Advanced Windows Exploitation

All efforts for the AWE course and preparation for the Offensive Security Exploitation Expert (OSEE) exam.

Study Strategy

• Several rounds of course content
• First round:
  • Shellcoding on x64
  • Flash Player [Firefox x86] - Heap Internals (bypassing DEP, ASLR and Sandboxes) - CVE-2015-3104
• Second round:
  • VMWare Internals (guest-to-hosts escape)
  • Symantec Endpoint Protection - Bypass Windows Defender Exploit Guard (WDEG)
• Third round:
  • Edge Exploitation - Type Confusion Bugs and Sandbox Escapes (Edge and Chakra JavaScript Engine)
  • JavaScript Code on x64 - CVE-2017-8601
• Fourth round:
  • Windows 10 x64 - Kernel Exploitation
  • Kernel Space Exploitation - Bypass Modern Protections (ACG, CFG, SMEP) - CVE-2015-5736
• Further Study:
  • Architectures
    • Intel 32-bit
    • Intel 64-bit
  • Tools
    • IDA Pro
    • WinDBG
  • Courses
    • Assembly
    • C/C++
    • C#
    • JavaScript
  • Books
    • A Guide to Kernel Exploitation: Attacking the Core
    • Windows System Programming (4th Edition)
    • Windows Internals, Part 1 (6th Edition)
    • Windows Internals, Part 2 (6th Edition)
    • Advanced Windows Debugging
    • The IDA Pro Book, 2nd Edition
    • Reversing: Secrets of Reverse Engineering
  • Crackmes
    • Crackmes.one - https://crackmes.one
  • Youtube Videos
    • WinDBG 1 - https://www.youtube.com/watch?v=QuFJpH3My7A
    • WinDBG 2 - https://www.youtube.com/watch?v=8zBpqc3HkSE
    • SMEP - https://www.youtube.com/watch?v=QGf0-jHFulg&vl=en
    • Windows Kernel Exploitation 1 - https://www.youtube.com/watch?v=Gu_5kkErQ6Y
    • Windows Kernel Exploitation 2 - https://www.youtube.com/watch?v=2chDv_wTymc
    • Capcom.sys - https://www.youtube.com/watch?v=pJZjWXxUEl4
    • Bypass Control Flow Guard - https://www.youtube.com/watch?v=K929gLPwlUs
    • EDGE (JIT) - https://www.youtube.com/watch?v=lBL4KGIybWE