Greybox Automatic Exploit Generation for Heap Overflows
summary
Presents a grey-box system for automatic exploit generation specifically targeting heap overflows, focusing on handling heap layout reasoning separately from other exploit tasks. Explains using dynamic analysis and learning from existing inputs as an alternative to traditional costly white-box program analysis techniques.
AI-written summary · about
chapters (28)
- 0:00Intro
- 0:39Why care about exploiting interpreters?
- 4:54Exploiting a Heap Overflow - Object Creation
- 6:58Exploiting a Heap Overflow - Layout Manipuation
- 7:31Exploiting a Heap Overflow - Corruption
- 10:49Unique Challenges for AEG in Interpreters
- 14:55Gollum - Greybox, Modular AEG for Interpreters
- 15:21Vulnerability Representation
- 16:11Sample Code?
- 17:13Starting Tests
- 18:19New Input Generation
- 19:10Original Test
- 19:22Injection #1
- 20:19Layout Exploration
- 21:46Lazy Resolution of Heap Layouts
- 22:43Shape Shifter
- 23:33Primitive Detection
- 25:08Crash Dumps
- 25:30Blackbox I/O Relationship Discovery
- 26:55Candidate Primitive Database
- 27:34Automatic Exploit Generation
- 29:10One-Gadget Payload Insertion
- 31:48High Level Algorithm
- 32:06Heap Layout Manipulation in Gollum
- 32:35Final Exploit
- 32:52Evaluation
- 35:36Key Points
- 37:09Open Problems (Closely Related)
related talks
37mHeap Layout Optimisation for Exploitation
21mAutomatic Heap Layout Manipulation for Exploitation
01h 00mIntroduction to memory exploitation
51mThe Anatomy of an Exploit
26mTowards Efficient Heap Overflow Discovery
20mAutomated Exploit Generation for Node.js Packages
50mBuffer Overflow Demystified
37mHouse of Einherjar — Yet Another Heap Exploitation Technique on GLIBC