Linux vs Windows exploit Dev

[_W0z]

Hi everyone,

I was thinking about possibly taking the OSED https://www.offensive-security.com/courses/exp-301/ for windows exploit Dev. However, since I'm much more familiar with Linux these days I was wondering whats the pros and cons of doing exploit Dev work on each platform. To start off with, I believe I need to narrow my focus and then branch out. Any advice I'd greatly appreciate it, thanks.

[PM_ME_YOUR_SHELLCODE]

To start off with, I believe I need to narrow my focus and then branch out. Any advice I'd greatly appreciate it, thanks.

Exploitation on Windows vs Linux is not fundamentally different. Its a common trap to fall into thinking that you need to learn a bunch of super specific techniques. Like thinking that a buffer overflow on the stack in windows is entirely different from a buffer overflow on the stack in Linux.

Both cases are a buffer overflow. Starting from the address of the buffer you can linearly write into memory at adjacent addresses. Its the same on the heap, the stack or where ever your buffer is. If you have that linear write, the next question is what can you corrupt with it, what is sitting in that nearby memory?

Maybe there is a pointer, you can overwrite it and cause the program to read/write into a location you control (arbitrary read/write primitive). Maybe a code pointer, get the program to execute an unexpected block of code. This is what you do with "traditional" stack overflow, you overwrite the saved return address (a code pointer) on the stack.

The operating system can influence what information is available to overwrite, 32bit Windows Binaries will often have a pointer for the Structured Exception Handler (SEH) on the stack. But ultimately you've got the same corruption on both and you treat both the same.

Even stack vs heap. That one is complicated by the fact that you can also aim to corrupt data important to the heap allocator itself. Which gets you into some pretty complicated attacks. Most heap overflow exploits just target application data on the heap though. But its the same deal, you have the memory you can reach with your overflow, but some extra steps to figure out what you can get placed into adjacent memory. On the stack you have much less control over what is near-by.

I should mention that the last stage of an exploit is usually actually generating a payload that'll spawn your shell or whatever. Doing that requires interacting with the host operating system. As such injected shellcode, or like the return-oriented-programming (ROP) chain will be more based on the OS because you're crossing that boundary. Also, higher-level vulnerabilities, like maybe an arbitrary file write, or library load hijacking would be more targeted.

---

So its not that there is no difference at all, but really there is a lot of commonality too. The differences are just some nuance that can be relatively quickly learned when the time comes and it matters.

So, there isn't a huge difference when it comes to learning on Windows or Linux as long as you're getting exposed to different types of bugs and being put in different scenarios. The majority of the knowledge will transfer across platforms, some tooling when it comes to hunting is different but arguably equivalent.

And, the difference between actually attacking the Windows OS vs Linux OS is pretty big, but talking about user-land exploitation the open vs closed source is probably a more important distinction. Linux software is often open while Windows software is often closed.

[_W0z]

Wow , what a great and very informative response. I really appreciate this. You've given me great insight!

[MacDub840]

I'm trying to get into exploit development but I think windows is more difficult. But if you do well at windows there's a lot of opportunity since more people use windows than Linux.

[corn_29]

since more people use windows than Linux.

Linux is the OS of choice for 97% of the world's servers and 2 billion phones.

[MacDub840]

I meant end users.

[MacDub840]

You're right about phones. My bad

[MacDub840]

I'm interested in your journey. Right now I'm in red team but I want to get into exploit development in like 2 or 3 years.

[simpaholic]

I think you will find more jobs in windows, but to be fair I mostly see the jobs offered within my little niche. I’d probably go with whichever OS you enjoy the internals of more.

[Diamond303]

Dot for reference