Advanced Windows Exploitation (AWE)

Prerequisites:

Participants should have:

• Experience in developing Windows exploits
• Proficiency in operating a debugger
• Familiarity with tools such as WinDBG, x86_64 assembly, IDA Pro, and basic C/C++ programming
• A strong willingness to work and dedicate real effort

Target Audience:

• Experienced penetration testers
• Security researchers
• Exploit developers
• Red team operators

By the end of this course, participants will be able to:

• Develop modern exploits for Windows-based platforms
• Bypass security mitigations such as DEP, ASLR, and CFG
• Perform complex heap manipulations
• Conduct 64-bit kernel exploitation
• Analyse vulnerable software and identify problematic code
• Develop functioning exploits for various modern Windows operating systems

Learning Outcomes:

Upon successful completion, participants will be able to:

• Demonstrate advanced skills in Windows exploitation
• Develop reliable exploits for modern Windows operating systems
• Effectively bypass advanced security mitigations
• Conduct thorough vulnerability assessments and exploit development

Introduction to Advanced Windows Exploitation

• Overview of modern Windows security features
• Understanding exploitation challenges in contemporary environments

Security Mitigation Bypass Techniques

• Bypassing Data Execution Prevention (DEP)
• Address Space Layout Randomization (ASLR) evasion
• Control Flow Guard (CFG) bypass strategies

Complex Heap Manipulations

• Understanding heap structures in Windows
• Techniques for heap spraying and grooming
• Exploiting heap-based vulnerabilities

64-bit Kernel Exploitation

• Introduction to Windows kernel architecture
• Identifying and exploiting kernel vulnerabilities
• Developing kernel-mode payloads

Case Studies and Practical Exercises

• Analysing real-world vulnerabilities in large, well-known applications
• Developing exploits in a controlled lab environment
• Documenting and reporting findings

Assessment and Certification:

• Exam: 72-hour practical exam taken post class, in a virtual lab environment, requiring the development and documentation of exploits for specific, unknown vulnerabilities.
• Certification: Offensive Security Exploitation Expert (OSEE) upon successful completion of the exam
• Contribute to advanced penetration testing and red teaming engagements