Reverse Engineering and Exploit Development

Learn about common vulnerabilities, especially stack buffer overflows in C programs caused by user-controlled input and overflow-prone copies like strcpy.

Compile and run stack and heap buffer overflow demos with gcc, observe segmentation faults and aborts, and contrast stack memory, heap allocation, and vulnerability discovery.

Explore format string vulnerabilities when untrusted input controls the print function formatting. Learn how these flaws can cause segmentation faults, memory pointer leakage, and kernel-level risks with elevated privileges.

Learn how fuzzing uses random input to crash applications and reveal vulnerabilities, then create a virtual lab with VirtualBox and a host-only network to test a vuln server.

Continue fuzzing a downloaded vulnerable server, identify host addresses, and use netcat to send commands via a script for semi automated input.

Automate fuzzing to simplify vulnerability testing by injecting commands with backticks, echoing results, and using zees to mutate bytes—start at byte 12—and attempt to crash a vulnerable server.

Master fuzzing with a simple perl script to automate sending crafted inputs to a vulnerable server, observe crashes in a debugger, and analyze registers to steer execution toward shell code.

Disassemble a simple program to examine how assembly language sits above machine code, and observe memory layout, registers, and a potential buffer overflow during a string copy, using a debugger.

Debug a buffer overflow program in assembly by setting breakpoints, stepping through function calls, and tracing stack growth and return addresses.

Investigate how a buffer overflow in assembly language can overwrite a return address on the stack, leading to an access violation and potential manipulation of function calls via str copy.

Learn how stack overflows relate to calling conventions on 32-bit Windows, including cdecl, stdcall, and fastcall, and how overflowing a local variable can overwrite the return address to run shellcode.

This lecture continues the discussion of stack overflows with a simple program and a Python tester, showing how to craft input, trigger a crash, and determine offset to return address.

Demonstrate a buffer overflow exploit by showing how copying a string on the stack overwrites the return address, and how a Python script crafts the payload.

Continue exploring heap buffer overflows by tracing a vulnerable program’s heap creation and memory allocations, including the free and look aside list, ending in an access violation.

This lecture extends heap overflow concepts on Windows by manipulating three 16-byte buffers, overwriting buffer2's pointers using a little-endian address, injecting shell code, and freeing to observe in Immunity Debugger.

Target heap overflows by overwriting lookaside list pointers, placing shellcode in a writable, executable heap region, and verifying technique with Immunity Debugger.

Investigate format string vulnerabilities by showing how untrusted input in printf can access the stack and guide exploitation using precise input patterns and stack disclosure.

Explore format string vulnerabilities through a hands-on immunity debugging session, showing how stack variables, %x outputs, and length specifiers guide payload construction to reach shellcode or overwrite a return address.

Explore format string vulnerabilities, manipulating the stack to control registers and return addresses, identify call stack pointers, and craft values to redirect program flow.

Demonstrates format string vulnerabilities by building a Python exploit that writes the shellcode address with format length specifiers, uses a NOP sled, and runs via subprocess to launch calculator.

Explore section overflow vulnerabilities in Windows, demonstrating how buffer overflows can overwrite global variables and function pointers, enabling corruption of strcpy and printf calls through crafted input.

Examine kernel mode exploits by detailing privilege levels and rings, focusing on ring 0 and ring 3, system calls, and vulnerabilities in the Windows kernel and device drivers.

Learn how decompilers like boomerang and rex studio convert a simple buffer overflow program into readable code, revealing overhead, function prototypes, and output path considerations.

Explore how automation speeds reverse engineering tasks by running a Python script to test multiple commands against a vulnerable server, using sockets, incrementing payload lengths, and crash detection.

Explore automated fuzzing and reverse engineering on a decompiled program using Rex Studio to spot format string and strcpy vulnerabilities with a simple grep-based script.

Explore how exploits and reversing apply to macOS, comparing stack and heap memory, overcoming non-executable stack, and addressing format string bugs in C libraries.

Demonstrates how a 20-byte stack buffer with user input and strcpy can overflow, causing a segmentation fault on Mac and Linux when input exceeds limits.

Explore Mac heap structures and malloc zones, learn heap overflow techniques to overwrite function pointers, consider stacks, and use memory patterns to locate offsets across old and new Mac architectures.

Explore linux vulnerability landscapes for exploit development, including stack overflow vulnerabilities, stack protections, non-executable memory, heap and format string bugs, and kernel risks, with emphasis on zero-days and responsible disclosure.

demonstrates linux stack overflows using a 10-byte local buffer and strcpy, showing how stack protection halts exploitation while disabling it enables overflow.

Explore Linux stack buffer overflows by debugging two program versions with gdb, learning commands, breakpoints, and stepping through to observe segmentation faults.

Explore how GDP and gdb reveal Linux stack overflows by inspecting the 64-bit stack pointer (RSP) and memory layout, with and without stack protector.

Explore how Linux stack protectors use stack canaries and compiler-reordered stacks, including copied local variables and parameters, to protect return addresses and detect overwrites, with gdb debugging.

Investigate Linux stack buffer overflows with stack protector enabled, using function pointers to probe potential overwrites, and debug with gdb, breakpoints, and memory analysis to assess exploitable vulnerabilities.

Demonstrates how a 32-byte malloc buffer can be overflowed by strcpy, causing heap corruption and a Linux abort, with gdb breakpoints before strcpy and before free revealing heap metadata.

Explore Linux heap overflows by analyzing two 32-byte buffers, using strcpy, malloc, and free, and debugging with gdb to observe memory addresses and overflow effects.

Explore linux heap overflows, showing how overwriting buffers on a 64-bit little-endian system can trigger sig abort and probe protections using two's complement tricks and gdb with python inputs.

Explore how Linux heap protections complicate heap overflows, why simple buffer overflows rarely succeed, and how memory allocator internals, such as malloc, free, and heap chunks, influence exploit opportunities.

Examine Linux kernel vulnerabilities and how system calls work in 64-bit Linux assembly, executing in kernel mode. Build and run a hello world program that uses a system call.

Explore Linux kernel mode system calls, comparing 64-bit and 32-bit Linux, including interrupt 0x80, and learn 32-bit shellcode assembly and kernel-mode exploit constraints.

Explore the ARM platform, its reduced instruction set architecture, ARM7 and ARM6 chips, and how Android apps run on the Dalvik VM with potential C-level vulnerabilities.

Learn to analyze android applications built on arm by installing android studio, loading an apk, and debugging on an emulator while inspecting the manifest and resources.

Explore web vulnerabilities, including SQL injection, cross-site scripting, API flaws, and misconfigured servers, and learn how scanners like nikto, Veiga, and others help detect and prevent them.

Investigate database vulnerabilities in web apps, including sql injection, misconfigurations, and weak passwords and privileges. Use sequel map and nikto to identify issues and Veiga for high-priority findings.

Explore going from vulnerable to exploited by outlining exploitation goals, including reliability across Windows versions, broad applicability, and integration with other tools, demonstrated with a simple exploit script and shell.

Learn to build a simple Python exploit script that crafts a payload with a nop sled and shellcode, then uses a socket to target a vulnerable server.

Learn to convert a script-based exploit into a Metasploit module using Mona in Immunity, generating a Ruby skeleton with TCAP payloads and customizable targets.

Learn to build a Metasploit module for a Windows exploit from a Python script. Configure host and port, 2006-byte padding, 16 nops, and a payload using a little-endian return address.

Learn how to create and load a Metasploit module for a vuln server exploit, configure remote host and payloads, and establish a reverse bind session for post-exploitation actions.

Learn to build a 32-bit Linux hello world in assembly, use write and exit syscalls, assemble with NASM, and generate a shellcode string; the video also notes 64-bit differences.

Rewrite shellcode to remove nulls and absolute addresses, zeroing registers with xor and using short jumps with call and pop to derive the message address for a Linux payload.

Build and analyze 64-bit Linux shellcode, compare with 32-bit Linux and Windows approaches, adjust system call numbers, handle function addresses, and verify with disassembly using Intel syntax.

Learn how to encode shellcode using msf encode encoders, including Shikata Goodnight and metamorphic block-based options, to bypass intrusion detection systems and prepare encoded payloads.

Explore encoding shellcode workflows, from raw binaries to C files, and learn how polymorphic encoding and tools like Shikata gun shy shape shellcode size and output.

Exploit web services with weak credentials on a Tomcat server, using a multi-exploit approach to deploy a Java interpreter bind payload and gain a Linux shell.