Abstract:Capture-the-flag (CTF) competitions have become highly successful in security education, and heap corruption is considered one of the most difficult and rewarding challenges due to its complexity and real-world impact. However, developing a heap exploit is a challenging task that often requires significant human involvement to manipulate memory layouts and bypass security checks. To facilitate the exploitation of heap corruption, existing solutions develop automated systems that rely on manually crafted patterns to generate exploits. Such manual patterns tend to be specific, which limits their flexibility to cope with the evolving exploit techniques. To address this limitation, we explore the problem of the automatic summarization of exploit patterns. We leverage an observation that public attack artifacts provide key insights into heap exploits. Based upon this observation, we develop AutoPwn, the first artifact-assisted AEG system that automatically summarizes exploit patterns from artifacts of known heap exploits and uses them to guide the exploitation of new programs. Considering the diversity of programs and exploits, we propose to use a novel Exploitation State Machine (ESM), with generic states and transitions to model the exploit patterns, and then efficiently construct it through combining the dynamic monitoring of exploits and the semantic analysis of their text descriptions. We implement a prototype of AutoPwn and evaluate it on 96 testing CTF binaries. The results show that AutoPwn produces 22 successful exploits and 13 partial exploits, preliminarily demonstrating its efficacy.

Xede: Practical Exploit Early Detection

AutoPwn: Artifact-Assisted Heap Exploit Generation for CTF PWN Competitions

AutoExploit: Automatic Exploit Generation with Security Mitigation

deExploit: Identifying misuses of input data to diagnose memory-corruption exploits at the binary level.

Executable Based Vulnerability Detection

AEMB: an Automated Exploit Mitigation Bypassing Solution

Accurate and Efficient Exploit Capture and Classification

Detecting Exploit Primitives Automatically for Heap Vulnerabilities on Binary Programs

Shellix: an Efficient Approach for Shellcode Detection

Dynamical System Theory for the Detection of Anomalous Behavior in Computer Programs

A Vulnerability Exploits Detection Method Based on Binary Program Behavior Analysis

Pbaeg: Combine-Vulnerabilities Aeg to Defeat Protection Mechanisms

Automated Crash Analysis and Exploit Generation with Extendable Exploit Model

DEPA: Determining Exploit Primitives Automatically for Interactive Programs

Dynamic Analysis and Debugging of Binary Code for Security Applications

XHunter: Understanding XXE Vulnerability via Automatic Analysis

Automated Vulnerability Detection in Embedded Devices.

A Vulnerability Automation Exploitation Method Based on Symbolic Execution

ROPocop - Dynamic Mitigation of Code-Reuse Attacks

A Hybrid Dynamic Testing technology source code XSS vulnerability detection method

Dynamic Detection of Unknown Malicious Executables Base on API Interception