Joas Antonio的OSED笔记概述：渗透测试与Windows安全技术

需积分: 5 57 浏览量更新于2024-06-20 收藏 19.99MB PDF 举报

本文档"OSED Notes Study Overview by Joas Antonio"主要聚焦于网络安全渗透测试中的关键概念和技术，由LinkedIn的专业人士Joas Antonio dos Santos撰写。内容涵盖了广泛的领域，从基础的实验室实践到高级的逆向工程和漏洞利用技术。首先，文档以深入浅出的方式介绍了X86架构，包括通用寄存器（如eax、ebx、ecx、edx等）和特殊目的寄存器（如eip、flags），这些都是理解程序执行过程的基础。接着，作者探讨了Windows Debugger，一个强大的工具，用于控制程序执行，特别是对于分析内存泄漏和调试栈溢出这类常见的安全漏洞。核心部分涉及到了几种特定的攻击技术： 1. **Stack-Based Buffer Overflow**：讲述如何利用栈溢出漏洞，通过修改堆栈中的数据来执行恶意代码或控制程序流程。 2. **Data Execution Prevention (DEP)** 和 **Address Space Layout Randomization (ASLR)**：是Windows系统防止栈溢出攻击的重要机制，作者解释了如何绕过这些保护措施。 3. **Control Flow Guard (CFG)**：一种旨在阻止非预期代码执行的安全特性，作者详细介绍了如何在实际攻击中应对。 4. **SEH Buffer Overflow Egg Hunter**：着重讲解了一种利用Structured Exception Handling（SEH）的复杂溢出技巧，结合蛋猎者（EggHunters）的概念。 5. **Shellcode**：讨论了壳代码的编码、解码以及在不同环境下的应用，包括编码方法（如Base64编码）和如何规避防护。 6. **ROP（Return-Oriented Programming）和 ROP Chain**：展示了如何利用已存在的函数调用来构造攻击链，实现非原始代码的执行。 7. **Reversing Engineering**：逆向工程技术的应用，包括使用Immunity Debugger和GDB等工具进行二进制文件的分析和调试。整个文档不仅覆盖了基础知识，还深入探讨了高级渗透测试技术，对从事网络安全、逆向工程或漏洞挖掘的专业人员具有很高的实用价值。通过阅读和学习这些笔记，读者可以提升在真实世界环境中对抗和防御此类攻击的能力。

Functions of the "__fastcall" convention pass the first two parameters to a function using

ecx and edx. Additionally, when calling a member function of a class, a pointer to that class

is often passed in ecx no matter what the calling convention is.

Additionally, ecx is often used as a loop counter. for loops generally, although not always,

set the accumulator variable to ecx. rep- instructions also use ecx as a counter,

automatically decrementing it till it reaches 0. This class of function will be discussed in a

later section.

edx

edx is a volatile general-purpose register that is occasionally used as a function parameter.

Like ecx, edx is used for "__fastcall" functions.

Besides fastcall, edx is generally used for storing short-term variables within a function.

esi

esi is a non-volatile general-purpose register that is often used as a pointer. Specifically, for

"rep-" class instructions, which require a source and a destination for data, esi points to the

"source". esi often stores data that is used throughout a function because it doesn't change.

edi

edi is a non-volatile general-purpose register that is often used as a pointer. It is similar to

esi, except that it is generally used as a destination for data.

ebp

ebp is a non-volatile general-purpose register that has two distinct uses depending on

compile settings: it is either the frame pointer or a general purpose register.

If compilation is not optimized, or code is written by hand, ebp keeps track of where the

stack is at the beginning of a function (the stack will be explained in great detail in a later

section). Because the stack changes throughout a function, having ebp set to the original

value allows variables stored on the stack to be referenced easily. This will be explored in

detail when the stack is explained.

If compilation is optimized, ebp is used as a general register for storing any kind of data,

while calculations for the stack pointer are done based on the stack pointer moving (which

gets confusing -- luckily, IDA automatically detects and corrects a moving stack pointer!)

esp

esp is a special register that stores a pointer to the top of the stack (the top is actually at a

lower virtual address than the bottom as the stack grows downwards in memory towards

the heap). Math is rarely done directly on esp, and the value of esp must be the same at

the beginning and the end of each function. esp will be examined in much greater detail in

a later section.

Special Purpose Registers

For special purpose and floating point registers not listed here, have a look at the Wikipedia

Article or other reference sites.

eip

eip, or the instruction pointer, is a special-purpose register which stores a pointer to the

address of the instruction that is currently executing. Making a jump is like adding to or

subtracting from the instruction pointer.

After each instruction, a value equal to the size of the instruction is added to eip, which

means that eip points at the machine code for the next instruction. This simple example

shows the automatic addition to eip at every step:

eip+1 53 push ebx

eip+4 8B 54 24 08 mov edx, [esp+arg_0]

eip+2 31 DB xor ebx, ebx

eip+2 89 D3 mov ebx, edx

eip+3 8D 42 07 lea eax, [edx+7]

.....

flags

In the flags register, each bit has a specific meaning and they are used to store meta-

information about the results of previous operations. For example, whether the last

calculation overflowed the register or whether the operands were equal. Our interest in the

flags register is usually around the cmp and test operations which will commonly set or

unset the zero, carry and overflow flags. These flags will then be tested by a conditional

jump which may be controlling program flow or a loop.

https://wiki.skullsecurity.org/index.php/Registers

Introduction Windows Debugger

There are several debugging programs available on Windows. OllyDbg13 and Immunity

Debugger14 are well-known in the reverse engineering and exploit development world for

their user-friendly interface. Immunity Debugger originally began as a fork of OllyDbg but it has

since surpassed OllyDbg’s functionality. Despite the convenience of these programs, we will

use Microsoft WinDbg15 debugger exclusively in this course. This is because WinDbg provides

the same scripting features available in Immunity Debugger, along with the availability of both

32- and 64-bit versions. While an open source implementation of OllyDbg for 64-bit exists, it

does not provide the same features or support as WinDbg. WinDbg is also our preferred

debugger because it can debug in both user-mode and kernel-mode, which makes it the best

fit for the development of any kind of exploits leveraged on Windows. WinDbg is provided as

part of the Software Development Kit (SDK), the Windows Driver Kit (WDK), and the Debugging

Tools for Windows, free-of-charge.

What is Time Travel Debugging?

Time Travel Debugging, is a tool that allows you to record an execution of your process

running, then replay it later both forwards and backwards. Time Travel Debugging (TTD) can

help you debug issues easier by letting you "rewind" your debugger session, instead of having

to reproduce the issue until you find the bug.

TTD allows you to go back in time to better understand the conditions that lead up to the bug

and replay it multiple times to learn how best to fix the problem.

TTD can have advantages over crash dump files, which often are missing the code execution

that led up to the ultimate failure.

In the event you can't figure out the issue yourself, you can share the trace with a co-worker

and they can look at exactly what you're looking at. This can allow for easier collaboration than

live debugging, as the recorded instructions are the same, where the address locations and

剩余611页未读，继续阅读

网络研究观

粉丝: 1w+
资源: 2711

Joas Antonio的OSED笔记概述：渗透测试与Windows安全技术

"概述网络安全渗透测试漏洞和开发基础知识 - Joas Antonio详解

"OSWE基础笔记与网络安全渗透测试：Joas的分享

"Craco隔膜泵.pdf；领先技术，成熟品质——工业应用的解决方案

Offensive Security Defense Analyst Overview PT.1.pdf

Overview Altiris vs SMS.pdf

hybrisCommerceDeveloperTraining1.01Overview共26页.pdf.zip

IEEE 1722.1 Overview _ Manualzz.pdf

NXP Ethernet Overview - Distribution.pdf

product_overview_update.pdf

S4HANA PCE Overview and Positioning.pdf

最新资源