OSED case studies
OSED · Put your knowledge to work in context.
The OffSec Exploit Developer (OSED) certification validates advanced Windows user-mode exploit development skills. It is aimed at penetration testers, security researchers, reverse engineers, and red team operators who already have a solid foundation in programming and basic exploitation concepts and want to master crafting custom exploits. The associated EXP-301 course covers reverse engineering binaries to locate vulnerabilities, stack buffer overflow exploitation, writing custom shellcode, bypassing Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), and exploiting format string vulnerabilities to develop a read primitive. The exam is a 48-hour proctored hands-on assessment delivered in a private VPN, consisting of 3 independent exploit tasks. The OSED case studies are 5 cases and about 3,303 words.
1Signed Length Check in a UDP Parser
While assessing a 32-bit Windows service, svcparse.exe , you reverse the packet handler at 0x00401200 . The service reads a 16-bit length field at offset 0x10 of each UDP packet and copies the remainder into a 0x200-byte stack buffer using memcpy .
663 words, about 3 min2Null-Byte-Constrained Overflow in an FTP Command
A 32-bit Windows FTP server, ftpd.exe , copies the argument of the USER command into a 128-byte stack buffer with strcpy . The command is read with recv into a 1024-byte buffer, so you can send long strings, but strcpy stops at the first null byte.
605 words, about 3 min3Position-Independent Download-and-Execute Shellcode
You are developing 32-bit Windows shellcode that downloads http://10.0.0.5/payload.exe and executes it. The shellcode will be injected via a stack overflow and executed after a ROP chain calls VirtualProtect on the stack.
601 words, about 3 min4Combining a Format String Leak with a Stack Overflow
A 32-bit Windows service, logsvc.exe , has two vulnerabilities. First, a logging function calls fprintf(logfile, user input) ; user input is a 256-byte buffer received over TCP.
721 words, about 4 min5Building an Arbitrary Read Primitive from a Format String
A 32-bit Windows service has a format string bug in a response builder: sprintf(response, user input) followed by send(client, response, strlen(response), 0) . user input is a 128-byte buffer read from the client and is null-terminated.
713 words, about 4 min