Use After Free Exploitation
summary
Defines a Use-After-Free as a prematurely freed C++ object and shows how to find and confirm one with IDA Pro, Bindiff, GFlags/PageHeap and a postmortem debugger, then weaponizes it against IE8/10 by replacing freed objects via heap spray and DOM/property sprays. Demonstrates ROP stack-pivoting, ASLR bypass via a memory leak from Flash ActionScript, and shellcode that opens port 4444 and spawns calc.exe. Claims typical exploit values of $10–$25k up to six figures; mitigations discussed but shown bypassable.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:12Use After Free
- 3:06Virtual Function Behavior & UAF (2)
- 6:57Replacing a Deleted Object
- 8:37Common Exploitation Technique (1)
- 12:34Overall Exploitation Steps
- 19:18GFLAGS - Global Flags Editor
- 34:13ASLR Bypass through Pointer Leaks
- 35:10ASLR Bypass Example
- 36:23CVE 2014-0322
- 37:03ASLR Bypass with ActionScript
- 38:25Demonstration
related talks
36mUnderstanding & explaining Use-After-Free vulnerability, a critical security flaw
01h 00mIntroduction to memory exploitation
52mA New CVE-2015-0057 Exploit Technology
51mThe Anatomy of an Exploit
58mExploiting Adobe Flash Player In The Era Of Control Flow Guard
57mThe Anatomy of an Exploit
51mWindows 10 Mitigation Improvements
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways