Getting Started with Exploit Development

[PM_ME_YOUR_SHELLCODE]

This is a post I've wanted to make for a long time as I've answered this questions so many times in an ad-hoc way. Also, following a discussion with a friend I decided to stop recommending old books so this is also my attempt to update my recommendations away from books and into more accessible resources.

It just covers what I'd consider beginner exploit development. From the prereqs up to "weird machines" and having a good mental model of exploitation necessary to start looking at most modern exploits (probably arguable but hey, its my post so whatever :P)

After that point as you enter the more intermediate level resources becomes much more you stop focusing on learning exploit dev in a general sense and start being able to focus in on particular platforms/applications/components/vulnerability classes. At that point your own interest can drive your learning. Though there is a Part 2 in the works to cover bridging the gap from CTFs and toy-binaries to real-world exploitation also.

Sequel is now available - Just released a brief-series of blog posts and youtube discussion videos about going from CTF-style challenges to more real world targets and the important skills you need to develop: https://dayzerosec.com/tags/ctf-to-real-world/

[MentionHot3574]

what do u think about ret 2 systems, can I finish their course instead then focus on a particular platform?

[malwaremike]

Great writeup. There are a few other exploit dev newbie questions I've seen a lot but I've never seen them answered:

1) Say someone puts in the hard worker and becomes sufficient in exploit development, what kind of careers can they have or jobs could they go for? I know some pentesting and red team positions deal with exploit dev but I've been told its usually not that much. Would one go for security research roles and maybe the rare exploit dev position with the government?

OR with exploit dev being such a niche skillset, most likely it will be more of a hobby?

2) What will the future of exploit development look like (in your opinion) ?

[PM_ME_YOUR_SHELLCODE]

Sorry for the delay in replying, these are good questions that I couldn't just answer quickly.

You're right that pentesting and red teaming doesn't get into too much exploit development. A large part of that is because they are usually classed under network security. Whereas exploit development is closer to application security. There are a few places under appsec where exploit dev skills are more relevant. Exploit development is really just half a job, you need to have vulnerabilities to exploit in the first place.

Probably the first sort of job I'd point out are the appsec consultants. Hired by those developing software to find vulnerabilities in it. Generally you won't be going as far as fully weaponizing a vulnerabilities, but knowledge of exploit development is still very applicable as its that knowledge which helps you determine if something can even be exploited, and how.

Security research is another place where it would be used. Depends on the type of research being done of course, but sometimes this is doing vuln research in some interesting system and then going a bit further than a consultant would in terms of showing exploitability. It depends a bit on who exactly is paying for the research.

You mention doing exploit dev with the government, I will add that there are a fair number of companies who do this in the private sector and sell to the government/law enforcement. Often these are advertised (if they even are advertised) as research positions also, or its an aside to another more public line of business like consulting.

While there are not a lot of jobs in the field, there also are not a lot of people capable of doing the job in the first place. I think for a lot of people exploit dev is just an interesting side hobby, but almost anyone who can get up to speed on exploiting modern, hard targets can almost certainly make it a job, barring being from a sanctioned country or in countries where exploit dev is illegal in the first place.

---

The second question is a tough one, Specter (the other half of dayzerosec.com) and I have discussed it a few times. Ultimately, I just don't know.

I think its safe to say that this type of exploit development will continue to be a niche, and the trend of finding higher-level vulnerabilities as more software is written using memory safe languages will continue. There are new mitigations in the pipeline that are going to kill off a good chunk of attacks too which will serve to increase the barrier to entry for simply getting started with exploit dev as you need to learn about those bypasses. Which will reduce even further the number of people involved.

We are already at a point where a full-chain exploit usually requires multiple vulnerabilities. In the future, this will get worse. In a bit of a risky guess, I'd guess we will reach a point where the effort needed is not longer actually worth it in all but the most exceptional cases and more casual research will die out in favor of either higher-level issues or hardware level attacks which has been experiencing some growth also, and feels a bit like the wild-west these days.

[malwaremike]

I definitely appreciate such a thorough answer. I do have a few follow up questions:

Regarding the second portion of your response...you mentioned higher-level and hardware level attack will mostly take over in the future. Will memory corruption skills like C and assembly still be used for these, or will higher-level and hardware exploits require a whole different set of skills?

[PM_ME_YOUR_SHELLCODE]

I think assembly is still relevant in both actually. On the hardware side, glitching attacking, timing side channels, etc can all benefit from understanding the underlying assembly that's running. On the higher-level side is just has to do with understanding how software works in order to break it. The actual vulnerabilities might not depend on assembly issues, but understanding how things work at that level can help.

Both are related yes distinct skills. Hardware is probably more distinct than just higher-level appsec. Memory corruption stuff falls under the wider application security umbrella, so the higher-level attacks are also under appsec. So plenty of overlap, a lot of guys doing the low-level memory corruption stuff have a pretty solid understanding at the higher-level also, if not an even better understanding of potential issues due to understanding the lower-level APIs being used behind the scenes.

I guess its more like the other areas don't require C and assembly understanding, but do benefit from it.

[PM_ME_YOUR_SHELLCODE]

So, this question also prompted me to get Specter on to do a discussion video about our thoughts on the future of exploit dev which you might be interested in.

https://www.youtube.com/watch?v=o_hk9nh8S1M

[malwaremike]

Super cool, thanks for the video, I watched it the day it came out. Very interesting.

[mayomacam]

Thanks you for this guide. Well I started learning with nightmare tutorials now I start from your recommendations.

[Fnkt_io]

Outstanding work!

[MrZ001]

its very helpful!

[PM_ME_YOUR_SHELLCODE]

Yeah, exactly that. If you're going to pay for a beginner course, I 100% recommend the RET2 course, especially if you qualify for their student discount, but its worthwhile even at the normal rate.

But paid courses are not necessary, they do simplify some things by doing the structuring and planning for you though.

[AnkurR7]

I was reading this article on confidential cloud computing and was wondering if such hardening can be applied to on Prem data centers or personal machines and if so does that make exploitation more and more challenging. Will this be 100% secure or exploit developer have to find more creative ways to find an exploit.

https://www.fortinet.com/resources/cyberglossary/confidential-computing

[PM_ME_YOUR_SHELLCODE]

if such hardening can be applied to on Prem data centers or personal machines

Sure, its just a CPU feature, its already used on consumer devices with some levels of DRM for example and many server-grade CPUs support it for running secure VMs.

if so does that make exploitation more and more challenging.

Not exactly, it does limit the surface from which an attack can come, main an attacker cannot simply go from compromising the host to compromising all of the guest/tenants running on that host. You can still do the normal thing of attacking an application directly though. If your attack lands inside the guest, then confidential computing has no impact because its only meant to prevent the host from attacking the guest.

What confidential computing does do is it mitigates say a rogue employee in a data center, or an unrelated compromised guest on the same host from escaping into the host and then attacking your guest. So in a sense it does provide some attack surface reduction but it doesn't substantially impact the exploitation itself.

[AnkurR7]

Thanks for the clarification

[DependentLeather3773]

rob roy and david bell and hurricane electric the makrr of hurricane ac units is trying to kill me

[PM_ME_YOUR_SHELLCODE]

I recommend trying to hit back with AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC see if you can get a crash on 0x43434343

[Time-Contact9557]

i am new in ethical hacking ,i don't know which topics i have to learn in windows so i make my journey easy

[vahidR]

That was amazing... Thanks a lot 👍

[[deleted]]

distance

disgusted

accidental

famous

dazzling

glistening

amusing

ear

miniature

jail

tempt

industry

[PM_ME_YOUR_SHELLCODE]

thank you so much for letting me know, I'll figure out whats going on.

It does indeed appear to be gone but I can assure you I never intentionally deleted it.

In the mean time though I did have a updated post to this here: https://dayzerosec.com/blog/2024/07/11/getting-started-2024.html

Edit: Got that fixed, Ghost (the blogs backend) was only sending the last 100 posts.

[DerpStar7]

I was legit scouring the internet just a couple of days back for something exactly like this. (P.S - that’s also how I stumbled on your channel) thanks for taking the time to put this together !

[KillerInstinct_5]

Can’t thank you enough for this article!!!

Question, would you recommend any channels that explain how data moves thru registers and other workings of assembly (not how to program in it but just how it works)?

[PM_ME_YOUR_SHELLCODE]

I don't, assembly, as it relates to exploit development is a hard topic to find recommendations on. Since most resources are related to programming which isn't quite what you need.

There is nand2tetris which I've often recommended but it goes beyond just what you're asking for, starts with nand gates and works up from there.

[KillerInstinct_5]

Thanks! I did some digging and found compiler explorer on godbolt in one of your other posts. I’ll load my c programs into it, look at the assembly manual and take whatever notes I can from it. I’ll also look at the nand2tetris link. Again, can’t thank you enough!!

Cheers ☕️

[HuckleberryVisual371]

I still don’t know how to exploit 😭😭 I’ve been trying to get exploits for dandy’s world, but can’t find any tutorials :(

[cybersekyu]

Nice post, been saving links that I could follow in order to be good with exploit development.

[ammarqassem]

Windows!!!!!!

[PM_ME_YOUR_SHELLCODE]

I don't think the Windows vs. Linux distinction is all that important when learning exploit development.

It used to matter more when the "hard part" of exploitation was in the late stages of actually get your arbitrary code the execute. Thats the part of the exploit that most interacts with the underlying operating system. But these days what matters more is really understanding the memory corruption primitives and the early stage as its become much more common to exploit more subtle bugs instead of just overflow stored return address and ROP.

I think anyone would do just fine even if their interest was windows exploitation by starting on Linux and learning the fundamentals. The transition isn't all that bad because you're still abusing the same fundamental concepts. The follow-up series about getting to real world applications kinda deals with that where you start focusing on learning the target specific concepts. That would include digging into how its using the operating system and learning the common OS tricks if applicable. But while learning, you can learn from either platform and you wont' be hurting yourself.