Hands-On Exploit Development

This class will primarily focus on Win32 exploit development, but there will be basic exercises in Windows x64 bit, x86 Linux, and ARM platforms. Student will gain hands on experience finding vulnerabilities, writing working exploits from scratch, and porting public exploit code to meet your needs. We will start with the basics of stack based buffer overflows and study saved return pointer and structured exception handler overwrites in depth. We will look at methods for dealing with space issues such as egghunting and relative jumps. We will also cover dealing with character set limitations, such as Unicode conversions and alphanumeric shellcode. We will also look at writing shellcode manually in assembly. Then we will move onto bypassing more advanced anti-exploitation measures such as stack cookies, ASLR, DEP, etc. In addition, to writing exploits from scratch we will look at public exploit code and porting it to fit our environment's needs. We will also look at writing Metasploit modules and porting our exploits into Metasploit.

Hands-on labs will be covered, exploiting real vulnerable programs. The course is structured such that we will work through an exercise covering a new concept together followed by a similar exercise where students will work independently. No previous programming or exploitation experience is required. Exploit skeletons will be provided for each exercise allowing students to focus on the attack string rather than programming syntax. Students will become familiar with using the tools of the trade, such as Immunity Debugger, Mona.py, Wingdb, and gdb.