Gray Hat Hacking: The Ethical Hacker’s Handbook

777 Pages·2018·94.346 MB·English

by  Shon Harris, Allen Harper, Daniel Regalado, Ryan Linn, Stephen Sims, Branko Spasojevic, Linda Martinez Hahaj, Michael Baucom, Chris Eagle

Praise for Gray Hat Hacking: The Ethical Hacker’s Handbook, Fifth Edition
“The Gray Hat Hacking book series continue to provide an up-to-date and detailed view on
a large variety of offensive IT security disciplines. In this fifth edition, a group of respected
infosec professionals spared no effort to share their experience and expertise on novel
techniques to bypass security mechanisms.
The exploit development chapters, written by Stephen Sims, reveal in great detail what it
takes to write an exploit for modern applications. In Chapter 14, Stephen uses a recent
vulnerability in a major web browser to demystify the complexity of writing modern
exploits for heap-related memory corruptions, bypassing memory protections along the
road.
This book is a must read for anyone who wants to step up and broaden their skills in
infosec.”
—Peter Van Eeckhoutte
Corelan Team (@corelanc0d3r)
“One of the few book series where I ALWAYS buy the updated version. Learn updated
exploit-dev techniques from the best instructors in the business. The volume of new
information available to the average information security practitioner is staggering. The
authors, who are some of the best in their respective fields, help us stay up to date with
current trends and techniques. GHH’s updates on Red Team Ops, Bug Bounties,
PowerShell Techniques, and IoT & Embedded Devices are exactly what infosec
practitioners need to add to their tool kits.”
—Chris Gates
Sr. Security Engineer (Uber)
“Never before has there been so much technology to attack nor such high levels of controls
and prevention mechanisms. For example, the advancements in modern operating systems
and applications to protect against exploitation are very impressive, yet time and time again
with the right conditions they are bypassed. Amongst a litany of modern and up-to-date
techniques, Gray Hat Hacking provides detailed and informative walkthroughs of
vulnerabilities and how controls like ASLR and DEP are bypassed. Filled with real
examples you can follow if you are seeking to upgrade your understanding of the latest
hacking techniques—this is the book for you.”
—James Lyne
Global Research Advisor (Sophos) and Head of R&D (SANS Institute)
2
3
Copyright © 2018 by McGraw-Hill Education. All rights reserved. Except as permitted
under the United States Copyright Act of 1976, no part of this publication may be
reproduced or distributed in any form or by any means, or stored in a database or retrieval
system, without the prior written permission of the publisher, with the exception that the
program listings may be entered, stored, and executed in a computer system, but they may
not be reproduced for publication.
ISBN: 978-1-26-010842-2
MHID: 1-26-010842-2
The material in this eBook also appears in the print version of this title: ISBN: 978-1-26-
010841-5,
MHID: 1-26-010841-4.
eBook conversion by codeMantra
Version 1.0
All trademarks are trademarks of their respective owners. Rather than put a trademark
symbol after every occurrence of a trademarked name, we use names in an editorial fashion
only, and to the benefit of the trademark owner, with no intention of infringement of the
trademark. Where such designations appear in this book, they have been printed with
initial caps.
McGraw-Hill Education ebooks are available at special quantity discounts to use as
premiums and sales promotions or for use in corporate training programs. To contact a
representative, please visit the Contact Us page at www.mhprofessional.com.
All trademarks or copyrights mentioned herein are the possession of their respective owners
and McGraw-Hill Education makes no claim of ownership by the mention of products that
contain these marks.
Information has been obtained by McGraw-Hill Education from sources believed to be
reliable. However, because of the possibility of human or mechanical error by our sources,
McGraw-Hill Education, or others, McGraw-Hill Education does not guarantee the
accuracy, adequacy, or completeness of any information and is not responsible for any
errors or omissions or the results obtained from the use of such information.
TERMS OF USE
This is a copyrighted work and McGraw-Hill Education and its licensors reserve all rights
in and to the work. Use of this work is subject to these terms. Except as permitted under
the Copyright Act of 1976 and the right to store and retrieve one copy of the work, you
4
may not decompile, disassemble, reverse engineer, reproduce, modify, create derivative
works based upon, transmit, distribute, disseminate, sell, publish or sublicense the work or
any part of it without McGraw-Hill Education’s prior consent. You may use the work for
your own noncommercial and personal use; any other use of the work is strictly prohibited.
Your right to use the work may be terminated if you fail to comply with these terms.
THE WORK IS PROVIDED “AS IS.” McGRAW-HILL EDUCATION AND ITS
LICENSORS MAKE NO GUARANTEES OR WARRANTIES AS TO THE
ACCURACY, ADEQUACY OR COMPLETENESS OF OR RESULTS TO BE
OBTAINED FROM USING THE WORK, INCLUDING ANY INFORMATION
THAT CAN BE ACCESSED THROUGH THE WORK VIA HYPERLINK OR
OTHERWISE, AND EXPRESSLY DISCLAIM ANY WARRANTY, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. McGraw-Hill
Education and its licensors do not warrant or guarantee that the functions contained in the
work will meet your requirements or that its operation will be uninterrupted or error free.
Neither McGraw-Hill Education nor its licensors shall be liable to you or anyone else for
any inaccuracy, error or omission, regardless of cause, in the work or for any damages
resulting therefrom. McGraw-Hill Education has no responsibility for the content of any
information accessed through the work. Under no circumstances shall McGraw-Hill
Education and/or its licensors be liable for any indirect, incidental, special, punitive,
consequential or similar damages that result from the use of or inability to use the work,
even if any of them has been advised of the possibility of such damages. This limitation of
liability shall apply to any claim or cause whatsoever whether such claim or cause arises in
contract, tort or otherwise.
5
In Memory of Shon Harris
In the previous edition, I spoke in memory of Shon Harris, my friend, mentor, and a
person I credit with jump-starting my career after my time in the Marine Corps. Simply
put, neither this book nor most of my professional accomplishments would have happened
without her. I continue to miss her and I know I speak on behalf of the other authors that
we wish she were still with us. If you did not know Shon or have never heard of her, you
owe it to yourself to learn about her inspiring story in the last edition and elsewhere. For
those of us who knew her and have our own “Shon” stories, join me in keeping her
memory alive and share her story with anyone who will listen. She was an amazing person
and is loved and missed dearly. We dedicate this book to her memory.
—Allen Harper
Lead author and friend of Shon Harris
To my brothers and sisters in Christ, keep running the race. Let your light shine for Him,
that others may be drawn to Him through you.
—Allen Harper
Dedicado a ti mamita Adelina Arias Cruz, cuando me pregunto de donde sale mi garra de
no dejarme de nadie o el sacrificio incansable para conseguir mis metas, solo tengo que
voltear a verte, para ti no hay imposibles, te adoro!
—Daniel Regalado
To Mom, who read to me when I was little, so I could achieve the level of literacy I needed
to become an author one day.
—Ryan Linn
To my lovely wife LeAnne and my daughter Audrey, thank you for your ongoing support!
—Stephen Sims
To my lovely daughter Elysia, thank you for your unconditional love and support. You
inspire me in so many ways. I am, and will always be, your biggest fan.
—Linda Martinez
To my family and friends for their unconditional support and making this life funny and
interesting.
—Branko Spasojevic
To my daughter Tiernan, thank you for your support and continuous reminders to enjoy
life and learning each and every day. I look forward to seeing the wonderful woman you
will become.
6
—Michael Baucom
To my son Aaron, thanks for all your love while I spend too much time at the keyboard,
and thanks for sharing your joy on all the projects we work on together.
—Chris Eagle
7
ABOUT THE AUTHORS

Dr. Allen Harper, CISSP. In 2007, Allen Harper retired from the military as a Marine
Corps Officer after a tour in Iraq. He has more than 30 years of IT/security experience. He
holds a PhD in IT with a focus in Information Assurance and Security from Capella, an
MS in Computer Science from the Naval Postgraduate School, and a BS in Computer
Engineering from North Carolina State University. Allen led the development of the GEN
III honeywall CD-ROM, called roo, for the Honeynet Project. He has worked as a security
consultant for many Fortune 500 and government entities. His interests include the
Internet of Things, reverse engineering, vulnerability discovery, and all forms of ethical
hacking. Allen was the founder of N2NetSecurity, Inc., served as the EVP and chief hacker
at Tangible Security, and now serves the Lord at Liberty University in Lynchburg, Virginia.
Daniel Regalado, aka Danux, is a Mexican security researcher with more than 16 years
in the security field, dissecting or pen-testing malware, 0-day exploits, ATMs, IoT devices,
IV pumps, and car infotainment systems. He is a former employee of widely respected
companies like FireEye and Symantec and is currently a principal security researcher at
Zingbox. Daniel is probably best known for his multiple discoveries and dissection of ATM
malware attacking banks worldwide, with the most notorious findings being Ploutus,
Padpin, and Ripper.
Ryan Linn has over 20 years in the security industry, ranging from systems programmer
to corporate security, to leading a global cybersecurity consultancy. Ryan has contributed to
a number of open source projects, including Metasploit and the Browser Exploitation
Framework (BeEF). Ryan participates in Twitter as @sussurro, and he has presented his
research at numerous security conferences, including Black Hat and DEF CON, and has
provided training in attack techniques and forensics worldwide.
Stephen Sims is an industry expert with over 15 years of experience in information
technology and security. He currently works out of San Francisco as a consultant
performing reverse engineering, exploit development, threat modeling, and penetration
testing. Stephen has an MS in information assurance from Norwich University and is a
course author, fellow, and curriculum lead for the SANS Institute, authoring courses on
advanced exploit development and penetration testing. He has spoken at numerous
conferences, including RSA, BSides, OWASP AppSec, ThaiCERT, AISA, and many
others. He may be reached on twitter: @Steph3nSims
Branko Spasojevic is a security engineer on Google’s Detection and Response team.
Before that he worked as a reverse engineer for Symantec and analyzed various threats and
8
APT groups.
Linda Martinez is the Chief Information Security Officer (CISO) and Vice President of
Commercial Service Delivery at Tangible Security. Linda is a proven information security
executive and industry expert with over 18 years of experience leading technical teams,
developing technical business lines, and providing high-quality consulting services to
clients. She is responsible for Tangible Security’s Commercial Division, where she leads the
following business lines: penetration testing, including red and purple team operations;
hardware hacking; product and supply chain security; governance, risk management, and
compliance; incident response and digital forensics. Linda also leads a team of virtual Chief
Information Security Officers (CISOs) in providing expert guidance to many organizations.
Prior to her current position, Linda was the Vice President of Operations for N2 Net
Security. Before that, she co-founded and served as Chief Operating Officer (COO) for
Executive Instruments, an information security research and consulting firm.
Michael Baucom currently works for Tangible Security as the VP of Tangible Labs.
While at Tangible he has worked on a wide variety of projects, including software security
assessments, SDLC consulting, tool development, and penetration tests. Prior to working at
Tangible Security, he served in the Marine Corps as a ground radio repairman.
Additionally, he worked for IBM, Motorola, and Broadcom in several capacities, including
test engineering, device driver development, and system software development for
embedded systems. In addition to his work activities, Michael has been a trainer at Black
Hat, speaker at several conferences, and technical editor for Gray Hat Hacking: The Ethical
Hacker’s Handbook. His current interests are in automating pen-test activities, embedded
system security, and mobile phone security.
Chris Eagle is a senior lecturer in the computer science department at the Naval
Postgraduate School in Monterey, California. A computer engineer/scientist for more than
30 years, he has authored several books, served as the chief architect for DARPA’s Cyber
Grand Challenge, frequently speaks at security conferences, and has contributed several
popular open source tools to the security community.
The late Shon Harris is greatly missed. She was the president of Logical Security, a
security consultant, a former engineer in the Air Force’s Information Warfare unit, an
instructor, and an author. She authored the best-selling CISSP Exam Guide (currently in its
seventh edition), along with many other books. Shon consulted for a variety of companies
in many different industries. Shon taught computer and information security to a wide
range of clients, including RSA, Department of Defense, Department of Energy, West
Point, National Security Agency (NSA), Bank of America, Defense Information Systems
Agency (DISA), BMC, and many more. Shon was recognized as one of the top 25 women
in the Information Security field by Information Security Magazine.
Disclaimer: The views expressed in this book are those of the authors and not of the
U.S. government or any company mentioned herein.
9
About the Technical Editor
Heather Linn has over 20 years in the security industry and has held roles in corporate
security, penetration testing, and as part of a hunt team. She has contributed to open
source frameworks, including Metasploit, and has contributed to course materials on
forensics, penetration testing, and information security taught around the globe.
Heather has presented at many security conferences, including multiple BSides
conferences, local ISSA chapter conferences, and student events aimed at providing realistic
expectations for new students entering the information security field.
10