Automatic Heap Layout Manipulation for Exploitation
summary
Automatic heap-layout tool SHRIKE targets PHP by extracting allocator-interacting fragments from 11,000 regression tests, fuzzing them, and stitching sequences using pseudo-random black-box search. On ~2,500 synthetic benchmarks the simple random search solves ~70% of cases (average ~10 minutes, 500k guesses ≈15 minutes); across nine runs 78% are solved at least once. Demonstration produces a full control-flow hijack on PHP (calculator pop) and supports exploit templates that leave heap holes for the solver.
AI-written summary · about
chapters (6)
- 0:00Manual exploit development
- 3:24Heap manipulation techniques
- 8:50Automating heap layout
- 12:20System design and evaluation
- 16:02Demo and conclusions
- 19:30Q&A session
related talks
37mHeap Layout Optimisation for Exploitation
42mContemporary Automatic Program Analysis
39mGreybox Automatic Exploit Generation for Heap Overflows
01h 00mIntroduction to memory exploitation
44mHands Off and Putting SLAB/SLUB Feng Shui in a Blackbox
35mDeep-Kernel Treasure Hunt: Finding exploitable structures in the Linux kernel
26mTowards Efficient Heap Overflow Discovery
26mFrom Finding New Type of Logical Flaw at Linux Kernel To Developing New Heap Exploitation Technique