OSED Study

A study journey for the OSED.

Introduction

So, once upon a time, I took the Offensive Security Exploit Developer (OSED). I unfortunately failed the exam at that time. Discouraged, I shelved it and transferred to the Blue Team before I could return to it.

Why I’m returning to this: OSED represents advanced exploit development skills that complement my OSCP foundation. This structured study plan keeps me accountable and demonstrates a methodical approach to complex technical challenges. Time to crush it like a cockroach.

What I am going to add: I am adding x64 custom shellcoding and VM escape modules in addition to the course material. Microsoft is slowly trying to kill support for x86 (or maybe they already have?) so incorporating x86_64, while I am already studying anyways, just seems like a good idea so I am actually useful once I pass. VM escapes seem like a good addition because virtualization is ubiquitous at this point as that is the backbone of the cloud (t3.micro is a VM). I expect the exam itself remains focused on 32-bit (x86) Windows user-mode exploitation. That is what it was when I took it last time.

Well, I was playing with KaliGPT and decided to ask it for help. I decided to ask for a curriculum and checklist and see what it would develop for me. I then decided to play dueling LLMs and have Claude lay into it. Might go back to KaliGPT, not sure how many rounds. Anyways, this is the result of that little experiment. Since I didn’t know where to save it to keep me honest, my portfolio projects section will have to do.


Links

Offsec OSED Link
https://github.com/biscottidiskette/osed


Process

Resources


Books

  • Practical Reverse Engineering — Bruce Dang
  • Windows Internals, Part 1 — Mark Russinovich
  • The IDA Pro Book — Chris Eagle
  • The Shellcoder's Handbook — Jack Koziol
  • Hacking: The Art of Exploitation, 2nd Ed — Jon Erickson
  • The C Programming Language — Kernighan and Ritchie (or C Programming: A Modern Approach — K.N. King)

Online Courses & Tutorials

Tools & References


Overall Path

The phases below are aligned to the EXP-301 module order and the core exploit development skill areas. Each phase builds on the last. Do not skip ahead — this material rewards depth, not breadth.

Phase 0: Foundation & Setup (1–2 weeks)

Goal: Lock in C fundamentals, x86 assembly, Windows internals, PE format, and tool fluency before touching exploits.

Topics:
  • C programming: pointers, arrays, strings, structs, memory allocation (malloc/free)
  • Understanding what vulnerable C code looks like before the compiler turns it into assembly
  • x86 Assembly (32-bit focus): registers, stack operations, calling conventions (stdcall/cdecl)
  • Stack layout: function prologs/epilogs, EBP/ESP relationship
  • PE file format: headers, sections, IAT, image loading
  • Virtual memory, Windows API basics (VirtualAlloc, LoadLibrary, GetProcAddress)
  • WinDbg workflow: breakpoints, stepping, memory inspection, !address, !exchain
  • IDA Free/Pro workflow: navigation, cross-references, string analysis, function identification
Resources:


Phase 1: Stack Overflows & SEH (2–3 weeks)

Goal: Master vanilla buffer overflows and SEH-based exploitation — the foundation for everything that follows.

Topics:
  • Stack-based buffer overflows: manual EIP control
  • Cyclic pattern generation and offset calculation
  • Bad character identification and handling
  • SEH overwrite technique and nSEH/SEH chain mechanics
  • Short jumps and trampolining
Resources:


Phase 2: Egghunters (1–2 weeks)

Goal: Overcome space restrictions by using egghunters to locate shellcode in memory.

Topics:
  • Why egghunters: limited buffer space after gaining EIP control
  • NtAccessCheckAndAuditAlarm and NtDisplayString syscall egghunters
  • Egg tag placement strategies
  • Combining egghunters with SEH-based delivery
Resources:


Phase 3: IDA Reverse Engineering (2–3 weeks)

Goal: Become fluent in static analysis — RE is how you find the bug before you can exploit it.

Topics:
  • Navigating IDA: Functions window, Strings window, Imports, cross-references (Xrefs)
  • Identifying vulnerability patterns: unsafe string operations, unchecked buffer copies
  • Tracing data flow from input to vulnerable function
  • Recognizing calling conventions and reconstructing function prototypes
  • Patching binaries in IDA for testing
  • Mapping IDA static analysis to WinDbg dynamic analysis
  • Crackmes: tracing program logic in IDA with no source code to fall back on
Resources:
  • The IDA Pro Book — Chris Eagle (full analysis sections)
  • Practical Reverse Engineering — Bruce Dang (reversing chapters)
  • Crackmes.one — practice RE challenges (start easy, work up)
  • Practice: download vulnerable apps and find the bug in IDA before looking at writeups


Phase 4: Custom Shellcode from Scratch (4–5 weeks)

Goal: Write Windows shellcode entirely by hand in x86 assembly. This includes building multiple payloads beyond those included in class for variety and to anchor the skill.

Topics:
  • PEB walking: resolving kernel32.dll base address at runtime
  • Export table parsing: finding function addresses by hash (GetProcAddress equivalent)
  • Position-independent code (PIC) — no hardcoded addresses
  • Null-byte avoidance and bad character constraints
  • Writing a reverse shell from scratch
  • Writing a dropper/stager from scratch
  • Writing an add-user-to-admin payload from scratch
  • Custom encoder/decoder stubs: XOR encoding to evade bad character filters
  • Alphanumeric and Unicode shellcode constraints
Key Win32 APIs to Know Cold:
  • LoadLibraryA — load a DLL (e.g., urlmon.dll) at runtime
  • GetProcAddress — resolve function addresses from loaded DLLs
  • URLDownloadToFileA — download a file from a URL to a local path
  • WinExec / CreateProcessA — execute a local file
  • ExitProcess — clean exit
  • Understand the stdcall convention: arguments pushed right-to-left, callee cleans the stack
Resources:


Phase 5: DEP Bypass with ROP Chains (3–4 weeks)

Goal: Bypass DEP by constructing ROP chains. The course teaches VirtualAlloc — learn it for understanding, then focus heavily on VirtualProtect and WriteProcessMemory as they are more versatile and cover more real-world scenarios.

Topics:
  • DEP and NX: what they prevent and what they don't
  • Return-Oriented Programming: concept, gadget types, chaining
  • Stack pivoting: controlling ESP to point to your ROP chain
  • VirtualAlloc ROP chain — learn for understanding (course method)
    • Allocates new RWX memory, copies shellcode there, jumps to it
    • Arguments: lpAddress, dwSize, flAllocationType (0x1000 = MEM_COMMIT), flProtect (0x40 = PAGE_EXECUTE_READWRITE)
  • VirtualProtect ROP chain — drill this
    • Changes protection of existing memory region to RWX
    • Arguments: lpAddress, dwSize, flNewProtect (0x40), lpflOldProtect (writable address)
    • Shellcode stays in place, you just make it executable
  • WriteProcessMemory ROP chain — drill this
    • Copies shellcode to a code cave in an executable region
    • Arguments: hProcess (-1 = current process pseudo-handle), lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten
    • Useful when you cannot change memory protections
  • Gadget discovery: IDA manual search, ROPgadget, rp++
  • Handling bad characters in ROP chains (encoding gadget addresses)
  • Pushad technique for setting up API arguments
Resources:


Phase 6: ASLR Bypass (2–3 weeks)

Goal: Understand ASLR and bypass it using non-ASLR modules and info leaks.

Topics:
  • What ASLR randomizes: stack, heap, module base addresses
  • Identifying ASLR-enabled vs. non-ASLR modules (lm in WinDbg)
  • Partial ASLR bypass: using non-ASLR modules
  • Constructing ROP chains from non-ASLR module gadgets
  • Information leaks via format strings (bridge to Phase 7)
Resources:


Phase 7: Format String Specifier Attacks (2–3 weeks)

Goal: Exploit format string vulnerabilities to build read and write primitives. This is a standalone EXP-301 topic — not a subtopic.

Topics:
  • Format string basics: %x for reading stack, %n for writing to memory
  • Building a read primitive: leaking stack values, module base addresses (ASLR bypass via info leak)
  • Building a write primitive: overwriting function pointers, return addresses
  • Direct parameter access (%N$x, %N$n) for precise targeting
  • Combining format string leaks with ROP chains for full exploitation
Resources:


Phase 8: Full Exploit Chains & Practice (4–6 weeks)

Goal: Combine everything into end-to-end exploits. RE in IDA → crash triage in WinDbg → exploit development → shell. Practice under time pressure and document as you go.

Topics:
  • Full chain: Crash → root cause analysis → offset calculation → SEH/stack overflow → DEP bypass (ROP) → shellcode injection → execution
  • Combining ASLR bypass (non-ASLR module or format string leak) with DEP bypass (ROP) with custom shellcode
  • Writing exploit automation scripts in Python (socket connections, struct packing, payload assembly)
  • Report writing: documenting every step with screenshots
Practice Targets:
  • Vulnserver (multiple commands test different techniques)
  • FreeFloat FTP
  • Any vulnerable binary with DEP enabled + a non-ASLR module
  • EXP-301 Challenge Labs (3 labs) — treat as dress rehearsals
Resources:


Phase 9 (Bonus): x64 Shellcode & VM Escape (Post-Pass Study)

Goal: Extend into x64 exploitation and hypervisor escape techniques. These are my additions beyond the core EXP-301 curriculum — practical skills for a world that has largely moved past 32-bit.

Topics:
  • x64 calling convention differences (RCX, RDX, R8, R9 for first 4 args; shadow space)
  • x64 shellcode development
  • VM escape concepts and hypervisor attack surfaces
Resources:
  • TBD


Checklist

  1. Pre-Phase: C & Assembly Fundamentals
    2. Goal: Get comfortable reading C and x86 assembly. Reading C is an explicit EXP-301 prerequisite — when you're staring at disassembly of a strcpy overflow, you need to understand what the C code was doing before the compiler got to it.
    • C Fundamentals
      • ❏  Complete core C exercises: pointers, arrays, strings, structs, malloc/free
      ❏  Write a deliberately vulnerable C program (e.g., unchecked strcpy into a fixed buffer)
      ❏  Compile it, crash it, examine the crash in WinDbg
      ❏  Read K&R or K.N. King (at least through pointers and memory chapters)
      ❏  Complete exercises on Learn-C
    • Assembly
      • ❏  Complete OpenSecurityTraining — Intro to x86
      ❏  TCM Security Assembly course (if available)
      ❏  Read Practical Reverse Engineering Ch. 1 (Registers, Stack, Calling Conventions)
      ❏  Solve 3 exercises from Protostar Stack (stack0–stack2)
      ❏  Write 5 small assembly programs (loops, function calls, string operations) and step through them in WinDbg
  2. Phase 0: Foundation & Lab Setup
    3. Goal: Establish core knowledge of Windows internals, PE format, and tool fluency.
    • System & Tools Setup
      • ❏  Install Kali or Windows lab VMs (Windows 7/10 x86)
      ❏  Install WinDbg Preview
      ❏  Install IDA Free
      ❏  Install PE-bear for PE header inspection
      ❏  Set up Python 3 exploit dev environment with pwntools and struct
    • PE Format & Memory
      • ❏  Read Microsoft PE Format Specification
      ❏  Read Mark Pelf — PE Format Illustrated
      ❏  Inspect PE headers with PE-bear on calc.exe and notepad.exe
      ❏  Trace IAT in IDA — locate VirtualAlloc, VirtualProtect, WriteProcessMemory, ExitProcess
      ❏  Use WinDbg: lm (list modules), !address (memory layout), !peb (PEB structure)
    • Windows Internals
      • ❏  Read Windows Internals Part 1, Ch. 1–4
      ❏  Understand PEB structure and how modules are linked (PEB → PEB_LDR_DATA → InMemoryOrderModuleList)
      ❏  Trace a VirtualAlloc call from user mode to kernel in WinDbg
  3. Phase 1: Stack Overflows & SEH
    4. Goal: Master vanilla and SEH-based buffer overflows.
    • Vanilla Stack Overflow
      • ❏  Reproduce vanilla buffer overflow (gain EIP control)
      ❏  Calculate exact offset using cyclic patterns (msf-pattern_create / msf-pattern_offset)
      ❏  Identify bad characters using memory dump comparison in WinDbg
      ❏  Analyze crash state: registers, stack, !exploitable
      ❏  Redirect execution to shellcode via JMP ESP or similar
    • SEH Overflows
      • ❏  Understand SEH chain structure (nSEH → SEH handler)
      ❏  Trigger and overwrite SEH structures (!exchain in WinDbg)
      ❏  Use POP-POP-RET to redirect to nSEH
      ❏  Short jump from nSEH to shellcode
      ❏  Combine SEH overwrite with egghunter when buffer is small
  4. Phase 2: Egghunters
    5. Goal: Overcome limited buffer space by searching memory for your payload.
  5. Phase 3: IDA Reverse Engineering
    6. Goal: Build RE fluency — finding the vulnerability is half the battle.
    • Core IDA Skills
      • ❏  Read The IDA Pro Book Ch. 1–3
      ❏  Navigate: Functions, Strings, Imports, Exports windows
      ❏  Master cross-references (Xrefs): find all callers/callees of a function
      ❏  Trace data flow: input buffer → vulnerable copy function
      ❏  Identify unsafe functions: strcpy, sprintf, memcpy with unchecked sizes
    • Crackmes
      • ❏  Complete 5+ crackmes from crackmes.one (start easy, work up)
      ❏  Trace program logic in IDA with no source code — this is the muscle you need
    • Practical RE
      • ❏  RE a simple vulnerable binary: find the overflow in IDA, confirm in WinDbg
      ❏  RE a network-facing binary: identify the protocol parsing, find the input vector
      ❏  Practice on 3+ binaries from VulnBins or ExploitDB without looking at existing writeups first
  6. Phase 4: Custom Shellcode from Scratch
    7. Goal: Write custom shellcode and build a variety of payloads to develop well-rounded shellcoding ability.
    • Foundations
      • ❏  Understand PEB walking to find kernel32.dll base address
      ❏  Write a function hash resolver: parse export table to find APIs by hash
      ❏  Write a simple "call WinExec('calc.exe')" shellcode from scratch
      ❏  Eliminate null bytes from your shellcode
      ❏  Verify position independence: shellcode must work at any memory address
    • Reverse TCP Shellcode
      • ❏  Resolve LoadLibraryA and GetProcAddress from kernel32.dll
      ❏  Call LoadLibraryA("ws2_32.dll") to load Winsock
      ❏  Resolve and call WSAStartup to initialize Winsock
      ❏  Resolve and call WSASocketA to create a TCP socket
      ❏  Build a sockaddr_in structure on the stack (IP, port, AF_INET)
      ❏  Resolve and call connect to reach the attack machine
      ❏  Redirect stdin/stdout/stderr to the socket via STARTUPINFO
      ❏  Call CreateProcessA to spawn cmd.exe over the connection
      ❏  Call ExitProcess(0) for clean exit
    • Dropper/Stager Shellcode
      • ❏  Resolve LoadLibraryA and GetProcAddress from kernel32.dll
      ❏  Call LoadLibraryA("urlmon.dll") to load the URL download library
      ❏  Resolve URLDownloadToFileA from urlmon.dll
      ❏  Construct the destination file path on the stack (Desktop path + filename)
      ❏  Call URLDownloadToFileA(NULL, url, dest_path, 0, NULL) to download the .exe
      ❏  Call WinExec(dest_path, SW_SHOW) or CreateProcessA to execute the downloaded file
      ❏  Call ExitProcess(0) for clean exit
    • Add Local Admin User Shellcode
      • ❏  Resolve LoadLibraryA and GetProcAddress from kernel32.dll
      ❏  Call LoadLibraryA("netapi32.dll") to load the Net API library
      ❏  Resolve NetUserAdd from netapi32.dll
      ❏  Build a USER_INFO_1 structure on the stack (username, password, privilege level, flags)
      ❏  Call NetUserAdd(NULL, 1, &userInfo, NULL) to create the local user
      ❏  Resolve NetLocalGroupAddMembers from netapi32.dll
      ❏  Build a LOCALGROUP_MEMBERS_INFO_3 structure on the stack (username pointer)
      ❏  Construct the group name string "Administrators" on the stack
      ❏  Call NetLocalGroupAddMembers(NULL, "Administrators", 3, &memberInfo, 1) to add the user to local admins
      ❏  Call ExitProcess(0) for clean exit
    • Shellcode Encoding
      • ❏  Write a XOR encoder in Python and a decoder stub in assembly
      ❏  Handle bad character constraints by encoding shellcode
      ❏  Create alphanumeric payloads using known-safe instruction encodings
      ❏  Reproduce Corelan ASCII/Unicode SEH exploit
    • Extra Shellcode Practice
      • ❏  Write a bind shell from scratch
      ❏  Write shellcode that works under Unicode constraints
  7. Phase 5: DEP Bypass with ROP Chains
    8. Goal: Build ROP chains using all three DEP bypass APIs. Start with reviewing and understanding VirtualAlloc from the course material. Then focus on VirtualProtect and WriteProcessMemory for versatility.
    • DEP Foundations
      • ❏  Enable DEP on test app, verify shellcode crash in WinDbg (!address, !exploitable)
      ❏  Read Practical Reverse Engineering Ch. 2 (Windows memory management)
      ❏  Understand ROP concept: chaining small instruction sequences ending in RET
    • VirtualAlloc ROP Chain (Course Method — Learn, Don't Drill)
      • ❏  Build a VirtualAlloc ROP chain following Corelan Part 8
      ❏  Understand the arguments: lpAddress, dwSize, flAllocationType, flProtect
    • VirtualProtect ROP Chain (Drill This)
      • ❏  Build a VirtualProtect ROP chain from scratch using gadgets from a non-ASLR DLL
      ❏  Arguments: lpAddress (shellcode addr), dwSize (0x400+), flNewProtect (0x40 = RWX), lpflOldProtect (writable addr)
      ❏  Practice the pushad technique for setting up arguments on the stack
      ❏  Build VirtualProtect chains against 3+ different binaries with different gadget sets
    • WriteProcessMemory ROP Chain (Drill This)
      • ❏  Build a WriteProcessMemory ROP chain from scratch
      ❏  Arguments: hProcess (0xFFFFFFFF = GetCurrentProcess pseudo-handle), lpBaseAddress (code cave), lpBuffer (shellcode location), nSize, lpNumberOfBytesWritten (writable addr)
      ❏  Find code caves in target binaries for shellcode destination
      ❏  Build WriteProcessMemory chains against 3+ different binaries
    • ROP Mastery
      • ❏  Complete all ROP Emporium challenges (x86)
      ❏  Use ROPgadget and rp++ for automated gadget discovery, but also find gadgets manually in IDA
      ❏  Practice stack pivot techniques: XCHG EAX,ESP; MOV ESP,EAX; etc.
      ❏  Handle bad characters in gadget addresses (find alternative gadgets or use encoding)
      ❏  Skape's Shellcode Paper (Advanced)
  8. Phase 6: Understanding ASLR
    9. Goal: Identify and exploit non-ASLR modules; understand info leak techniques.
    • ASLR Detection
      • ❏  Use lm in WinDbg to list all loaded modules and their base addresses
      ❏  Use narly WinDbg extension to check for security headers
      ❏  Use !address to view full memory layout and ASLR status
    • Partial ASLR Bypass
      • ❏  Identify static modules loaded at fixed addresses
      ❏  Read Corelan — ASLR Tutorial
  9. Phase 7: Format String Specifier Attacks
    10. Goal: Use format string vulnerabilities for information leaks (ASLR bypass) and arbitrary writes.
    • Reading
      • ❏  Hacking: The Art of Exploitation, 2nd Ed — Format Strings chapter
      ❏  Format String Vulnerabilities — Aleph One
      ❏  Modern Binary Exploitation (RPISEC) — format string labs
    • Practice
      • ❏  Leak stack values using %x and %p format specifiers
      ❏  Leak a module base address to bypass ASLR
      ❏  Write to an arbitrary address using %n with direct parameter access
      ❏  Overwrite a function pointer to redirect execution
      ❏  Combine a format string info leak with a ROP chain for full DEP+ASLR bypass
      ❏  FuzzySecurity — Stack Smashing 0x07
  10. Phase 8: Full Exploit Chains & Practice
    11. Goal: Put it all together. Pick binaries you haven't seen before, RE them in IDA, build full exploits under time pressure. Document everything as you go.
    • Skill Drills
      • ❏  Pick a vulnerable binary — RE it in IDA, find the bug, build a working exploit
      ❏  Build a VirtualProtect ROP chain against a new binary with DEP enabled
      ❏  Build a WriteProcessMemory ROP chain against a different binary
      ❏  Write a complete dropper shellcode from scratch without referencing notes
    • End-to-End Exploits (2+ targets)
      • ❏  Target 1: Vulnserver — Full chain with multiple commands
      ❏  Target 2: FreeFloat FTP or similar — Full chain from fuzzing to shell
      ❏  Build each exploit with: crash analysis → offset → ROP/SEH → shellcode → reverse shell
    • Tooling & Reporting
      • ❏  Write custom boofuzz fuzzer for a target app
      ❏  Build a Python exploit template with modular sections (connection, overflow, ROP, shellcode)
      ❏  Write a bad character detection script using WinDbg memory dumps
      ❏  Practice report writing: screenshot every key step, document your methodology
    • EXP-301 Challenge Labs
      • ❏  Complete Challenge Lab 1
      ❏  Complete Challenge Lab 2
      ❏  Complete Challenge Lab 3
      ❏  Re-do any lab where you needed hints — you should be able to solo them


PE Format Study Plan

  1. Microsoft's Official PE Specification
  2. PE Format Illustrated — Mark Pelf (2-part article)
  3. Deep Dive YouTube Videos
  4. Blogs & Tutorials
  5. GitHub "PE101-v1" PDF


Exam Day Strategy

Before the Exam

  • Have your scripts, skeletons, and templates ready to go
  • Have a cheat sheet of WinDbg commands, IDA shortcuts, and Win32 API signatures
  • Test your VPN setup and tooling in advance
  • Sleep because exhaustion won't help you

During the Exam

  • Time boxing: If stuck for 2+ hours on one problem, switch to another. Fresh eyes solve problems.
  • Breaks: Every 2 hours, take a 10–15 minute break. Walk around, eat, hydrate. Fatigue kills more attempts than lack of knowledge.
  • Document as you go: Screenshot every significant step. Take notes on what you tried and why. You will NOT remember details after a long exam session.
  • Shellcode tip: Follow the course on how to test your shellcode as you go instead of waiting to the end to find out it doesn't work.
  • ROP tip: Don't tunnel vision into a single WinAPI. Have a workbench of WinAPIs just in case you need to pivot.

The Report

  • Follow the OSED Exam Guide report format exactly
  • Every step must be reproducible from your report
  • Include: proof screenshots, full exploit code (commented), step-by-step methodology
  • Include: raw `.py` code files (one per assignment)
  • Submit as .7z with the required naming convention — check the guide


Study

Just getting started. Not much to report yet.


Extra

https://github.com/nop-tech/OSED
https://github.com/Gabb4r/osed
https://github.com/r0r0x-xx/OSED-Pre
https://github.com/epi052/osed-scripts
https://github.com/CyberSecurityUP/OSCE3-Complete-Guide
https://github.com/ForsakenSystems/.github/blob/main/content/lost-and-found/expl/skel.md


References:

https://claude.ai
https://chatgpt.com/