Exploiting Adobe Flash Player In The Era Of Control Flow Guard
summary
Shows a concrete CFG bypass via JIT codegen that locates a method pointer at bytearray->vtable+0xD4 and turns an unguarded JIT indirect call into a ROP start; Adobe patches (June 2015) close that vector. Demonstrates three working data-only exploits: flip the camera flag at 0x49 to enable camera/mic, overwrite the sandbox dword at offset 4 to escalate to local trusted and read files, and swap a vtable entry to call WinExec-like API to run commands without shellcode.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:38Agenda
- 1:46Overview of CFG
- 5:00CVE-2015-0311 Overview
- 9:26Control flow hijacking attempt detected!
- 10:12Approaches
- 12:00Flash JIT compiler
- 12:46Leveraging the JIT compiler to bypass CFG
- 18:37Current status
- 21:14JIT hardening
- 27:13Data-only attacks: related work
- 28:22The Security Settings object
- 30:44Gaining (unauthorized) access to the camera & mic
- 36:46From Remote sandbox to Local Trusted sandbox
- 43:23Executing commands without shellcode nor ROP
- 47:20Crafted state
- 51:21Thank you!
related talks
47mThe Art of Reverse Engineering Flash Exploits
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
51mWindows 10 Mitigation Improvements
55mHow hacking works
51mExploiting Hardware Glitches And Side Channels In Perfect Software
51mSneaking Past Device Guard
37mAbusing Adobe Reader’s JavaScript APIs
36m"Playing in the Sandbox: Adobe Flash Exploitation Tales"