Lab 1.2: Exploit protection

🥷 Hacker scenario

A business app on SEA-SVR1 has a bug. The vendor hasn't released a patch yet. The attacker sends specially crafted input that is much longer than the app expects. It spills over into memory where it doesn't belong, and suddenly the server is running the attacker's code. That spill-over has a name: a buffer overflow. How does it work, and how can Windows stop it? Let's see.

📖 Concepts

Programs have bugs. Some bugs let an attacker write data into memory where it doesn't belong, and then trick the CPU into running it. That's called a buffer overflow.

Exploit protection makes this much harder with a few memory tricks:

• DEP (Data Execution Prevention): memory that holds data cannot run as code.
• ASLR (Address Space Layout Randomization): Windows shuffles where things live in memory, every time.
• CFG (Control Flow Guard): a program may only jump to places it is supposed to jump to.

Think of ASLR like a hotel that changes your room number every night. The burglar knows you're in the building, but which door?

🛡️ How this stops the attacker

ASLR moves the memory around, so the attacker doesn't know where to jump. DEP refuses to run code from a data area. Instead of running the attacker's code, the app crashes. A crash is annoying. A compromise is a disaster.

🧪 Step by step

1. On SEA-SVR1, open Windows Security > App & browser control > Exploit protection settings.
2. On System settings, check that DEP, Force randomization for images (Mandatory ASLR), Bottom-up ASLR and CFG are configured.
3. Click Program settings > Add program to customize > Add by program name and type notepad.exe. Turn on Arbitrary code guard (ACG).
4. Click Export settings and save the file to a share, for example \\SEA-DC1\Policies$\ExploitProtection.xml.

⚠️ Added by this repository: the course does not create this share. Create it once on SEA-DC1 (see lab setup), so that the servers (computer accounts) can read the file. 5. On SEA-DC1, edit a GPO linked to the servers OU: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Exploit Guard > Exploit Protection > Use a common set of exploit protection settings. Enable it and type the UNC path.

Now let's verify on SEA-SVR1:

gpupdate /force
Get-ProcessMitigation -Name notepad.exe

Scroll through the output. Under DynamicCode you'll see BlockDynamicCode: ON. That's our ACG setting, pushed by Group Policy.

✅ Key takeaway

Patches always arrive late. Exploit protection buys you time. Even an unpatched bug becomes very hard to turn into a working attack.