THE EXPLOIT LABORATORY ADVANCED EDITION

The Exploit Laboratory Advanced Edition is a new class specially designed for a 3-day format. The class is an intermediate to advanced level class, for those curious to dig deeper into the art and craft of software exploitation. The Advanced Edition begins with a quick overview of stack overflows, exception handler abuse, memory overwrites, and other core concepts. The class then moves on to use-after-free bugs and vtable overwrites, especially applicable to browser and PDF exploits. The class also spends a lot of time focusing on defeating modern day exploit mitigation techniques like DEP and ASLR using Return Oriented Programming (ROP).

The Exploit Laboratory Advanced Edition requires a lot of hands on work. Lab examples used in this class cover Linux and Microsoft Windows platforms, featuring popular third party applications and products instead of simulated lab exercises.

As with the popular Exploit Laboratory, all topics are delivered in a down-to-earth, learn-by-example methodology. The same trainers who brought you The Exploit Laboratory for over five years have been working hard in putting together advanced material based on past feedback.

Student Pre-requisite

  • Have a working knowledge of operating systems, Win32 and Unix.
  • Not be allergic to command line tools.
  • Use vi/pico/joe editors.
  • Have a working knowledge of shell scripts, cmd scripts or Perl.
  • Understanding of C programming would be a bonus.

Software Requirement

  • Windows XP SP3 / Windows 7 / Linux kernel 2.4 or 2.6 / Mac OS X 10.6 or 10.7 (Intel only)
  • VMWare Player / VMWare Workstation / VMWare Fusion MANDATORY
  • Administrator / root access MANDATORY
  • Ability to disable Anti-virus software on your laptop
  • Ability to disable Host firewall
  • Perl 5.8
  • An SSH client, such as PuTTY
  • Netcat

  • NOTE: If your laptop is a locked-down company issued laptop, please make sure you have VMWare Workstation or VMWare Player installed by your administrator before you come to class.

Hardware Requirement

  • A working laptop (no Netbooks)
  • Intel Core 2 Duo x86/x64 hardware (or superior) required
  • 2GB RAM required, at a minimum, 4GB preferred, and anywhere in between shall be tolerated
  • Wireless network card
  • 20 GB free Hard disk space

Course Outline

LEARNING OBJECTIVES
  • Stack Overflows (Linux and Windows)
  • Abusing Structured Exception Handlers on Windows
  • Use-after-free bugs and vtable overwrites
  • Browser Exploits
  • PDF Exploits
  • Defeating DEP using Ret2LibC
  • Introduction to Return Oriented Programming
  • ROP gadgets and stack flips.
  • ROP shellcode loaders
  • Practical ROP Exploits
  • Bypassing ASLR on Windows 7
  • Advanced Heap Spray techniques
TARGET AUDIENCE
  • Pen-testers, Security analysts, Security auditors, who want to take their skills to the next level and write their own exploits instead of borrowing them.
  • Developers and Project managers, who want to understand what can happen to poorly written code.
  • Members of internal product security groups, who want to pen-test custom binaries and exploit custom built applications.
  • System administrators, who want to follow a more "pro-active" approach in enforcing security measures.
  • Just about anyone curious about vulnerabilities and exploits.
Smashing the Stack
  • Introduction to systems concepts
  • Using GDB and WinDBG
  • Stack overflows on Linux
  • Stack overflows on Windows 7
  • Exercises
Browser and PDF exploitation
  • Use-after-free bugs
  • vtable overwrites
  • Browser Exploits
  • PDF Exploits
  • Exercises
Exploit Mitigation Bypass
  • Defeating DEP using Ret2LibC
  • Introduction to Return Oriented Programming
  • ROP gadgets and stack flips.
  • ROP shellcode loaders
  • Practical ROP Exploits
  • Bypassing ASLR on Windows 7
  • Advanced Heap Spray techniques

About Instructor

Saumil Shah

Saumil Shah is the founder and CEO of Net-Square, providing cutting edge information security services to clients around the globe. Saumil is an internationally recognized speaker and instructor, having regularly presented at conferences like Blackhat, RSA, CanSecWest, PacSec, EUSecWest, Hack.lu, Hack-in-the-box and others. He has authored two books titled "Web Hacking: Attacks and Defense" and "The Anti-Virus Book".

Saumil graduated with an M.S. in Computer Science from Purdue University, USA and a B.E. in Computer Engineering from Gujarat University. He spends his leisure time breaking software, flying kites, traveling around the world and taking pictures.