SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking

SEC660: Advanced Penetration Testing, Exploit Writing, and Ethical Hacking is designed as a logical progression point for those who have completed SEC560: Network Penetration Testing and Ethical Hacking, or for those with existing penetration testing experience. Students with the prerequisite knowledge to take this course will walk through dozens of real-world attacks used by the most seasoned penetration testers. The methodology of a given attack is discussed, followed by exercises in a hands-on lab to consolidate advanced concepts and facilitate the immediate application of techniques in the workplace. Each day of the course includes a two-hour evening boot camp to drive home additional mastery of the techniques discussed. A sample of topics covered includes weaponizing Python for penetration testers, attacks against network access control (NAC) and virtual local area network (VLAN) manipulation, network device exploitation, breaking out of Linux and Windows restricted environments, IPv6, Linux privilege escalation and exploit-writing, testing cryptographic implementations, fuzzing, defeating modern OS controls such as address space layout randomization (ASLR) and data execution prevention (DEP), return-oriented programming (ROP), Windows exploit-writing, and much more!

Attackers are becoming more clever and their attacks more complex. To keep up with the latest attack methods, you need a strong desire to learn, the support of others, and the opportunity to practice and build experience. This course provides attendees with in-depth knowledge of the most prominent and powerful attack vectors and furnishes an environment to perform these attacks in numerous hands-on scenarios. The course goes far beyond simple scanning for low-hanging fruit and shows penetration testers how to model the abilities of an advanced attacker to find significant flaws in a target environment and demonstrate the business risk associated with these flaws.

SEC660 starts off by introducing advanced penetration concepts and providing an overview to prepare students for what lies ahead. The focus of day one is on network attacks, an area often left untouched by testers. Topics include accessing, manipulating, and exploiting the network. Attacks are performed against NAC, VLANs, OSPF, 802.1X, CDP, IPv6, VOIP, SSL, ARP, SNMP, and others. Day two starts with a technical module on performing penetration testing against various cryptographic implementations, then turns to PowerShell and post exploitation, escaping Linux restricted environments and Windows restricted desktop environments. Day three jumps into an introduction of Python for penetration testing, Scapy for packet crafting, product security testing, network and application fuzzing, and code coverage techniques. Days four and five are spent exploiting programs on the Linux and Windows operating systems. You will learn to identify privileged programs, redirect the execution of code, reverse-engineer programs to locate vulnerable code, obtain code execution for administrative shell access, and defeat modern operating system controls such as ASLR, canaries, and DEP using ROP and other techniques. Local and remote exploits as well as client-side exploitation techniques are covered. The final course day is devoted to numerous penetration testing challenges that require students to solve complex problems and capture flags.

Among the biggest benefits of SEC660 is the expert-level hands-on guidance provided through the labs and the additional time allotted each evening to reinforce daytime material and master the exercises.

SEC660.1: Network Attacks for Penetration Testers

Overview

Day one serves as an advanced network attack module, building on knowledge gained from SEC560: Network Penetration Testing and Ethical Hacking. The focus will be on obtaining access to the network; manipulating the network to gain an attack position for eavesdropping and attacks, and for exploiting network devices; leveraging weaknesses in network infrastructure; and taking advantage of client frailty.

CPE/CMU Credits: 8

Topics

◈ Bypassing network access/admission control (NAC)
◈ Impersonating devices with admission control policy exceptions
◈ Exploiting EAP-MD5 authentication
◈ Custom network protocol manipulation with Ettercap and custom filters
◈ Multiple techniques for gaining man-in-the-middle network access
◈ IPv6 for penetration testers
◈ Exploiting OSPF authentication to inject malicious routing updates
◈ Using Evilgrade to attack software updates
◈ Overcoming SSL transport encryption security with Sslstrip
◈ Remote Cisco router configuration file retrieval

SEC660.2: Crypto and Post Exploitation

Overview

Day two starts by taking a tactical look at techniques that penetration testers can use to investigate and exploit common cryptography mistakes. We begin by building some fundamental knowledge on how ciphers operate, without getting bogged down in complex mathematics. Then we move on to techniques for identifying, assessing, and attacking real-world crypto implementations. We finish the module with lab exercises that allow students to practice their newfound crypto attack skill set against reproduced real-world application vulnerabilities.

The day continues with advanced techniques but focuses more on post exploitation tasks. We leverage an initial foothold to further exploit the rest of the network. We abuse allowed features to escape restricted environments. First we will build up knowledge of local restrictions on hosts. Once we establish a set of possible restrictions, we leverage that knowledge to circumvent them. We will cover the core components that restrict the desktop and a variety of escape possibilities. The Windows escape exercise is a perfect, real-world demonstration of the risks of relying on obfuscation and blacklisting to thwart attacks.

As a major factor in post exploitation, we cover both exploiting administrators use of PowerShell and PowerShell attack tools. We'll use Metasploit alternatives like PowerShell Empire to escalate privileges, pivot, and deliver additional payloads. The day ends with a challenging boot camp exercise against a full network environment comprised of a variety of modern, representative, and fully patched systems with no obvious remote vulnerabilities.

CPE/CMU Credits: 8

Topics

◈ Pen testing cryptographic implementations
◈ Exploiting CBC bit flipping vulnerabilities
◈ Exploiting hash length extension vulnerabilities
◈ PowerShell Essentials
◈ Enterprise PowerShell
◈ Post Exploitation with PowerShell and Metasploit
◈ Escaping Software Restrictions
◈ Two-hour evening Capture the Flag exercise against a modern network with hardened servers, desktops, and vApp targets

SEC660.3: Python, Scapy, and Fuzzing

Overview

Day three brings together the multiple skill sets needed for creative analysis in penetration testing. We start by discussing product security testing. The day continues with a focus on how to leverage Python as a penetration tester - the aim is to help students unfamiliar with Python start modifying scripts to add their own functionality, while also helping seasoned Python scripters improve their skills. Once we leverage the Python skills in creative lab exercises, we move on to leveraging Scapy for custom network targeting and protocol manipulation. Using Scapy, we examine techniques for transmitting and receiving network traffic beyond what canned tools can accomplish, including IPv6. Next, we take a look at network protocol and file format fuzzing. We leverage fuzzing to target both common network protocols and popular file formats for bug discovery. We use hands-on exercises to develop custom protocol fuzzing grammars to discover bugs in popular software. Finally, we carefully discuss the concept of code coverage and how it goes hand-in-hand with fuzzing. We will conduct a lab using the Paimei Reverse Engineering Framework and IDA Pro to demonstrate the techniques discussed.

CPE/CMU Credits: 8

Topics

◈ Becoming familiar with Python types
◈ Leveraging Python modules for real-world pen tester tasks
◈ Manipulating stateful protocols with Scapy
◈ Using Scapy to create a custom wireless data leakage tool
◈ Product security testing
◈ Using Taof for quick protocol mutation fuzzing
◈ Optimizing your fuzzing time with smart target selection
◈ Automating target monitoring while fuzzing with Sulley
◈ Leveraging Microsoft Word macros for fuzzing .docx files
◈ Block-based code coverage techniques using Paimei

SEC660.4: Exploiting Linux for Penetration Testers

Overview

Day four begins by walking through memory from an exploitation perspective as well as introducing x86 assembler and linking and loading. These topics are important for anyone performing penetration testing at an advanced level. Processor registers are directly manipulated by testers and must be intimately understood. Disassembly is a critical piece of testing and will be used throughout the remainder of the course. We will take a look at the Linux OS from an exploitation perspective and discuss privilege escalation. We continue by describing how to look for SUID programs and other likely points of vulnerabilities and misconfigurations. The material will focus on techniques that are critical to performing penetration testing on Linux applications.

We then go heavily into stack overflows on Linux to gain privilege escalation and code execution. We will first cover using a debugger to expose weak passwords. Then we will go over redirection of program execution and, finally, code execution. Techniques such as return to buffer and return to C library (ret2libc) will be covered, as well as an introduction to return-oriented programming. The remainder of the day takes students through techniques used to defeat or bypass OS protections such as stack canaries and address space layout randomization (ASLR). The goal of this section is to expose students to common obstacles on modern Linux-based systems.

CPE/CMU Credits: 8

Topics

◈ Stack and dynamic memory management and allocation on the Linux OS
◈ Disassembling a binary and analyzing x86 assembly code
◈ Performing symbol resolution on the Linux OS
◈ Identifying vulnerable programs
◈ Code execution redirection and memory leaks
◈ Identifying and analyzing stack-based overflows on the Linux OS
◈ Performing return-to-libc (ret2libc) attacks on the stack
◈ Return-oriented programming
◈ Defeating stack protection on the Linux OS
◈ Defeating ASLR on the Linux OS

SEC660.5: Exploiting Windows for Penetration Testers

Overview

Day five starts off covering the OS security features (ASLR, DEP, etc.) added to the Windows OS over the years as well as Windows-specific constructs, such as the process environment block (PEB), structured exception handling (SEH), thread information block (TIB), and the Windows application programming interfaces (API). Differences between Linux and Windows will be covered. These topics are critical in assessing Windows-based applications. We then focus on stack-based attacks against programs running on the Windows OS. After finding a vulnerability in an application, the student will work with Immunity Debugger to turn the bug into an opportunity for code execution and privilege escalation. Advanced stack-based techniques such as disabling data execution prevention (DEP) are covered. Client-side exploitation will be introduced, as it is a highly common area of attack. We continue with the topic of return-oriented programming (ROP), demonstrating the technique against a vulnerable application, while looking at defeating hardware DEP and address space layout randomization (ASLR) on Windows 7, Windows 8, and Windows 10. We then have a module on porting over an exploit into the Metasploit Framework and on how to quickly identify bad characters in your shellcode and as input into a program. Finally, we will take a quick look at shellcode and the differences between shellcode on Linux and Windows, followed by a ROP challenge.

CPE/CMU Credits: 8

Topics

◈ The state of Windows OS protections on Windows 7, 8, 10, Server 2008 and 2012
◈ Understanding common Windows constructs
◈ Stack exploitation on Windows
◈ Defeating OS protections added to Windows
◈ Creating a Metasploit module
◈ Advanced stack-smashing on Windows
◈ Using ROP
◈ Building ROP chains to defeat DEP and bypass ASLR
◈ Windows 7 and Windows 8 exploitation
◈ Porting Metasploit modules
◈ Client-side exploitation
◈ Windows Shellcode

SEC660.6: Capture the Flag Challenge

Overview

This day will serve as a real-world challenge for students by requiring them to utilize skills they have learned throughout the course, think outside the box, and solve a range of problems from simple to complex. A web server scoring system and Capture the Flag engine will be provided to score students as they capture flags. More difficult challenges will be worth more points. In this offensive exercise, challenges range from local privilege escalation to remote exploitation on both Linux and Windows systems, as well as networking attacks and other challenges related to the course material.

CPE/CMU Credits: 6