Demonstrating Binary Exploitation

on YouTube ↗01h 00m

" summary

Live reproduction of a real sudo vulnerability shows a heap overflow triggered by a trailing backslash in a command line argument that copies into a heap buffer from controllable environment data. The exploit uses fuzzing + heap feng shui to force a service_user struct overwrite, sets a library pointer to NULL and supplies a crafted lib nss_x/x.so.2 with a dlopen constructor that sets UID/GID to 0, and the exploit reliably yields a root shell for that sudo version.

AI-written summary · about

" chapters (23)

1. 0:00Intro
2. 0:23Meet Marit Christian
3. 2:09Introduction
4. 8:50Stack Overflow
5. 9:25The Stack
6. 17:31Questions
7. 17:51Stack growth
8. 19:23Memory Allocation
9. 20:47Code snippet
10. 21:47Heap explanation
11. 22:31Running the program
12. 24:47Summary
13. 25:37Example
14. 27:52Code
15. 32:44In Memory
16. 33:42Summary of vulnerability
17. 34:33What is stored in memory
18. 36:20Recontrol overflow size
19. 43:10Shared library code
20. 44:00Running the exploit
21. 51:02Behind the scenes
22. 51:43Safety analogy
23. 54:37Question

" related talks

• 58mDemonstrating binary exploitationChristian Resell, Marit Iren Rognli Tokle · NDC TechTown 2021
• 22mDemostrating Binary ExploitationChristian Resell, Marit Iren Rognli Tokle · NDC Security 2022
• 51mThe Anatomy of an ExploitPatricia Aas · ACCU 2019
• 57mThe Anatomy of an ExploitPatricia Aas · NDC TechTown 2019
• 55mHow hacking worksEspen Sande-Larsen · NDC Security 2023
• 44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019Tong Lin, Luhai Chen · Linux Security Summit Europe 2019
• 43mThe Hidden Dangers of SudoMaciej Klesiewicz · DevDays || DevOps Pro || CyberWiseCon Europe 2025
• 01h 00mIntroduction to memory exploitationPatricia Aas · Meeting C++ 2021