OSEP - PEN-300 - Evasion Techniques and Breaching Defenses (Offensive Security)（Z-Library）

# OSEP - PEN-300 - Evasion Techniques and Breaching Defenses ## 【One-Line Pitch】 A hands-on offensive security course for penetration testers and red teamers who want to master advanced evasion techniques—bypassing antivirus, AMSI, and application whitelisting—to breach modern Windows defenses. If you're preparing for the OSEP certification or need practical, code-level evasion skills beyond basic Metasploit usage, this is your playbook. ## 【Book Arc】 - **Opening (~0%–10%)**: Course logistics, lab setup, and exam expectations; then a rapid dive into operating system and programming theory—covering Windows internals, Win32 APIs, and the fundamentals needed to write custom shellcode runners and droppers. - **Early (~10%–23%)**: Client-side attack vectors—HTML smuggling, phishing with Microsoft Office, VBA and PowerShell shellcode runners, and executing shellcode in Word memory; transitions into Windows Script Host with JScript droppers, C# integration via DotNetToJscript, and SharpShooter. - **Early (~23%–32%)**: Process injection and migration theory—finding a home for shellcode, implementing injection techniques in C#, and process hollowing; then the first major antivirus evasion module covering signature location, Metasploit encoders/encryptors, and C# shellcode runner hardening. - **Middle (~32%–42%)**: Behavioral evasion—sleep timers, non-emulated APIs, and Office-based AV bypasses; then a deep dive into AMSI (Antimalware Scan Interface) with Frida hooking, PowerShell reflection attacks, patching internals, and UAC bypasses like FodHelper. - **Middle (~42%–48%)**: Advanced AMSI bypasses in JScript, registry-based attacks, and self-executable techniques; then application whitelisting evasion—AppLocker bypasses via third-party execution, PowerShell Constrained Language Mode (CLM) bypasses, custom runspaces, and reflective injection. - **Late (~48%–100%)**: The excerpts thin out here, but the trajectory continues into more advanced evasion—likely covering additional whitelisting bypasses, defense-in-depth circumvention, and exam-focused synthesis of all techniques into real-world attack chains. ## 【Key Takeaways】 - **Client-side initial access is a multi-layered craft** (Early): HTML smuggling, VBA macros, and PowerShell runners are not just "phishing"—each requires careful API selection and in-memory execution to avoid static detection. The course teaches you to build these from scratch, not just use tools. - **JScript and C# are a powerful evasion combo** (Early): DotNetToJscript and SharpShooter show how to compile C# shellcode runners and load them via JScript, bypassing file-based detection by keeping payloads in memory and leveraging trusted script hosts. - **Process injection is about choosing the right home** (Early): Theory covers why certain processes (e.g., explorer.exe, svchost.exe) are better targets, and C# implementations of injection and hollowing give you control over every Win32 call—essential for tailoring to specific AV/EDR environments. - **AV evasion starts with understanding signatures** (Early): The course emphasizes simulating your target environment and locating exact signature triggers in files—not blind encoding. Metasploit encoders/encryptors are covered, but the real value is in custom C# encryption and behavioral tweaks like sleep timers and non-emulated APIs. - **AMSI is the modern battleground** (Middle): Bypassing AMSI in PowerShell via reflection, patching internals, or attacking initialization is a core skill. The course also covers Frida-based hooking to understand AMSI's API flow—knowledge that transfers to any scripting language. - **Application whitelisting requires creative execution paths** (Middle): AppLocker bypasses via PowerShell CLM, custom runspaces, and reflective injection show that whitelisting is not a silver bullet—attackers can abuse built-in Windows components to execute arbitrary code. - **Evasion is a mindset, not a toolset** (Throughout): Every module reinforces the need to understand *why* a technique works (API calls, memory layouts, policy gaps) so you can adapt when defenses change. The exercises push you to modify and extend code, not just copy-paste. ## 【Reading Tips】 - **Deep-read the code-heavy chapters** (Chapters 3–5): The VBA, PowerShell, C#, and JScript shellcode runners are the foundation. Don't skim—type out the code, compile it, and run it in your lab to internalize the Win32 API patterns. - **Skim the course logistics** (Chapter 1): The lab setup and exam rules are important for OSEP candidates, but if you're here for the techniques, jump straight to Chapter 2 and return later. - **Treat exercises as mandatory, not optional**: Each "Exercise" and "Extra Mile" section is designed to force you to debug and extend the techniques. Skipping them will leave you with shallow knowledge that won't survive real-world AV/EDR encounters. - **Hard spot—AMSI internals (Chapter 7)**: The reflection and patching sections are dense. Read them twice, and use Frida or a debugger to trace AMSI calls yourself—this is where most students get stuck, but it's also where the highest-value skills live. - **Takeaway for practice**: Build a personal "evasion toolkit" as you go—a collection of your own shellcode runners, injection scripts, and AMSI bypasses. This becomes your exam cheat sheet and professional reference. ## 【Coverage Limits】 The excerpts cover roughly the first half of the book (through AppLocker bypasses). Later modules—likely including advanced EDR evasion, tunneling, and full attack chain synthesis—are not represented in this guide, so treat the final arc as inferred from the course's known structure. ##