# Windows Exploitation

> Windows exploit development: stack overflows, SEH hijacking, egghunters, DEP and ASLR bypasses, and kernel pool exploitation.

- Source: https://stevenfoerster.com/tutorials/paths/windows-exploitation/

Learning Path

Exploit development on Windows, from classic stack overflows through SEH hijacking and egghunter techniques to DEP and ASLR bypasses, culminating in kernel pool exploitation.

7 available [Start the path](https://stevenfoerster.com/tutorials/windows-stack-buffer-overflow/)

1.  - 1
    - intermediate

    ## [Windows Stack Buffer Overflow](https://stevenfoerster.com/tutorials/windows-stack-buffer-overflow/)

    Exploit a classic stack buffer overflow on Windows, from crash discovery to shellcode execution using Immunity Debugger and mona.py.

2.  - 2
    - advanced

    ## [Windows SEH Overflow Exploitation](https://stevenfoerster.com/tutorials/windows-seh-overflow-exploitation/)

    Exploit Structured Exception Handler (SEH) overflows on Windows, bypassing SafeSEH protections to achieve code execution.

3.  - 3
    - advanced

    ## [Windows Egghunter Exploitation](https://stevenfoerster.com/tutorials/windows-egghunter-exploitation/)

    Use egghunter shellcode to locate and execute a larger payload when buffer space is limited.

4.  - 4
    - advanced

    ## [Bypassing DEP with ROP on Windows](https://stevenfoerster.com/tutorials/bypassing-dep-with-rop-on-windows/)

    Build a ROP chain on Windows to bypass Data Execution Prevention, using mona.py to find gadgets and VirtualProtect to mark shellcode executable.

5.  - 5
    - advanced

    ## [Bypassing ASLR on Windows](https://stevenfoerster.com/tutorials/bypassing-aslr-on-windows/)

    Defeat Windows ASLR with non-ASLR modules, partial pointer overwrites, and information leaks to build reliable exploits against randomized address spaces.

6.  - 6
    - advanced

    ## [Windows Kernel Pool Overflow Foundations with HEVD](https://stevenfoerster.com/tutorials/windows-kernel-exploitation-pool-overflow/)

    Trigger and analyze a pool buffer overflow in a vulnerable Windows kernel driver, groom the kernel pool, and map the privilege-escalation stage that follows.

7.  - 7
    - advanced

    ## [Windows CFG and Hardware-Enforced Stack Protection (CET)](https://stevenfoerster.com/tutorials/windows-cfg-and-cet-mitigations/)

    How Control Flow Guard validates indirect call targets, why it cripples JOP on Windows 8.1+, and how Win11 hardware shadow stacks layer on via Intel CET.


[All tutorials and learning paths](https://stevenfoerster.com/tutorials/)