DEPA: Determining Exploit Primitives Automatically for Interactive Programs

Liu, Jie; Hang, An,; Li, Jin; Liang, Hongliang

doi:10.1145/3573428.3573550

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2023

2024

Publication Types

Select...

Book1

Article1

Relationship

Self Cite0

Independent2

Authors

Journals

Cited by 2 publications

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

CtxFuzz: Discovering Heap-Based Memory Vulnerabilities Through Context Heap Operation Sequence Guided Fuzzing

Jiang,

Wen,

Qin

2024

Theoretical Aspects of Software Engineering

View full text Add to dashboard Cite

CtxFuzz: Discovering Heap-Based Memory Vulnerabilities Through Context Heap Operation Sequence Guided Fuzzing

Jiang,

Wen,

Qin

2024

Theoretical Aspects of Software Engineering

View full text Add to dashboard Cite

AAHEG: Automatic Advanced Heap Exploit Generation Based on Abstract Syntax Tree

Wang,

Zhang,

2023

Symmetry

View full text Add to dashboard Cite

Automatic Exploit Generation (AEG) involves automatically discovering paths in a program that trigger vulnerabilities, thereby generating exploits. While there is considerable research on heap-related vulnerability detection, such as detecting Heap Overflow and Use After Free (UAF) vulnerabilities, among contemporary heap-automated exploit techniques, only certain automated exploit techniques can hijack program control flow to the shellcode. An important limitation of this approach is that it cannot effectively bypass Linux’s protection mechanisms. To solve this problem, we introduced Automatic Advanced Heap Exploit Generation (AAHEG). It first applies symbolic execution to analyze heap-related primitives in files and then detects potential heap-related vulnerabilities without a source code. After identifying these vulnerabilities, AAHEG builds an exploit abstract syntax tree (AST) to identify one or more successful exploit strategies, such as fast bin attack and Safe-unlink. AAHEG then selects exploitable methods via an abstract syntax tree (AST) and performs final testing to produce the final exploit. AAHEG chose to generate advanced heap-related exploits because the exploits can bypass Linux protections. Basically, AAHEG can automatically detect heap-related vulnerabilities in binaries without source code, build an exploit AST, choose from a variety of advanced heap exploit methods, bypass all Linux protection mechanisms, and generate final file-form exploit based on pwntools which can pass local and remote testing. Experimental results show that AAHEG successfully completed vulnerability detection and exploit generation for 20 Capture The Flag (CTF) binary files, 11 of which have all protection mechanisms enabled.

show abstract

DEPA: Determining Exploit Primitives Automatically for Interactive Programs

Cited by 2 publications

References 3 publications

CtxFuzz: Discovering Heap-Based Memory Vulnerabilities Through Context Heap Operation Sequence Guided Fuzzing

CtxFuzz: Discovering Heap-Based Memory Vulnerabilities Through Context Heap Operation Sequence Guided Fuzzing

AAHEG: Automatic Advanced Heap Exploit Generation Based on Abstract Syntax Tree

Contact Info

Product

Resources

About