h4cker/exploit_development/README.md

Exploit Development References

Tutorials and Examples

• Shellcode Tutorial
• Shellcode Examples
• Exploit Writing Tutorials
• Exploit Exercises

Hex Editors

• HexEdit.js - Browser-based hex editing.
• Hexinator - World's finest (proprietary, commercial) Hex Editor.
• Frhed - Binary file editor for Windows.
• 0xED - Native macOS hex editor that supports plug-ins to display custom data types.

File Format Analysis Tools

• Kaitai Struct - File formats and network protocols dissection language and web IDE, generating parsers in C++, C#, Java, JavaScript, Perl, PHP, Python, Ruby.
• Veles - Binary data visualization and analysis tool.
• Hachoir - Python library to view and edit a binary stream as tree of fields and tools for metadata extraction.

Reverse Engineering Tools

The following are some of the most popular reverse engineering tools. HOWEVER! GO TO THE REVERSE ENGINEERING SECTION for more references.

• Interactive Disassembler (IDA Pro) - Proprietary multi-processor disassembler and debugger for Windows, GNU/Linux, or macOS; also has a free version, IDA Free.
• WDK/WinDbg - Windows Driver Kit and WinDbg.
• OllyDbg - x86 debugger for Windows binaries that emphasizes binary code analysis.
• Radare2 - Open source, crossplatform reverse engineering framework.
• x64dbg - Open source x64/x32 debugger for windows.
• Immunity Debugger - Powerful way to write exploits and analyze malware.
• Evan's Debugger - OllyDbg-like debugger for GNU/Linux.
• Medusa - Open source, cross-platform interactive disassembler.
• plasma - Interactive disassembler for x86/ARM/MIPS. Generates indented pseudo-code with colored syntax code.
• peda - Python Exploit Development Assistance for GDB.
• dnSpy - Tool to reverse engineer .NET assemblies.
• binwalk - Fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.
• PyREBox - Python scriptable Reverse Engineering sandbox by Cisco-Talos.
• Voltron - Extensible debugger UI toolkit written in Python.
• Capstone - Lightweight multi-platform, multi-architecture disassembly framework.
• rVMI - Debugger on steroids; inspect userspace processes, kernel drivers, and preboot environments in a single tool.
• Frida - Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.

Implant Creation

• Exploiting CVE-2017-0199: HTA Handler Vulnerability
• CVE-2017-0199 Toolkit
• CVE-2017-8759-Exploit-sample
• Window Signed Binary
• Wepwnise
• Bash Bunny
• Generate Macro - Tool
• How To: Empire’s Cross Platform Office Macro
• Excel macros with PowerShell
• PowerPoint and Custom Actions
• MS Signed mimikatz in just 3 steps
• Hiding your process from sysinternals
• Luckystrike: An Evil Office Document Generator
• The Absurdly Underestimated Dangers of CSV Injection
• Macro-less Code Exec in MSWord
• Multi-Platform Macro Phishing Payloads
• Macroless DOC malware that avoids detection with Yara rule
• Empire without powershell
• Powershell without Powershell to bypass app whitelist
• Phishing between the app whitelists
• Bypass Application Whitelisting Script Protections - Regsvr32.exe & COM Scriptlets (.sct files)
• Bypassing Application Whitelisting using MSBuild.exe - Device Guard Example and Mitigations
• Windows oneliners to download remote payload and execute arbitrary code
• Week of Evading Microsoft ATA - Announcement and Day 1 to Day 5
• AMSI How Windows 10 Plans to Stop Script-Based Attacks and How Well It Does It
• USING A SCF FILE TO GATHER HASHES
• USING THE DDE ATTACK WITH POWERSHELL EMPIRE
• AVSignSeek
• Keying Payloads for Scripting Languages
• Executing Metasploit & Empire Payloads from MS Office Document Properties (part 1 of 2)
• Executing Metasploit & Empire Payloads from MS Office Document Properties (part 2 of 2)
• Microsoft Office – NTLM Hashes via Frameset
• Abusing Microsoft Word Features for Phishing: “subDoc”
• code signing certificate cloning attacks and defenses
• userland api monitoring and code injection detection
• In memory evasion

Return Oriented Programming

• The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls
• Blind return-oriented programming
• Sigreturn-oriented Programming
• Jump-Oriented Programming: A New Class of Code-Reuse Attack
• Out of control: Overcoming control-flow integrity
• ROP is Still Dangerous: Breaking Modern Defenses
• Loop-Oriented Programming(LOP): A New Code Reuse Attack to Bypass Modern Defenses - by Bingchen Lan, Yan Li, Hao Sun, Chao Su, Yao Liu, Qingkai Zeng [2015]
• Systematic Analysis of Defenses Against Return-Oriented Programming -by R. Skowyra, K. Casteel, H. Okhravi, N. Zeldovich, and W. Streilein [2013]
• Return-oriented programming without returns -by S.Checkoway, L. Davi, A. Dmitrienko, A. Sadeghi, H. Shacham, and M. Winandy [2010]
• Jump-oriented programming: a new class of code-reuse attack -by T. K. Bletsch, X. Jiang, V. W. Freeh, and Z. Liang [2011]
• Stitching the gadgets: on the ineffectiveness of coarse-grained control-flow integrity protection - by L. Davi, A. Sadeghi, and D. Lehmann [2014]
• Size does matter: Why using gadget-chain length to prevent code-reuse attacks is hard - by E. Göktas, E.Athanasopoulos, M. Polychronakis, H. Bos, and G.Portokalidis [2014]
• Buffer overflow attacks bypassing DEP (NX/XD bits) – part 1 - by Marco Mastropaolo [2005]
• Buffer overflow attacks bypassing DEP (NX/XD bits) – part 2 - by Marco Mastropaolo [2005]
• Practical Rop - by Dino Dai Zovi [2010]
• Exploitation with WriteProcessMemory - by Spencer Pratt [2010]
• Exploitation techniques and mitigations on Windows - by skape
• A little return oriented exploitation on Windows x86 – Part 1 - by Harmony Security and Stephen Fewer [2010]
• A little return oriented exploitation on Windows x86 – Part 2 - by Harmony Security and Stephen Fewer [2010]

Windows memory protections

Windows memory protections Introduction Articles.

• Data Execution Prevention
• /GS (Buffer Security Check)
• /SAFESEH
• ASLR
• SEHOP

Bypassing filter and protections

Windows memory protections Bypass Methods Articles.

• Third Generation Exploitation smashing heap on 2k - by Halvar Flake [2002]
• Creating Arbitrary Shellcode In Unicode Expanded Strings - by Chris Anley
• Advanced windows exploitation - by Dave Aitel [2003]
• Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft Windows 2003 Server - by David Litchfield
• Reliable heap exploits and after that Windows Heap Exploitation (Win2KSP0 through WinXPSP2) - by Matt Conover in cansecwest 2004
• Safely Searching Process Virtual Address Space - by Matt Miller [2004]
• IE exploit and used a technology called Heap Spray
• Bypassing hardware-enforced DEP - by Skape (Matt Miller) and Skywing (Ken Johnson) [October 2005]
• Exploiting Freelist[0] On XP Service Pack 2 - by Brett Moore [2005]
• Kernel-mode Payloads on Windows in uninformed
• Exploiting 802.11 Wireless Driver Vulnerabilities on Windows
• Exploiting Comon Flaws In Drivers
• Heap Feng Shui in JavaScript by Alexander sotirov [2007]
• Understanding and bypassing Windows Heap Protection - by Nicolas Waisman [2007]
• Heaps About Heaps - by Brett moore [2008]
• Bypassing browser memory protections in Windows Vista - by Mark Dowd and Alex Sotirov [2008]
• Attacking the Vista Heap - by ben hawkes [2008]
• Return oriented programming Exploitation without Code Injection - by Hovav Shacham (and others ) [2008]
• Token Kidnapping and a super reliable exploit for windows 2k3 and 2k8 - by Cesar Cerrudo [2008]
• Defeating DEP Immunity Way - by Pablo Sole [2008]
• Practical Windows XP2003 Heap Exploitation - by John McDonald and Chris Valasek [2009]
• Bypassing SEHOP - by Stefan Le Berre Damien Cauquil [2009]
• Interpreter Exploitation : Pointer Inference and JIT Spraying - by Dionysus Blazakis[2010]
• Write-up of Pwn2Own 2010 - by Peter Vreugdenhil
• All in one 0day presented in rootedCON - by Ruben Santamarta [2010]
• DEP/ASLR bypass using 3rd party - by Shahin Ramezany [2013]
• Bypassing EMET 5.0 - by René Freingruber [2014]

Typical windows exploits

• Real-world HW-DEP bypass Exploit - by Devcode
• Bypassing DEP by returning into HeapCreate - by Toto
• First public ASLR bypass exploit by using partial overwrite - by Skape
• Heap spray and bypassing DEP - by Skylined
• First public exploit that used ROP for bypassing DEP in adobe lib TIFF vulnerability
• Exploit codes of bypassing browsers memory protections
• PoC’s on Tokken TokenKidnapping . PoC for 2k3 -part 1 - by Cesar Cerrudo
• PoC’s on Tokken TokenKidnapping . PoC for 2k8 -part 2 - by Cesar Cerrudo
• An exploit works from win 3.1 to win 7 - by Tavis Ormandy KiTra0d
• Old ms08-067 metasploit module multi-target and DEP bypass
• PHP 6.0 Dev str_transliterate() Buffer overflow – NX + ASLR Bypass
• SMBv2 Exploit - by Stephen Fewer
• Microsoft IIS 7.5 remote heap buffer overflow - by redpantz
• Browser Exploitation Case Study for Internet Explorer 11 - by Moritz Jodeit [2016]

Exploit development tutorial series

Exploid Development Tutorial Series Base on Windows Operation System Articles.

• Corelan Team

  • Exploit writing tutorial part 1 : Stack Based Overflows
  • Exploit writing tutorial part 2 : Stack Based Overflows – jumping to shellcode
  • Exploit writing tutorial part 3 : SEH Based Exploits
  • Exploit writing tutorial part 3b : SEH Based Exploits – just another example
  • Exploit writing tutorial part 4 : From Exploit to Metasploit – The basics
  • Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development
  • Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR
  • Exploit writing tutorial part 7 : Unicode – from 0x00410041 to calc
  • Exploit writing tutorial part 8 : Win32 Egg Hunting
  • Exploit writing tutorial part 9 : Introduction to Win32 shellcoding
  • Exploit writing tutorial part 10 : Chaining DEP with ROP – the Rubik’s Cube
  • Exploit writing tutorial part 11 : Heap Spraying Demystified

• Fuzzysecurity

  • Part 1: Introduction to Exploit Development
  • Part 2: Saved Return Pointer Overflows
  • Part 3: Structured Exception Handler (SEH)
  • Part 4: Egg Hunters
  • Part 5: Unicode 0x00410041
  • Part 6: Writing W32 shellcode
  • Part 7: Return Oriented Programming
  • Part 8: Spraying the Heap Chapter 1: Vanilla EIP
  • Part 9: Spraying the Heap Chapter 2: Use-After-Free
  • Part 10: Kernel Exploitation -> Stack Overflow
  • Part 11: Kernel Exploitation -> Write-What-Where
  • Part 12: Kernel Exploitation -> Null Pointer Dereference
  • Part 13: Kernel Exploitation -> Uninitialized Stack Variable
  • Part 14: Kernel Exploitation -> Integer Overflow
  • Part 15: Kernel Exploitation -> UAF
  • Part 16: Kernel Exploitation -> Pool Overflow
  • Part 17: Kernel Exploitation -> GDI Bitmap Abuse (Win7-10 32/64bit)
  • Heap Overflows For Humans 101
  • Heap Overflows For Humans 102
  • Heap Overflows For Humans 102.5
  • Heap Overflows For Humans 103
  • Heap Overflows For Humans 103.5

• Securitysift

  • Windows Exploit Development – Part 1: The Basics
  • Windows Exploit Development – Part 2: Intro to Stack Based Overflows
  • Windows Exploit Development – Part 3: Changing Offsets and Rebased Modules
  • Windows Exploit Development – Part 4: Locating Shellcode With Jumps
  • Windows Exploit Development – Part 5: Locating Shellcode With Egghunting
  • Windows Exploit Development – Part 6: SEH Exploits
  • Windows Exploit Development – Part 7: Unicode Buffer Overflows