{"product_id":"advanced-windows-binary-exploitation-kolja-grassmann-and-florian-schweins-sg2027","title":"Advanced Windows Binary Exploitation - Kolja Grassmann - DCTSG2027","description":"\u003cp\u003e\u003cstrong\u003eName of Training:\u003c\/strong\u003e Advanced Windows Binary Exploitation\u003cbr\u003e\u003cstrong\u003eTrainer(s):\u003c\/strong\u003e Kolja Grassmann\u003cbr\u003e\u003cstrong\u003eSkill Level:\u003c\/strong\u003e Advanced\u003cbr\u003e\u003cstrong\u003eDates:\u003c\/strong\u003e March 5 – March 6, 2027\u003cbr\u003e\u003cstrong\u003eTime:\u003c\/strong\u003e 9 to 5 pm\u003cbr\u003e\u003cstrong\u003eVenue:\u003c\/strong\u003e TBD\u003cbr\u003e\u003cmeta charset=\"utf-8\"\u003e\u003cstrong\u003eEarly Bird Cost:\u003c\/strong\u003e S$3,300 \u003cmeta charset=\"utf-8\"\u003e\u003cspan\u003e(incl. GST, until Dec 31, 2026)\u003c\/span\u003e\u003cbr\u003e\u003cstrong\u003eRegular Cost:\u003c\/strong\u003e S$3600 (incl. GST)\u003cbr\u003e\u003c\/p\u003e\n\u003ch3\u003eShort Summary\u003c\/h3\u003e\n\u003cp\u003eMemory corruption bugs are alive! In this course you'll learn about the mitigations Windows has in place to prevent you from exploiting them and how you'll still succeed as an attacker.\u003c\/p\u003e\n\u003ch3\u003eCourse Description\u003c\/h3\u003e\n\u003cp\u003eThis training dives deep into the art of binary exploitation for Windows systems. Designed for security professionals eager to elevate their skills, the course starts with foundational techniques for identifying and analyzing buffer overflow vulnerabilities. The training starts with a concise refresher on x86 assembly and tools like x64dbg and Ghidra. Afterwards, using pre-configured systems, attendees will analyze and exploit example Windows binaries.\u003c\/p\u003e\n\u003cp\u003eThen, the training progresses to exploit development, covering shellcode crafting, stack smashing, and advanced topics like circumventing stack canaries, ASLR bypasses, and mastering Return-Oriented Programming (ROP). Participants will experience modern attack and defense strategies firsthand, culminating in the exploitation of real-world applications.\u003c\/p\u003e\n\u003cp\u003eBy the end of the course, attendees will have the skills and confidence to craft their own Windows exploits for memory corruption bugs.\u003c\/p\u003e\n\u003ch3\u003eCourse Outline\u003c\/h3\u003e\n\u003ch4\u003eDay 1 - Morning\u003c\/h4\u003e\n\u003cul\u003e\n\u003cli\u003eBrief refresher\u003c\/li\u003e\n\u003cli\u003eAssembly, x64dbg, and Ghidra.\u003c\/li\u003e\n\u003cli\u003eHands-on Challenges: Debugging and reversing binaries.\u003c\/li\u003e\n\u003cli\u003ePwntools\u003c\/li\u003e\n\u003cli\u003eOverview of Pwntools: Automating interactions with binaries.\u003c\/li\u003e\n\u003cli\u003eDemo: Writing simple scripts and crafting basic exploits.\u003c\/li\u003e\n\u003cli\u003eHands-on Challenges: Automating binary interactions.\u003c\/li\u003e\n\u003cli\u003eShellcode Development\u003c\/li\u003e\n\u003cli\u003eCrafting shellcode: techniques, use cases, and examples.\u003c\/li\u003e\n\u003cli\u003eHands-on Challenges: Writing and using shellcode with examples.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003eDay 1 - Afternoon\u003c\/h4\u003e\n\u003cul\u003e\n\u003cli\u003eSmashing the Stack\u003c\/li\u003e\n\u003cli\u003eFundamentals of buffer overflows and stack behavior.\u003c\/li\u003e\n\u003cli\u003eDemo: Developing a stack-smashing exploit.\u003c\/li\u003e\n\u003cli\u003eHands-on Challenges: Exploit a stack-overflow vulnerability in practice.\u003c\/li\u003e\n\u003cli\u003eLab + Q\u0026amp;A Session\u003c\/li\u003e\n\u003cli\u003eWork on lab exercises.\u003c\/li\u003e\n\u003cli\u003eDiscuss challenges and consolidate learning from Day 1.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003eDay 2 - Morning\u003c\/h4\u003e\n\u003cul\u003e\n\u003cli\u003eBypassing Stack Canaries\u003c\/li\u003e\n\u003cli\u003eOverview of stack canaries: Protection mechanisms and bypassing strategies.\u003c\/li\u003e\n\u003cli\u003eHands-on Challenges: Develop an exploit to bypass stack canaries.\u003c\/li\u003e\n\u003cli\u003eAddress Space Layout Randomization (ASLR)\u003c\/li\u003e\n\u003cli\u003eUnderstanding ASLR and techniques for bypassing it.\u003c\/li\u003e\n\u003cli\u003eDemo: Analyzing ASLR-protected binaries.\u003c\/li\u003e\n\u003cli\u003eHands-on Challenges: Exploit an ASLR-protected binary.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch4\u003eDay 2 - Afternoon\u003c\/h4\u003e\n\u003cul\u003e\n\u003cli\u003eReturn-Oriented Programming (ROP)\u003c\/li\u003e\n\u003cli\u003eBasics of ROP: Purpose, techniques, and crafting payloads.\u003c\/li\u003e\n\u003cli\u003eHands-on Challenges: Exploit a binary using a basic ROP chain.\u003c\/li\u003e\n\u003cli\u003eAdvanced ROP Challenges\u003c\/li\u003e\n\u003cli\u003eBuild and execute ROP chains to exploit vulnerabilities.\u003c\/li\u003e\n\u003cli\u003eChallenge: Create complex ROP payloads to bypass mitigations.\u003c\/li\u003e\n\u003cli\u003eLab + Q\u0026amp;A Session\u003c\/li\u003e\n\u003cli\u003eWork on lab exercises.\u003c\/li\u003e\n\u003cli\u003eWrap-up of advanced exploitation techniques with open discussion.\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eDifficulty Level\u003c\/h3\u003e\n\u003cp\u003eAdvanced - The student is expected to have significant practical experience with the tools and technologies that the training will focus on.\u003c\/p\u003e\n\u003ch3\u003eSuggested Prerequisites\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBasic knowledge of low-level programming (e.g. C\/C++)\u003c\/li\u003e\n\u003cli\u003eBasic understanding of x86 assembly\u003c\/li\u003e\n\u003cli\u003eFamiliarity with Windows memory layout (stack, heap, ...)\u003c\/li\u003e\n\u003cli\u003eExperience with at least one Windows debugger (e.g., x64dbg)\u003c\/li\u003e\n\u003c\/ul\u003e\n\u003ch3\u003eWhat Students Should Bring\u003c\/h3\u003e\n\u003cp\u003eA laptop with an up to date browser to access the browser-based lab\u003c\/p\u003e\n\u003ch3\u003eWhat the Trainer Will Provide\u003c\/h3\u003e\n\u003cp\u003eCourse material as PDF. Exercise files. Access to the challenge lab.\u003c\/p\u003e\n\u003ch3\u003eTrainer(s) Bio\u003c\/h3\u003e\n\u003cp\u003eKolja is a Security Researcher and Trainer at Neodyme. He specializes in Windows and Active Directory security. He has found vulnerabilities in widely used security products and has extensive exploit development, pentesting, and red teaming experience.\u003cbr\u003e\u003c\/p\u003e\n\u003ch3\u003eProficiency Exam\u003c\/h3\u003e\n\u003cp\u003eBy solving the exercises for our training participants get flags and we host a platform where they can be handed in. For the proficiency evaluation we would like students to solve at least 70% of the tasks (excluding bonus tasks, that are meant to be solved outside of class).\u003c\/p\u003e\n\u003chr\u003e\n\u003csection class=\"registration-terms\"\u003e\n\u003ch3\u003eRegistration Terms and Conditions\u003c\/h3\u003e\n\u003cp\u003eTrainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.\u003c\/p\u003e\n\u003cp\u003eBetween January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.\u003c\/p\u003e\n\u003cp\u003eAll trainings are non-refundable after Feb 28, 2027.\u003c\/p\u003e\n\u003cp\u003eTraining tickets may be transferred to another student. Please email us at training@defcon.org for specifics.\u003c\/p\u003e\n\u003cp\u003eIf a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).\u003c\/p\u003e\n\u003cp\u003eFailure to attend the training without prior written notification will be considered a no-show. No refund will be given.\u003c\/p\u003e\n\u003cp\u003eDEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.\u003c\/p\u003e\n\u003cp\u003eBy purchasing this ticket you agree to abide by the \u003ca href=\"https:\/\/defcon.org\/html\/links\/dc-code-of-conduct.html\"\u003eDEF CON Training Code of Conduct\u003c\/a\u003e and the registration terms and conditions listed above.\u003c\/p\u003e\n\u003cp\u003eSeveral breaks will be included throughout the day. Please note that food is not included.\u003c\/p\u003e\n\u003cp\u003e\u003cmeta charset=\"utf-8\"\u003eAll courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.\u003c\/p\u003e\n\u003c\/section\u003e","brand":"Singapore 2027","offers":[{"title":"Default Title","offer_id":63496774320268,"sku":null,"price":3300.0,"currency_code":"SGD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0750\/9042\/8044\/files\/kolja.jpg?v=1793071546","url":"https:\/\/sg.shop.defcon.org\/products\/advanced-windows-binary-exploitation-kolja-grassmann-and-florian-schweins-sg2027","provider":"DEF CON SG","version":"1.0","type":"link"}