About this course

This course teaches attendees the techniques hackers use to exploit memory corruption vulnerabilities on IoT devices running on the Arm Cortex-A processor. Based around two real-world routers, this course teaches students the process of analyzing and debugging vulnerabilities, building exploits from scratch, and bypassing common exploit mitigations along the way.

Who is this course for?

Security Researchers: Level up your skills and learn how to exploit IoT devices for research.
Red Teams: Test your products using the techniques hackers use to exploit IoT devices.
Forensic: Learn the techniques to look for when analyzing a compromised device.
Developers: Learn what exploit mitigations protect against and harden your device.

Our course begins with an introduction into the Arm architecture and assembly language, and how to build assembly shellcode. After an introduction to memory corruption vulnerabilites, students will analyze a stack-based buffer overflow and write their first exploit. The day ends with an intruction to the XN exploit mitigation, what it protects against, and the techniques hackers use to bypass it.

The second day of the course focuses on exploiting two real-world routers, including the process of emulating firmware, debug and trigger vulnerabilities on these target devices. Several practical labs guide students through the process of writing exploits to take over the process using different ROP-chain techniques and run in-memory shellcode directly in the target process.

The third day of the course provides a deeper study of exploit categories and techniques that make exploits reliable. Students will learn about ASLR and Stack Canary exploit mitigations and practice different bypass techniques in practical labs.

The final day begins with an introduction to glibc heap, and teaches students how to construct exploit primitives that can be engineered together to build powerful and reliable exploits for heap-based vulnerabilities. The main lab guildes students through the process of writing an exploit against a network service containing a heap linear buffer overflow, how to turn this buffer overflow into a reliable relative-read exploit primitive to bypass exploit mitigations, how to construct arbitrary-read primitives to search target memory for useful binaries, and how to exploit and construct malicious vtables to fully take control of the target device.