Heap Exploitation Heap Primitives malloc free calloc - PowerPoint PPT Presentation

Heap Exploitation

Heap Primitives • malloc • free • calloc

Organization of chunks • Bins • Fast • Singly linked list • 16, 24, 32, 40, 48, 56, 64, 72, 80 and 88 bytes • Small • Doubly linked list • 16, 24, ... , 504 bytes • Large • Doubly linked lists • Different sizes • Sorted in decreasing order • Unsorted

Overview of Algorithms for malloc and free • Malloc • Free

Examples of exploits • LIFO Experiment • Use after free • Unlink

FIFO Experiment

Example of UAF Heap exploit Indian Institute of Science 11

Example of UAF Heap exploit Indian Institute of Science 12

Example of UAF Heap exploit Indian Institute of Science 13

Example of UAF Heap exploit Indian Institute of Science 14

Example of UAF Heap exploit Indian Institute of Science 15

Example of UnLink Exploit

Example of UnLink Exploit

Current Research: Attackers Perspective • Automatic manipulation • Dynamic and static analysis • Understanding allocators • Chunk placement • Manual Exploitation: Exploit writing