Exploits 2 Exploitation in the Windows Environment samples , source codes , labs and video Free Download

Exploits 2: Exploitation in the Windows Environment samples , source codes , labs and video

English | Size: 5.56 GB (5,974,413,587 Bytes)
Category: Tutorial

This course covers the exploitation of stack corruption vulnerabilities in the Windows environment. Stack overflows are programming flaws that often times allow an attacker to execute arbitrary code in the context of a vulnerable program. There are many nuances involved with exploiting these vulnerabilities in Windows. Window’s exploit mitigations such as DEP, ASLR, SafeSEH, and SEHOP, makes leveraging these programming bugs more difficult, but not impossible. The course highlights the features and weaknesses of many the exploit mitigation techniques deployed in Windows operating systems. Also covered are labs that describe the process of finding bugs in Windows applications with mutation based fuzzing, and then developing exploits that target those bugs.

Topics covered in the labs for this class include:

* Exploiting a vanilla Windows stack overflow with no mitigations turned on

* Using WinDbg to analyze our crashes

* Removing bytes from your payload (such as nulls) which would prevent exploitation

* Finding functions to call by walking the Thread Execution Block to find kernel32.dll’s location in memory so we can call functions like LoadLibrary() and GetProcAddress()

* Hashing strings to use for comparison when searching for functions, in order to minimize the size of the payload

* Overwriting Structured Exception Handlers (SEH) as a means to bypass stack cookies (/GS compile option) and bypassing the SafeSEH mitigation

* Overwriting virtual function table function pointers in C++ code as another way around stack cookies

* Using Return Oriented Programming (ROP) to defeat Data Execution Prevention (DEP) aka non-executable (NX) stack

* Using libraries which opt out of Address Space Layout Randomization (ASLR) and SafeSEH to bypass these mitigations

* Using Python to mutationally fuzz the custom, never-before-analyzed, Corey’s Crappy Document Format and Crappy Document Reader in order to find and exploit the numerous bugs within

Author Biography:

Corey Kallenberg co-founded LegbaCore in January 2015 to focus on improving firmware security. He has a Bachelors of Science in Computer Science from the University of Waterloo. His specialty areas are trusted computing, vulnerability research and low level development. In particular, Corey has spent several years using his vulnerability research expertise to evaluate limitations in current trusted computing implementations. In addition, he has used his development experience to create and improve upon trusted computing applications. Among these are a timing based attestation agent designed to improve firmware integrity reporting, and an open source Trusted Platform Module driver for Windows. Corey is also an experienced trainer, having created and delivered technical courses for the MITRE Institute, OpenSecurityTraining.info, CanSecWest, as well as numerous private customers. He is an internationally recognized speaker who has presented at BlackHat USA, DEF CON, CanSecWest, Hack in the Box KUL/AMS/GSEC, SummerCon, NoSuchCon, SyScan, EkoParty and Ruxcon. In 2015, Corey won the Pwnie award for best privilege escalation bug, for CERT VU# 552286, which exploits from userspace (ring 3) to SMM (ring “-2”), and which was found on hundreds of models of computers.

Buy Long-term Premium Accounts To Support Me & Max Speed

DOWNLOAD:

If any links die or problem unrar, send request to http://goo.gl/aUHSZc

Exploits 2 Exploitation in the Windows Environment samples , source codes , labs and video

About Learning for Life

Leave a Reply Cancel reply