Black Hat C

From Buffer Overflows to Rootkits: A Practitioner’s Guide to Offensive Security

Introduction

1. How to use this book
2. Ethical note

Chapter 1: The Attacker’s View of Memory and Execution

1. A Minimal Vulnerable Program
2. Process Layout: Text, Data, Heap, Stack
3. ELF Format and Why It Matters
4. x86/x64 Registers and the Call Stack
5. How a Function Call Really Works (Calling Conventions)
6. From Source to Assembly: Tracing One Example
7. Segmentation, Paging, and Virtual Memory
8. Defensive Note: Why You Must Know This

Chapter 2: Buffer Overflows: The Classic Weapon

1. Anatomy of a Stack Buffer Overflow
2. Controlling the Return Address
3. Finding the Offset: Fuzzing with Patterns
4. NOP Sleds and Shellcode Placement
5. A Complete Exploit Walkthrough (Linux, x86)
6. Return-to-libc: Exploitation Without Shellcode
7. Defensive Note: Stack Canaries, ASLR, and Hardening Trade-offs

Chapter 3: Format String Vulnerabilities

1. How printf Parses Its Arguments
2. Leaking the Stack with %x and %p
3. Overwriting Arbitrary Memory with %n
4. A Realistic Exploit Example
5. Chained Format String Attacks
6. Real-World Example: CVE-2024-29510 in Ghostscript
7. Defensive Note: Safe Formatting and Static Analysis

Chapter 4: Heap Exploitation and Use-After-Free

1. How the Heap Is Managed (ptmalloc / glibc Basics)
2. Off-by-One and Heap Overflows
3. Use-After-Free: The Concept
4. Exploiting UAF via Struct Overwrite
5. Fastbin Attacks: A Concrete Walkthrough
6. Defensive Note: Hardened Allocators and Sanitizers

Chapter 5: Shellcoding: Code That Runs Anywhere

1. Constraints of Shellcode (No Null Bytes, No Fixed Addresses)
2. Writing a Simple execve(“/bin/sh”) on Linux (x86)
3. Writing a Simple execve(“/bin/sh”) on Linux (x86_64)
4. Reverse TCP Shellcode: Connecting Back
5. Position-Independent Tricks (Self-Referencing RIP, Syscall Stubs)
6. Encoding and Decoding Payloads
7. Embedding Shellcode in C Exploits
8. Defensive Note: DEP/NX, CFG, and Sandboxing

Chapter 6: Bypassing Protections: ASLR, DEP, Canaries

1. ASLR: How It Works and Where It Leaks
2. Information Leaks via Pointers and CRT
3. ROP Chaining (Return-Oriented Programming)
4. Bypassing DEP with ROP
5. Defeating Stack Canaries (Leak + Reuse)
6. Defensive Note: Full Mitigation Stacks and SECCOMP

Chapter 7: Position-Independent Code and Exploit Engineering

1. Static vs Dynamic Linking
2. Position-Independent Executables (PIE)
3. GOT/PLT Overwrites as an Attack Vector
4. Leveraging libc Offsets in Exploits
5. Combining Leaks, ROP, and GOT Hijacking
6. Defensive Note: RELRO, BindsNow, and Full Hardening

Chapter 8: Anti-Analysis Techniques

1. Detecting Sandboxes and VMs (CPUID, Timing, Artifacts)
2. String Obfuscation and Encrypted Payloads
3. Packed Binaries and Custom Unpackers
4. Anti-Debugging Tricks (PTRACE, Timing, sysenter tricks)
5. Flow Obfuscation and Control Integrity
6. Defensive Note: Dynamic Analysis Strategies

Chapter 9: Rootkits: Hiding in the Kernel

1. Userland vs Kernel Rootkits
2. Inline Hooking System Calls (Linux Example)
3. Modifying the System Call Table (Conceptual)
4. Hiding Processes, Files, and Network Sockets
5. Driver-Based Persistence on Windows (Conceptual)
6. Defensive Note: Integrity Checking, eBPF, and PatchGuard

Chapter 10: Malware Development Patterns

1. Process Injection Techniques (CreateRemoteThread, APC Injection)
2. Reflective DLL Loading
3. Living Off the Land (LOLBins and Scripts)
4. Command and Control (C2) Channel Design
5. Fileless Persistence and Memory-Only Techniques
6. Defensive Note: EDR, Telemetry, and Behavioral Detection

Chapter 11: Putting It All Together: A Controlled Case Study

1. The Lab: Dockerized, Isolated Test Environment
2. Target Service with Multiple Flaws
3. Step-by-Step Exploit Development
4. Adding Evasion and Persistence Layers
5. Post-Exploitation View
6. Defensive Note: How a Hardened System Would Resist This

Chapter 12: Network Exploitation – Remote Code Execution via Services

1. The Remote Exploitation Problem
2. A Minimal Network Vulnerable Service
3. Crafting a Network Payload
4. Protocol-Specific Exploitation
5. Reliability and Reboot Resilience
6. Defensive Note: Securing Network Services

Chapter 13: Privilege Escalation – From User to Root/Admin

1. The Privilege Escalation Landscape
2. SUID Binaries and Privilege Escalation
3. Sudo Misconfigurations
4. Kernel Exploits and Dirty Pipe
5. Capability Abuse and Namespaces
6. Windows Privilege Escalation (Overview)
7. Defensive Note: Hardening Against Privilege Escalation

Chapter 14: Windows Exploitation Fundamentals

1. PE Format: Windows’ Answer to ELF
2. Structured Exception Handling (SEH) and Overwrites
3. Windows Stack Overflows and Shellcode
4. Windows Heap Exploitation
5. ROP on Windows
6. Windows Mitigations and Bypasses
7. Defensive Note: Hardening Windows Systems

Chapter 15: Fuzzing and Exploit Reliability – Making Exploits Work in the Wild

1. Fuzzing as a Vulnerability Discovery Tool
2. Exploit Reliability: The Gap Between Lab and Wild
3. pwntools and Automation
4. Defensive Note: Fuzzing in CI and Exploit Mitigation

Chapter 16: Container and Cloud Escapes

1. How Container Isolation Works (And Where It Is Fragile)
2. CVE-2022-0492: Cgroup Release Agent Privilege Escalation
3. Docker Socket Escapes and Privileged Containers
4. Kubernetes Pod Escapes
5. Cloud Metadata Service Abuses
6. Namespace and Seccomp Evasion Techniques
7. Defensive Note: Hardening Container Environments

Chapter 17: Advanced ROP and Code Reuse

1. Return-to-dl-resolve: Calling Functions Without Gadgets
2. ORW Chains: Open, Read, Write Without execve
3. JIT Spraying: Weaponizing Just-In-Time Compilation
4. Call-Oriented Programming (COOP)
5. Defensive Note: Hardening Against Code Reuse

Chapter 18: Sandbox Escape Techniques

1. Seccomp Filters: How They Work and How They Fail
2. Chrome Sandbox Escapes
3. Namespace and chroot Escapes
4. Real-World Sandbox Escape Examples
5. Defensive Note: Designing Robust Sandboxes

Chapter 19: eBPF Abuse for Post-Exploitation

1. What eBPF Is and Why It Matters
2. eBPF-Based Rootkit Capabilities
3. A Conceptual eBPF Rootkit Example
4. Detection and Defense Against eBPF Rootkits
5. Defensive Note: Using eBPF Responsibly

Conclusion

References