OSED — Surviving on The Windows Underworld

بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ

Intro:

EXP-301, also known as “Windows User Mode Exploit Development (WUMED),” is an intermediate-level course that is one of the most recent courses from Offensive Security. It was first introduced in 2021; this course focuses primarily on Exploit Development and Reverse Engineering in the x86 Windows environment (User Mode), while also taking into account fundamental memory protections such as SEH, DEP, and ASLR.

This post serves as a review for the OSED course and exam also as a motivation for people who are interested in obtaining the OSED certification. om this post I would share my experience as I was able to pass the exam on my first attempt due to the thorough preparation and coverage of the course and the extramiles.

A Brief about Myself:

This is Monzer Kamal a Sudanese CyberSecurity Passionate who is completely obsessed with hacking, bug-hunting, penetration testing, red-teaming, and related stuff. Currently I’m working as a lead cybersecurity consultant in Saudi Arabia and recently I’m the prude holder of OSCE3.

My EXP-301 Course Experience:

On 16th of July, I’ve purchased the EXP-301 package provided by offensive security which includes one exam attempt and 90 Days of lab access. To be completely honest, my primarily interest was completing the OffSec triangle and earning the OSCE3 certificate so that learning binary exploitation techniques itself was a second priority because I didn’t enjoy them and didn’t find many uses for them in my daily work. However, after finishing this course I found myself infatuated with the Binary Exploitation and Reverse Engineering.

Since I began my OSCE3 Journey the OSED was my biggest worry because I had NO experience with PE files Reverse Engineering and Exploit Development before taking this course and had only dealt with OSCP level overflows. but after I passed the OSED exam I have found that it’s just like other OffSec Certifications — so difficult before the exam — incredibly simple once you pass it.

Without further ado, below are the lessons I’ve learnt over my OSED course time. As someone who believes in sharing knowledge and experience, I would want to give some recommendations and advice that may aid incoming students to get as much knowledge as they can with the least amount of effort.

1st Lesson: Keep your mind on binary mode

First, I stopped performing any web, mobile, or network penetration tests or bughunting (apart from those that were necessary for my day-to-day job). Anyone who has worked on any of these activities together before understands how challenging it is to move between all those mindsets. so, during the course just keep focusing on binaries.

2nd Lesson: Discipline is the key

Make a timetable that takes into account your prior experience with binaries and stick to it. In my case, I planned to study for 6 hours every day, including 1 hour spent listening to a related broadcast while driving from the office to my house, as I don’t have previous experiences, but for those how are familiar with Binaries I believe it will take less time. Additionally, if you started a module, attempt to finish it in the same session.

3rd Lesson: Do NOT avoid any module

All the modules are related to each other, so don’t skip any chapters because you might learn a command, shortcut, or exploitation technique that will save your life on the exam. You might think that some modules aren’t that important or simple and won’t be covered on the exam, but that isn’t always the case.

4th Lesson: Be Aware of The NOT mentioned things

This course will require you to find workarounds for many things that is not directly mentioned on it, therefore you’ll frequently need to go beyond the course material. Also, in addition to utilizing the techniques covered in the course, you should also take into account extra techniques that weren’t covered or were only hinted at in the course material, so learn to pay attention to the signals. (This is how I can expect OffSec exams scenarios).

5th Lesson: Try Smarter and Save Your efforts

I believe that the extramiles are intended to teach you one or two things, and if you don’t have time to complete the extramiles, try reading the Discord Channel discussions to collect some keywords, then search for it online. Usually, most students are stuck on the extramiles, so they would discuss it on the discord channel but without spoiling.

My OSED Exam Experience:

Since you have come to this point, I would assume that you are aware that this exam is almost the hardest in the Offensive Security series. However, I was able to pass it on my first attempt thanks to the thorough preparation I went through, proving that passing it on your first try is doable. Therefore, I would like to share the following advice:

1st Advise: Do the extramiles challenges

One of the important preparation activities that enabled me to understand the techniques provided in and outside of this course was to solve the extramiles machines using multiple methods.

2nd Advise: Find extra resources

Look for publicly available exploits and shellcodes and try to figure out which windows API or approach was used, and how it will be executed on the memory.

3rd Advise: Use your Own POCs

If you covered the course well and replicate the attacks you will collect a good amount of POCs scripts, you can utilize those POCs directly on the exam, saving you a ton of time. This eliminates the requirement for you to build everything from scratch.

4th Advise: Don’t maintain a strict timetable.

According to my experience with this exam, it’s best to avoid splitting objectives into days because, unlike OSWE, the objectives came with varying levels of difficulty. For me, one challenge took me more than 30 hours to complete, while another took me about 10 hours. So that you don’t lose hope until the last hour of the exam, I was on the verge of quitting twice but kept going on thanks to a good friend’s encouragement that I can do it.

5th Advise: Disconnect your mind

In this exam, you will feel that you can’t trust your own eyes, so try to disconnect your mind and get some fresh air then come back again. for me I used to take 15-minute break every 3 hours.

6th Advise: Take care of your health

Since I usually don’t sleep during OffSec exams, which is quite challenging and undoubtedly can damage your thinking and brain, I actually used to take vitamins two days prior and during any OffSec exams. In that situation, vitamins was extremely useful for me to focus and avoiding sleepless affects.

After 48 hours of pain and fighting with binaries and 2 days of waiting for the “We are happy to inform you ….” Email, on 19th of October received it finally.

Special Gift (Basic Preparation Plan for OSED):

For those who are not currently planning to enroll in the course and would like to develop a foundational knowledge of binary exploitation and gain some skills, I would like to share the following plan I designed. However, you would install and configure your own lab environment, all you need to do is install Windows 10, WinDbg in addition to some vulnerable applications on a virtual machine and try to cover the recommendations below:

[embed]OSED Basic Preparation Plan

Be aware that the course itself covers more advanced topics, but I just intended to present the fundamentals here.

Questions & Answers:

I’d want to respond here to the questions that I’ve gotten on my LinkedIn account, which are listed below.

Should I have strong skills in C?

No, you only need to understand the function prototype and, perhaps, replicate the function call to see how it is represented in assembly.

Which course might be considered as a preparation for the OSED?

In my perspective, I think that for all OffSec courses you only need to place yourself on the Fireline. Just register for the course and get started. As I previously mentioned, before I began this course, I had only dealt with binaries in the OSCP exam (vanilla Buffer overflow).

How Does the exam look like?

In accordance with the OSED exam guide Three separate objectives relating to exploit development make up the OSED certification exam, However, you may expect what you will encounter on the exam from the course material.

How Difficult it is?

First off, I don’t think the exam time is suitable for the challenges, and secondly, there are many limitations that are unreasonable and unrealistic. This made the exam extremely difficult. additionally, I’m rating OffSec Exams by difficulty as follows (OSCP, OSEP, OSWE, OSED, OSEE).

Conclusion:

This course was absolutely worth the time and work put into it. I lacked knowledge of many low-level topics, like malwares, virtual machines, the Windows kernel and its APIs, and the ability to write my own shellcode from scratch on assembly level then utilize it in my engagements. all these low-level topics and more was covered after I finished it. Finally, I want to stress that while to be certified is not that necessary, but to be qualified is, and thanks to Offensive Security, you will receive both. while this certificate was the last one on the offensive security triangle, an hour later I finally received the OSCE3 congratulations email After waiting for it for 10 months.