Windows Advanced Memory Corruption Attack and Defense Teaching Modules

Lab Environment

Windows

• All labs work on Windows 10/11.
• Minimum requirement. If our Windows VM is used, all the tools are already installed.
  • Vunerable Chat (VChat) Server: VChat.exe, Essfun.dll. VChat_GUI.exe can start VChat.exe as a background process although not really needed. On our Windows VM,
    • C:\Tools\vchat\VChat.exe
    • If VChat.exe is accidentally removed, copy from C:\Tools\vchat\Backup
  • Immunity Debugger
    • It prompts to install Python 2.7
    • mona.py shall be installed too
• Default Windows configuratiions
  • Disable all Windows Firewall by default
  • Disable all Exploit Protection features by default

Kali

Our Customized Kali VM is installed with tools Kali does not ship by default and also our own tools.

• boffuzz
• Customized Armitage
• Vunerable Chat (VChat) client: /home/kali/GenCyber/vchat/Client/client.py

Defense modules

1. Control Flow Guard (CFG)
2. Address Space Layout Randomization (ASLR)
3. Data Execution Protection (DEP)
4. Structured Exception Handling (SEH) Defenses
5. Security Cookies/Buffer Security Checks
6. Validate Heap Integrity

Attack modules

1. VChat TRUN - Basic Buffer Overflow
2. VChat GTER - Egg Hunters
3. VChat GTER - Code Reuse
4. VChat GMON - Structured Exception Handling (SEH)
5. VCHAT KSTET - Multistage Shellcode (recv)
6. VChat KSTET - Multistage Shellcode (DLL)
7. VChat LTER - Bad Characters
8. VChat TRUN - Introduction to Data Execution Prevention (DEP)
9. VChat TRUN - Understanding ROP
10. VChat TRUN - ROP Attack
11. VChat TRUN - Brute Force: DEP & ASLR Bypass
12. Heap Overflow Examples
13. VChat - Heap Overflows