All right.
So welcome to Introduction to Exploit and Zero Day Discovery and Development.
My name is Chang Tan and I am a two time National Cyber League winner since fall 2021.
And I'm currently a MOS Institute, Massey Institute student.
I'm actually taking the McDs, so I'm studying on how to basically escape malware that's commonly found
in the wild, using some very advanced techniques using Ida and JIRA.
So I added new content, as is now the summer 2022 release or the remastering, and there's a lot of
things that have changed.
So I did add 64 bit binary exploitation for Linux.
I am teaching manual rock chaining using red tulip.
See, I can teach you how to bypass a stack canary which is known as GC stack guard.
I can also bypass non executable, which is the Linux version of data execution prevention.
And we also are going to bypass address base layout randomization and we have a few things.
I didn't actually make a video for this, but I do have the write ups where customers show coding for
both 32 bit and 64 bit binaries.
And we are now going to be switching from GDB Petya to GDB Jef because GDB Jef is now still supported
in 2022 and we're going to show you the Power Tools Framework.
So here's a demonstration of one of our SLR bypass sections.
We are actually writing the letters of SW and H to spell out Shell within the data section.
And from now on we have for the Linux exploits flags.
So those are like your pop quizzes that I want you to answer once you get root access within the containers.
This is another example of very simplified version of a space layout randomization bypass called the
Return to Procedure Linkage Table.
The Return to Procedure Linkage Table is an attack that's used to bypass ASLA by modifying the global
offset tables entries.
So the reason why I decided to remaster the course is that as of 2022, by default, the new compiler
collection and as well as C++, they enable these protections by default.
So the odds of you finding like an unprotected shared object file, which is like the Linux version
of a dynamic link library without added space layout, randomization enabled is very rare.
And also, while Windows does support backwards compatibility for a 32 bit shell code because you have
a special directory in windows called while 64 Linux requires a custom toolchain to be able to run 32
bit assembly.
I am going to be teaching both Python two and three, so I am leaving my old modules that I left in
2019, 2020 in the class to show you Python two.
And the reason why is because a lot of public exploits actually still use Python two, but the new content
is written in Python three whenever possible.
Always.
Right.
And explain Python three because you still have support from the libraries.
Meanwhile, Pi Pi for Python two, a lot of the required libraries are often require workaround hacks.
Let me know if there's actually an issue with any of the methods I was using in the python two sections.
As far as I know they still work.
So after remastering the course for summer 2022, I'm going to remaster again after December 20, 22,
after I finished my fall college classes.
I am trying to get my students ready for exploit 301, exploit 4016 660 and six 7760.
So basically this class covers the introductory levels of user mode exploit development.
That means we're not doing anything like on the kernel side, which is a very, very arcane subject.
I am trying to research jump chaining, not rope chaining but job chaining or jump oriented programming
which can bypass all stack mitigations except for control flow guard.
But by the time you complete this class, you should be able to have your be on a running start for
the mentioned classes.
Now normally these classes like Exploit 401 and SAS Institute six, some 60 without like some sort of
corporate discount or four sands.
They have like a, like a work study program.
They range between 5 to 9000 and up and they're actually taught only in person.
So hopefully, you know, what I teach you in my course will let you basically get yourself ready for
that.
There's a lot of options and be able to get a discount for these higher level classes.
And I would say a lot of jobs, they actually pay for these classes for you as well as student work
study programs where you volunteer for Sands, working at their booths, being their proctors for their
exams, that kind of stuff.
So the requirements of my class is at this point all of the Linux challenges and exploitable binaries
are to load into Docker containers, and we're now using platform emulation to be able to run the binaries
so you can use any penetration testing distribution as a Linux virtual machine.
So there is a few old videos I put up how to install it on VMware and on for Windows and on kernel based
virtual machine for Linux.
So it's up to you.
But the Linux challenges are now taken care of by me compartmentalizing or containerized using them
in Docker.
Now you do need a Windows virtual machine, Windows XP, Vista or 732 bit, but if you are running like
a newer version of Windows, you can right click on the binary and then run it in compatibility mode,
which will allow you to run it as a 32 bit process.
Also, this class is English only, so good luck.
Have fun learning.
Don't forget to ask me some questions.
I am trying to figure out how to containerized windows instances.
There is some workaround hacks but they're not really feasible.
But once we can containerized windows instances I might be able to make.
This class more portable for Windows exploitation.