Abstract:Capture-the-flag (CTF) competitions have become highly successful in security education, and heap corruption is considered one of the most difficult and rewarding challenges due to its complexity and real-world impact. However, developing a heap exploit is a challenging task that often requires significant human involvement to manipulate memory layouts and bypass security checks. To facilitate the exploitation of heap corruption, existing solutions develop automated systems that rely on manually crafted patterns to generate exploits. Such manual patterns tend to be specific, which limits their flexibility to cope with the evolving exploit techniques. To address this limitation, we explore the problem of the automatic summarization of exploit patterns. We leverage an observation that public attack artifacts provide key insights into heap exploits. Based upon this observation, we develop AutoPwn, the first artifact-assisted AEG system that automatically summarizes exploit patterns from artifacts of known heap exploits and uses them to guide the exploitation of new programs. Considering the diversity of programs and exploits, we propose to use a novel Exploitation State Machine (ESM), with generic states and transitions to model the exploit patterns, and then efficiently construct it through combining the dynamic monitoring of exploits and the semantic analysis of their text descriptions. We implement a prototype of AutoPwn and evaluate it on 96 testing CTF binaries. The results show that AutoPwn produces 22 successful exploits and 13 partial exploits, preliminarily demonstrating its efficacy.

deExploit: Identifying misuses of input data to diagnose memory-corruption exploits at the binary level.

Reversing and Identifying Overwritten Data Structures for Memory-Corruption Exploit Diagnosis

Memory corruption exploit diagnosis based on field integrity

Identifying exploitable memory objects for out‐of‐bound write vulnerabilities

AutoPwn: Artifact-Assisted Heap Exploit Generation for CTF PWN Competitions

Capturing Invalid Input Manipulations for Memory Corruption Diagnosis

An Effective Taint‐based Software Vulnerability Miner

Xede: Practical Exploit Early Detection

Revery

Automated Use-After-Free Detection and Exploit Mitigation: How Far Have We Gone

Accurate and Efficient Exploit Capture and Classification

Exploit-oriented Automated Information Leakage

Revery: From Proof-Of-Concept To Exploitable (One Step Towards Automatic Exploit Generation)

Detection, exploitation and mitigation of memory errors

Detecting Exploit Primitives Automatically for Heap Vulnerabilities on Binary Programs

AutoExploit: Automatic Exploit Generation with Security Mitigation

Learning Fine-Grained Structured Input for Memory Corruption Detection

Evolution of Exploitation and Exploit Mitigation

Early Detection of In-Memory Malicious Activity based on Run-time Environmental Features

DEPA: Determining Exploit Primitives Automatically for Interactive Programs

MEI: A Light Weight Memory Error Injection Tool for Validating Online Memory Testers