OSEE case studies

OSEE · Put your knowledge to work in context.

The OSEE (Offensive Security Exploitation Expert) is a certification name associated with OffSec, the company behind the Kali Linux distribution and a family of hands-on penetration testing certifications. Candidates typically encounter it as an advanced, exploitation-focused credential aimed at security professionals who already write exploits and want to demonstrate depth in memory corruption, bypassing modern mitigations, and reliable payload development against hardened targets. The OSEE case studies are 5 cases and about 4,783 words.

Stack overflow with a 60-byte post-EIP budget

acmeprintsvc.exe is a 32-bit Windows Server 2008 R2 service you are assessing. A command handler memcpy's the data portion of a framed request into a 256-byte stack buffer using the 16-bit length from the header.

942 words, about 5 min 2

Use-after-free in a 0x38-byte LFH bucket

A 32-bit Windows 7 SP1 document viewer parses a proprietary .acm format. Each node record causes the parser to malloc 0x38 bytes, copy up to 8 attacker bytes into the name field at offset 0x08, and link the object into a global list.

1,018 words, about 5 min 3

Undersized allocation with a delimiter-terminated copy

A 32-bit Windows service accepts a request consisting of a 2-byte declared-length field, a flags byte, and data, terminated by a 0xFF delimiter. The handler allocates a buffer using the declared length, then, before copying, allocates a 0x100-byte reply context whose callback function pointer sits at offset 0x80 of its user data.

901 words, about 5 min 4

Null-free egg hunter in a 76-byte stager

A 32-bit Windows 7 chat client overflows a 512-byte stack buffer while copying an incoming message body with strcpy, so a 0x00 byte terminates the copy. The offset to the saved return address is 524.

929 words, about 5 min 5

SEH overwrite with SafeSEH and SEHOP both enabled

svcstore.exe is a 32-bit Windows Server 2008 R2 service. A 256-byte stack buffer lives in a function compiled without /GS out of a legacy static library, and that function has a try/ except block.

993 words, about 5 min