OSEE - Part 1 - Setting up Debugging Environment

Introduction

After conquering the OSCE3 certification, I’m now setting my sights on the final piece of my journey: the OSEE certification. In tandem with my preparations for Offensive Security’s Advanced Windows Exploitation course, I’ve begun exploring the fascinating realm of Windows kernel exploitation. Recently, I’ve deepened my skills in kernel debugging and familiarized myself with the fundamentals of exploiting vulnerable Windows drivers.

In this blog series, I’ll be dissecting the HackSysExtreme Vulnerable Driver (HEVD), a deliberately flawed driver crafted to mimic real-world vulnerabilities. HEVD not only provides a controlled environment to study advanced exploitation techniques, but it also illustrates how seemingly simple bugs can lead to significant security insights. Throughout this series, I aim to share a clear, methodical exploration of these techniques—highlighting the practical aspects of exploit development while keeping the inherent challenges in perspective.

Remote Debugging Layout

Establishing a robust kernel debugging environment involves setting up two distinct systems: one acting as the Debugger and the other as the Debuggee. In this case, I opted to install Windows 11 on both systems to take advantage of its modern architecture and enhanced security features while still providing a realistic test bed for advanced debugging techniques.

On the Debugger system, I utilize specialized tools like WinDbg or KD, which are designed to interact seamlessly with Windows 11’s kernel. These tools allow for real-time analysis, enabling a deep dive into system behavior and vulnerabilities. By leveraging Windows 11’s updated debugging interfaces and enhanced symbol support, it becomes easier to trace and analyze kernel-level operations, a critical step in understanding how exploits like those targeting the HackSysExtreme Vulnerable Driver function.

The Debuggee system, running Windows 11 as well, is configured to run in a special debugging mode. This involves enabling kernel debugging—typically through commands such as bcdedit /debug on—to allow the Debugger to attach remotely via network or a serial connection. This dual-setup not only mirrors real-world environments but also ensures a controlled and isolated space to safely experiment with exploit development. The consistency in operating system versions across both machines reduces potential compatibility issues and provides a stable platform for thorough kernel analysis.

By employing this setup, the debugging process becomes more streamlined, allowing for focused exploration of the intricate details within the Windows kernel.

Analysis & Debugging Tools

When it comes to kernel exploitation, having the right set of tools is paramount. My approach integrates three essential components:

• IDA Free
  Developed by Hex-Rays, IDA Free serves as a powerful disassembler for static binary analysis. It allows for an in-depth look into the driver’s inner workings, helping to identify potential vulnerabilities and understand the execution flow. IDA Free

• WinDbg (Legacy Version)
  For dynamic analysis, I rely on the stable, legacy version of WinDbg rather than the preview. This version offers a reliable and consistent debugging environment tailored for Windows kernel investigations. Its proven compatibility with Windows 11 makes it an excellent choice for real-time debugging sessions.

• Drivstaller
  This open-source tool is designed to streamline the process of managing and installing drivers on the test system. Drivstaller simplifies loading both custom and vulnerable drivers, making it easier to set up and validate various exploitation scenarios. Drivstaller

Each of these tools contributes a unique capability to the exploitation workflow—IDA Free for static code analysis, WinDbg for dynamic kernel debugging, and Drivstaller for efficient driver management—forming a robust toolkit to support my journey toward mastering advanced Windows exploitation techniques.

VMware Workstation Setup for Kernel Debugging

Leveraging VMware Workstation provides a versatile platform for establishing a dedicated kernel debugging environment. Below is a detailed guide to configure two virtual machines—one as the Debugger and one as the Debuggee—running Windows 11.

1. VM Creation and OS Installation

• Create Two VMs:
  • Debugger VM: Runs your debugging tools (e.g., WinDbg).
  • Debuggee VM: Hosts the target environment with the vulnerable driver for testing.
• Operating System:
  • Install Windows 11 on both VMs to ensure compatibility and consistency.

2. System Resources and Configuration

• Memory & CPU:
  • Allocate at least 8GB of RAM and 2 CPU cores per VM for smooth operation. More resources can further enhance performance.
• Storage:
  • A minimum of 50GB per VM is recommended.
• Snapshots:
  • Take a snapshot after the OS installation. This allows you to quickly revert to a clean state in case of misconfigurations or system issues.

3. Networking Setup

• Network Adapter Configuration:
  • Configure each VM with two network interfaces if necessary:
    • Primary Interface: Set to NAT or Bridged mode for internet connectivity (if needed).
    • Secondary Interface: Configure as a Host-Only or Custom VMnet network dedicated solely for debugger–debuggee communication.
• Static IP Addresses:
  • Assign static IPs on the dedicated network to maintain a stable connection:
    • Debugger VM: 192.168.50.1
    • Debuggee VM: 192.168.50.2
• Kernel Debugging over Network (KDNET):
  • Enable kernel debugging on the Debuggee by running:

    bcdedit /debug on
    bcdedit /dbgsettings net hostip:192.168.50.1 port:50000
    

  • Ensure firewall settings permit communication on the chosen port.

4. Additional Configurations

• Serial Port (Optional):
  • If you prefer using a serial debugging interface, add a virtual serial port connected via a named pipe.
• Driver Testing Preparation:
  • Configure the Debuggee VM for driver testing by disabling unnecessary security services or enabling test signing mode if required.
• VMware Tools:
  • Install VMware Tools in both VMs for improved performance and integration.
• OS Consistency:
  • Make sure both VMs run the same version and build of Windows 11 to avoid compatibility issues during debugging.

This configuration offers a robust and isolated environment for kernel debugging and exploitation experiments. By creating a dedicated network channel and optimizing VM resources, you can seamlessly transition between static analysis and dynamic debugging, paving the way for efficient vulnerability testing and learning.