For the purpose of learning about the complexities involved in writing PoC's (and gaining experience in) one could do patch diffing and have real world vulnerable examples to practice on. For now please disregard the idea of making your own vulnerable programs.
For patch diffing I see 3 states an OS can be in, let's take windows 7 as example:
- Plain state (no service packs, no patches)
- Partially patched (not updated to the latest released patches)
- Fully patched
Scenario
- My vmware/vbox system is in state 3 (fully patched).
- Next I go to the Microsoft Security Bulletin and pick a vulnerability (e.g. kernel).
- Now I want to revert to a useful state...
Although it will likely work on the plain state(1), the diff results will be bigger/harder to spot the issue. Secondly, the bug to the latest vulnerability could have been introduced by a previous patch/service pack.
Therefore, how does one go from OS state 3 to state 2, where state 2 is a system patched up to just before the new patch that resolves the issue? Or if more convenient, from state 1 to state 2.
update
I realize my question isn't as clear as I thought it was in my head, hopefully this clarifies a bit
I'm aware of the snapshot features of vmware/vbox but that is not what I'm looking for. What I'm actually aiming for is
- How to get the old versions of the changed binaries?
- How to know to which version to revert? Is there some naming scheme in the files?
Example:
- My system is fully up to date.
- I find a KB-XXXXX at the Security bulletin, extract it and it gives me an updated .dll named abc_005.dll
- Now I want to put my system in a state that I get the previous (vulnerable) version of the dll (e.g. abc_004.dll). <- How would I do this part?