Developing a Windows exploit

Exploit development is a tough art that requires attackers to have a fair bit of understanding of the assembly language and underlying system architecture. We can utilize the following five-stage approach to develop a custom exploit:

Figure 10.20: Five-stage custom exploit development

In this section, we will cover some basics that are required to develop a Windows exploit by building a vulnerable application. From the exploit development perspective, the following are the basic terms that penetration testers must understand when they develop an exploit:

• Registers: All of the processes execute via registers; these are used to store information.
• x86: This includes 32-bit systems that are mostly Intel-based; 64-bit systems are represented as x64.
• Assembly language: This includes low-level programming languages.
• Buffer: This is a static memory holder in a program that stores data on top of the stack or heap.
...