. This includes experience with stack-based buffer overflows on both Linux and Windows, as well as experience defeating modern exploit mitigation controls such as DEP, ASLR, canaries, and SafeSEH. Experience with various fuzzing tools such as the Sulley Fuzzing Framework is required. Programming experience is important, preferably with C/C++. At a minimum, scripting experience in a language such as Python, Perl, Ruby, or LUA is mandatory. Programming fundamentals such as functions, pointers, calling conventions, structures, etc... is mandatory and will be assumed knowledge. Experience with reverse engineering vulnerable code is also required, as is the ability to read x86 disassembly from within a debugger or disassembler. Experience with both Linux and Windows navigation is required, as well as TCP/IP experience. Failure to meet these requirements may result in the inability to keep up with the pace of the course.
Courses that Lead-in:
- SEC660 - Advanced Penetration Testing, Exploits, and Ethical Hacking
- FOR610 - Reverse Engineering Malware
- FOR526 - Windows Memory Forensics In-Depth
Courses that are Pre-reqs:
- SEC660 - Advanced Penetration Testing, Exploits, and Ethical Hacking
SEC760 is a very challenging course covering topics such as remote debugging with IDA, writing IDAPython & IDC scripts, SDL & threat modeling, Linux heap overflows, patch diffing, use-after-free attacks, Windows Kernel debugging and exploitation, and much more. Please see the course syllabus for a detailed listing, and be sure to take a look at the recommended prerequisites and laptop requirements. You are expected to already know how to write exploits for Windows and Linux applications, bypass exploit mitigation controls such as DEP and ASLR, utilize return oriented shellcode (ROP), etc.
As the author of the course, I get a lot of questions, including:
Am I ready for SEC760?
Should I take SEC660 first?
I've taken SEC660. Am I definitely ready for SEC760?
I've taken SEC560. Can I jump right to SEC760 if I only want the exploit dev material?
I have not taken any SANS pen testing courses, which one should I start with?
I've taken a course through Offensive Security, is the material the same?
There is no "one size fits all" reply to these types of questions, as everyone has a different level of experience. My personal recommendation is to thoroughly read through the course syllabus and prerequisite statements for any course you are considering. I am happy to answer any questions you may have about this subject matter to help you make an informed decision. You can reach me, Stephen Sims, at firstname.lastname@example.org .
I have written a ten question exam which will hopefully help you with determining if you are better suited for SEC660 or SEC760. Remember that this is purely from an exploit development perspective. SEC660 includes two days of material on introduction to exploit development and bypassing exploit mitigation controls. Much of the other material in SEC660 is on a wide range of advanced penetration testing topics such as network device exploitation (routers, switches, NAC), pentesting cryptographic implementations, fuzzing, Python, network booting attacks, escaping Linux and Windows restricted environments, etc.
What You Will Receive
- You will receive various preconfigured *NIX virtual machines; however, you are required to bring the aforementioned Windows VM's.
- You will receive various tools on a course DVD that are required for use in class.
You Will Be Able To
- Discover zero-day vulnerabilities in programs running on fully-patched modern operating systems.
- Create exploits to take advantage of vulnerabilities through a detailed penetration testing process.
- Use the advanced features of IDA Pro and write your own IDC and IDA Python scripts.
- Perform remote debugging of Linux and Windows applications.
- Understand and exploit Linux heap overflows.
- Write Return Oriented Shellcode.
- Perform patch diffing against programs, libraries, and drivers to find patched vulnerabilities.
- Perform Windows heap overflows and use-after-free attacks.
- Use precision heap sprays to improve exploitability.
- Perform Windows Kernel debugging up through Windows 8 64-bit.
- Jump into Windows kernel exploitation.
- You will be performing labls to reverse engineer several Microsoft patches from 2013 to identify the patched vulnerability, as well as take them through exploitation.
- You will perform use-after-free exploit labs against popular web browsers such as Internet Explorer.
- You will be remote-debugging both Linux and Windows applications, as well as remote-debugging the Windows 7 and 8 Kernels.
Press & Reviews
"SEC760 is a kind of training we couldn't get anywhere else. It's not a theory, we got to implement and to exploit everything we learn." - Jenny Kitaichit, Intel
As a perpetual student of information security, I am excited to offer this course on advanced Exploit Writing for Penetration Testers. Exploit development is a hot topic as of late and will continue to grow moving forward. With all of the modern exploit mitigation controls offered by operating systems such as Windows 7 and 8, the number of experts with the skills to produce working exploits is highly limited. More and more companies are hiring to fill experts with the ability to aid in a Secure-SDLC process, perform threat modeling, determine if vulnerabilities are exploitable, and perform security research. This course was written to help you get into these highly sought after positions and to teach you cutting edge tricks to thoroughly evaluate a target, providing you with the skills to improve your exploit development. Contact me at email@example.com if you have any questions about the course! -Stephen Sims