Windows Vulnerability Research & Fuzzing

Training overview:

Learn state-of-the-art Vulnerability Research techniques for Windows targets. Designed for beginners and those experienced, we cover introductory content for the inexperienced and lead into advanced techniques and concepts like full-system snapshot fuzzing and Kernel reverse engineering with live 0-day demonstrations.

Training Agenda:

Day one (theory and initial/basic exercises):

• • What is Vulnerability Research? Fuzzing vs manual approaches
  • Basic target fuzzing with WinAFL
  • What is code coverage? Viewing coverage with Ghidra
  • Fuzzing techniques (grammar generators, mutators like cmplog, snapshot fuzzing overview)

Day two (fuzzing a real target from scratch):

• • Choosing a target (windows event viewer .evt/.evtx file parser)
  • Locating the target code (parser code is in internal functions, not exported or callable directly)
  • Harness development (Loading the target code into our own process space, getting a private function pointers to the target code, initializing global and state, calling into the target parser functions with our own inputs and cleaning up afterwards)

Day three (snapshot fuzzing & Logic Bugs)

• • Turn our fuzzer from Day two into a full-system snapshot fuzzer using what-the-fuzz
    • After that, use kAFL to demonstrate the difference (kAFL emulates devices while what-the-fuzz does not)
  • Finding a logic 0-day in Trend Micro and Chef Workstation
    • Trend Micro logic issue is in a driver, cover reverse engineering and initial PoC development
    • Chef Workstation is a filesystem related issue, cover using Process Monitor and other Sysinternals tools for identifying the issue, develop PoC for privesc exploitation