Exploiting Blind Memory Corruption in Cloud Services
summary
A full exploit chain demonstrates remote code execution against a cloud backend: attackers craft malicious container images for GCP artifact-analysis, abuse a tar path‑traversal to write into proc/self/map_files ASLR oracle and only extract a SQLite DB when offsets match, trigger a 32‑bit multiplication bug in SQLite concat_ws overflow to corrupt an FTS3 module struct, spray a fake module on the Go heap, deploy a ROP chain and C2 implant in the image, and receive a backconnect from a production worker.
AI-written summary · about
chapters (10)
- 0:00Blind memory corruption intro
- 1:47Classical vs cloud targets
- 6:03Binary and load balancing challenges
- 10:57Case study: Artifact analysis service
- 13:05Path traversal in Excalibur unpacker
- 19:46Defeating ASLR with corruption
- 23:02SQLite concatWS corruption
- 35:41Exploit chain to RCE
- 36:46Conclusion and future work
- 38:11Q&A
related talks
47mReverse Engineering and Exploiting Builds in the Cloud
51mExploiting Hardware Glitches And Side Channels In Perfect Software
47mExploring the New World : Remote Exploitation of SQLite and Curl
01h 00mIntroduction to memory exploitation
55mHow hacking works
45mLive Hacking Cloud Architectures
24mThe Memory of a Meltdown
44mLive Hacking Cloud Architectures