AWE/OSEE Preparation
Blog
- https://addaxsoft.com/blog/offensive-security-advanced-windows-exploitation-awe-osee-review/
- http://infosecflash.com/2018/11/04/my-awe-experience/
- https://trickster0.wordpress.com/2018/10/27/awe-course-review-by-offensive-security/
- https://www.jscybersec.io/blogpage/Offensive-Security-Exploitation-Expert-OSEE
Public Reference Materials by Module
Module 0x01 DEP/ASLR Bypass and Sandbox Escape via Flash Heap Overflow
pykd
Fldbg, a Pykd script to debug FlashPlayer
Windbg Tutorial
Windbg Cheat Sheet
Discover Flash Player Zero-day Attacks In The Wild From Big Data by Peter Pi
Exploit writing tutorial part 10 : Chaining DEP with ROP – the Rubik’s Cube
Module 0x02 CFG/ACG Bypass and Sandbox Escape via Microsoft Edge Type Confusion
Morten Schenk - Back to Basics or Bypassing Control Flow Guard with Structured Exception Handler
Disarming and Bypassing EMET 5.1
Module 0x03 64-bit Kernel Driver Exploitation
Morten Schenk - Taking Windows 10 Kernel Exploitation to the next level
- https://www.youtube.com/watch?v=Gu_5kkErQ6Y
- https://www.youtube.com/watch?v=IxEKcB5Bvbg
- https://www.blackhat.com/docs/us-17/wednesday/us-17-Schenk-Taking-Windows-10-Kernel-Exploitation-To-The-Next-Level%E2%80%93Leveraging-Write-What-Where-Vulnerabilities-In-Creators-Update.pdf
- https://www.blackhat.com/docs/us-17/wednesday/us-17-Schenk-Taking-Windows-10-Kernel-Exploitation-To-The-Next-Level%E2%80%93Leveraging-Write-What-Where-Vulnerabilities-In-Creators-Update-wp.pdf
Morten Schenk - Windows Kernel Shellcode on Windows 10
- https://improsec.com/tech-blog/windows-kernel-shellcode-on-windows-10-part-1
- https://improsec.com/tech-blog/windows-kernel-shellcode-on-windows-10-part-2
- https://improsec.com/tech-blog/windows-kernel-shellcode-on-windows-10-part-3
- https://improsec.com/tech-blog/windows-kernel-shellcode-on-windows-10-part-4-there-is-no-code
Extra Mile - Exploit
Avast! 4.7 - 'aavmker4.sys' Local Privilege Escalation
- AWE v2.0 Module 0x5
- https://www.exploit-db.com/exploits/12406/
Microsoft Windows XP/2003 - 'afd.sys' Local Privilege Escalation (MS11-080)
- https://www.offensive-security.com/vulndev/ms11-080-voyage-into-ring-zero/
- https://www.exploit-db.com/exploits/18176/
Microsoft Windows 8.0/8.1 (x64) - 'TrackPopupMenu' Local Privilege Escalation (MS14-058)
- https://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-a-windows-kernel-mode-vulnerability-cve-2014-4113/
- https://dl.packetstormsecurity.net/papers/attack/CVE-2014-4113.pdf
- https://www.exploit-db.com/exploits/37064/