Duration
4 days
Overview
Once vulnerabilities have been found, there are different approaches to make use of them to exploit a system. The course will start by introducing basic exploitation methods like buffer and heap overflow techniques, as well as more advanced ideas for both Windows and Linux systems (for the experts: ASLR, SEH/SafeSEH, ROP, DEP etc. will be demonstrated and explained). Since system security is mainly based on encryption technologies, modern crypto systems will be explained, as will aspects of crypto security and how intruders try to break them.
Another important topic on this course is software resilience: malware execution is always based on an unintended program flow redirection. This course will show how code can be protected from being altered by introducing code morphing and obfuscation techniques. It is also planned to give an overview of virtualisation techniques, which help engineers analyse malware as long as the malware is not aware it is being executed in a research environment, but also carries the risk of potential malware escapes from the virtual environments, which have been seen before.
Course Prerequisite
Sound knowledge of assembly level programming
Sound knowledge of operating system details at process/library level on both Windows and Linux systems.
Who Need to Attend
The target audience is exclusively technical staff of CERTs/CIRTs or other governmental or military entities being involved in technical IT security or cyber defence.
1. Introduction
- Course Introduction
- Malware and Exploits – basics and definitions
- 2. Modern OS environment
- Creating a program
- Compilation, linking, shared libraries, sections of program
- Assembly introduction, AT&T vs. Intel syntax, endianness
- 3. Debuggers
- Static and dynamic program analysis
- Getting info about binaries
- Introduction to GDB debugger
- 4. Buffer overflows
- Concept of stack frame and local variables of function
- Buffer overflows without ASLR and NX/XD techniques
- Return‐to‐system and chaining
- Introduction to Immunity debugger and windbg
- Generating shell code
- 5. Heap overflows
- Exploitability of heap management
- Modern heap implementation
- 6. Protective mechanisms and common exploitation ideas
- Canaries, non‐executable stack
- ASLR, Position independent code
- 7. Linux exploitation in practice
- Return‐Oriented‐Programming approach
- 8. Windows exploitation in practice
- Structured Exception Handler (SEH, SAFESEH, SEHOP)
- Disabling DEP, permanent DEP
- ASLR (brute forcing, non ASLR libs, Information Leakage + HEAP spraying)
Programme scope, delivery arrangements and suitability are confirmed during enquiry.