SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking

Overview

Section one serves as an advanced network attack module, building on knowledge gained from SEC560: Enterprise Penetration Testing. The focus will be on obtaining access to the network; manipulating the network to gain an attack position for eavesdropping and attacks, and for exploiting network devices; leveraging weaknesses in network infrastructure; and taking advantage of client frailty.

Full Lab Details

• Identify and bypass multiple checks by a NAC/Captive Portal system
• Obtain a middle position between two targets to abuse their relationship and inject content into plain HTTP and encrypted HTTPS traffic
• Identify and work around networking restrictions like IPv4 firewalls by using autoconfigured IPv6
• Abuse router-related protocols to divert traffic into an MiTM situation
• Bypass Multi-Factor Authentication and coerce a browser to visit a malicious site

Full Topic Details

• Bypassing network access/admission control (NAC)
• Impersonating devices with admission control policy exceptions
• Custom network protocol manipulation with Ettercap and custom filters
• Overcoming TLS/SSL transport encryption security with SSL-stripping
• Multiple techniques for performing network-based tampering
• IPv6 for penetration testers
• Exploiting OSPF authentication to inject malicious routing updates
• Bypass Multi-Factor Authentication (MFA) for credential stealing

Overview

Whether the initial foothold is access to a special purpose device, appliance, desktop, or server, escalation and restriction bypass is a practical part of penetration testing modern environments. We begin by building some fundamental knowledge on how ciphers operate, without getting bogged down in complex mathematics. Then we move on to techniques for identifying, assessing, and attacking real-world crypto implementations. We finish the module with lab exercises that allow students to practice their newfound crypto attack skill set against reproduced real-world application vulnerabilities.

The section continues with advanced techniques but focuses more on post-exploitation tasks. We leverage an initial foothold to further exploit the rest of the network. We abuse allowed features to escape restricted environments. First, we will build up knowledge of local restrictions on hosts. Once we establish a set of possible restrictions, we leverage that knowledge to circumvent them. We will cover the core components that restrict the desktop and a variety of escape possibilities. The Kiosk escape exercise is a perfect, real-world demonstration of the risks of relying on obfuscation and deny controls to thwart attacks.

As a major factor in post-exploitation, we cover both exploiting administrators' use of attack tools, many of which are PowerShell-based. We'll use specialized and alternative tools to escalate privileges, pivot, and deliver additional payloads.

Whether hosted on Linux or Windows, applications packaged in the form of Docker images are an additional consideration when identifying candidates for escalation or other abuse. The Docker escape exercise combines remote compromise, securing a better foothold, escalation, and finally escape to run privileged code outside the container on the host.

The section ends with a challenging boot camp exercise against a full network environment comprised of a variety of modern, representative, and fully patched systems with no obvious remote vulnerabilities.

Full Lab Details

• Identify obscured/proprietary and known patterns of data/encryption
• Create a forgery of an encrypted message with CBC Bit flipping attack
• Extend a valid hash to match forged injected data message
• Escape and escalate from a hardened kiosk Windows desktop
• Attack, Escape, and Escalate from a Docker image used for routing and network-related monitoring
• Combine escape and escalation techniques to escape, escalate, pivot, and steal sensitive information by abusing a Data Loss Prevention system

Full Topic Details

• Pen testing cryptographic implementations
• Exploiting CBC bit flipping vulnerabilities
• Exploiting hash-length extension vulnerabilities
• PowerShell as a victim
• PowerShell as an attacker
• Post Exploitation with PowerShell and alternatives
• Escaping Software Restrictions on Windows
• Escaping Software Restrictions in Linux and Docker
• Two-hour Capture the Flag exercise against an enterprise Data Loss Prevention solution

Overview

We start by discussing product security testing and how products often use open-source software that can sometimes be involved in software supply chain attacks. We look at product security testing in the AI era. Before we get into fuzzing, we take a look at leveraging Scapy for custom network targeting and protocol manipulation. Using Scapy, we examine techniques for transmitting and receiving network traffic beyond what canned tools can accomplish, including IPv6.

Next, we take a look at dynamic analysis and fuzz testing. We leverage fuzzing to target both common network protocols and popular file formats for bug discovery. We use hands-on exercises to develop custom protocol fuzzing grammars to discover bugs in popular software.

Finally, we carefully discuss the concept of code coverage and how it goes hand-in-hand with fuzzing. We will conduct a lab using the DynamRIO instruction manipulation library, IDA Pro to demonstrate the techniques discussed, and using AFL++ for source code-assisted fuzzing.

Full Lab Details

• Use the Scapy packet fuzzing framework to create custom packets to use for exploitation
• Leverage fuzzers to identify vulnerabilities in open-source and commercial programs
• Utilize fuzzing frameworks to build intelligent mutation fuzzers
• Use code coverage tools to aid in fuzzing both closed-source and open-source applications
• Utilize DynamoRIO and custom fuzzing tools to instrument closed-source binaries
• Use IDA Pro to work on reversing vulnerable programs
• Use AFLplusplus to instrument open-source programs for maximum code coverage

Full Topic Details

• Manipulating stateful protocols with Scapy
• Using Scapy to create a custom wireless data leakage tool
• Product security testing in the AI era
• Using BooFuzz for quick protocol mutation fuzzing
• Optimizing your fuzzing time with smart target selection
• Automating target monitoring while fuzzing with BooFuzz
• Source code-assisted binary fuzzing and code coverage measurement using AFL++
• Block-based code coverage techniques using DynamoRIO

Overview

Section four begins by walking through processor architecture from an exploitation perspective, as well as introducing x86 and x86-64 assembler and linking and loading. These topics are important for anyone performing penetration testing at an advanced level, working with exploits. Processor registers are directly manipulated by testers and must be intimately understood. Disassembly is a critical piece of testing and will be used throughout the remainder of the course.

We will take a look at the Linux OS from an exploitation perspective and discuss privilege escalation. We continue by describing how to look for SUID programs and other likely points of vulnerabilities and misconfigurations. The material will focus on techniques that are critical to performing penetration testing on Linux applications.

We then go heavily into stack overflows on Linux to gain privilege escalation and code execution. We will first cover using a debugger to expose internal program secrets. Then we will go over redirection of program execution and, finally, code execution. Techniques such as return to buffer and return to C library (ret2libc) will be covered, as well as an introduction to return-oriented programming.

The remainder of the section takes students through techniques used to defeat or bypass OS protections such as stack canaries and address space layout randomization (ASLR). The goal of this section is to expose students to common obstacles on modern Linux-based systems. AI is used to assist in bug discovery and PoC generation.

Full Lab Details

• Identifying and exploiting memory corruption vulnerabilities in Linux programs
• Utilizing a technique known as ret2libc to avoid Data Execution Prevention (DEP)
• Analyzing stack canaries and looking for opportunities to repair them for successful exploitation
• Exploiting binaries with Address Space Layout Randomization (ASLR) enabled
• Exploiting 64-bit binaries
• Leveraging a local LLM to assist in analysis
• Extended hours exercises allowing you to continue using the techniques covered in class to exploit additional programs

Full Topic Details

• Stack memory management and allocation on the Linux OS
• Disassembling a binary and analyzing x86/x86-64 assembly code
• Performing symbol resolution on the Linux OS
• Identifying vulnerable programs using AI
• Code execution redirection
• Identifying and analyzing stack-based overflows on the Linux OS
• Performing return-to-libc (ret2libc) attacks on the stack
• Return-oriented programming
• Defeating stack protection on the Linux OS
• Defeating ASLR on the Linux OS

Overview

Section five starts off covering the OS security features (ASLR, DEP, etc.) added to the Windows OS over the years, as well as Windows-specific structures, such as the process environment block (PEB), structured exception handling (SEH), thread information block (TIB), and the Windows application programming interfaces (API). Differences between Linux and Windows will be covered. These topics are critical in assessing Windows-based applications. We will also take a deep dive into the many exploit mitigations available on the Windows OS and applications, both mandatory and optional.

We then focus on stack-based attacks against programs running on the Windows OS. After finding a vulnerability in an application, the student will work with Immunity Debugger to turn the bug into an opportunity for code execution and privilege escalation. Advanced stack-based techniques, such as disabling data execution prevention (DEP) are covered. Client-side exploitation will be introduced, as it is a highly common area of attack.

We continue with the topic of return-oriented programming (ROP), demonstrating the technique against a vulnerable application, while looking at defeating hardware DEP and address space layout randomization (ASLR) on Windows 11.

Finally, we will take a quick look at shellcode and the differences between shellcode on Linux and Windows, followed by a ROP challenge.

Full Lab Details

• Identify vulnerabilities and exploit commercial applications on the Windows 11 OS
• Identify exploitable stack overflow conditions
• Use techniques to evade exploit mitigations, such as SafeSEH
• Utilize Return Oriented Programming (ROP) to work around the DEP mitigation on Windows
• Write your own ROP chain with the help of tooling, and learn to debug ROP chains to ensure their success

Full Topic Details

• The state of Windows OS protections on the Windows OS
• Understanding common Windows constructs
• Stack exploitation on Windows
• Defeating OS protections added to Windows
• Advanced stack-smashing on Windows
• Using ROP
• Building ROP chains to defeat DEP and bypass ASLR
• Windows 11 exploitation
• Client-side exploitation
• Windows Shellcode

Overview

This section will serve as a real-world challenge for students by requiring them to utilize skills they have learned throughout the course, think outside the box, and solve a range of problems from simple to complex. A web server scoring system and Capture the Flag engine will be provided to score students as they capture flags. More difficult challenges will be worth more points. In this offensive exercise, challenges range from local privilege escalation to remote exploitation on both Linux and Windows systems, as well as networking attacks and other challenges related to the course material.