Demonstrating binary exploitation
summary
Demonstrates a real heap overflow in sudoedit (based on Qualys’ report) by overflowing user_args with backslashes to force null bytes, then uses heap feng shui via environment variables and crafts a libnss-style name so dlopen loads a malicious .so whose constructor calls setuid(0) and spawns a root shell. Uses glibc malloc behavior, works reproducibly on Ubuntu 20.04 in a Docker demo, and recommends ASan and fuzzing for prevention.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:30About us
- 2:27Agenda
- 3:28What is binary exploitation
- 4:52Memory safety
- 7:39Statistics
- 9:13Questions
- 9:31Stack
- 17:49Dynamic Memory Allocation
- 19:02Heap Allocation
- 19:57Chunks
- 20:49Happy Pass
- 23:58What is this bug
- 25:49The code
- 29:12How it works
- 30:10Summary
- 30:44Stack Overflows
- 33:27What to target
- 39:32Library
- 40:21Demo
- 47:32Safety analogy
- 55:43Question
related talks
01h 00mDemonstrating Binary Exploitation
22mDemostrating Binary Exploitation
55mHow hacking works
51mThe Anatomy of an Exploit
01h 00m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (1 of 2)”
57mThe Anatomy of an Exploit
01h 06mHow hacking works
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019