Exploit-oriented Automated Information Leakage |
| |
Authors: | Songtao Yang Kaixiang Chen Zhun Wang Chao Zhang |
| |
Affiliation: | Department of Computer Science and Technology, Tsinghua University, Beijing 100084, China;Institute for Network Sciences and Cyberspace, Tsinghua University, Beijing 100084, China |
| |
Abstract: | Automatic Exploit Generation (AEG) has become one of the most important ways to demonstrate the exploitability of vulnerabilities. However, state-of-the-art AEG solutions in general assume the target system has no mitigations deployed, which is not true in modern operating systems since they often deploy mitigations like Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR). This paper presents the automatic solution EoLeak that can exploit heap vulnerabilities to leak sensitive data and bypass ASLR and DEP at the same time. At a high level, EoLeak analyzes the program execution trace of the Proof-Of-Concept (POC) input that triggers the heap vulnerabilities, characterizes the memory profile from the trace, locates sensitive data (e.g., code pointers), constructs leakage primitives that disclose sensitive data, and generates exploits for the entire process when possible. We have implemented a prototype of EoLeak and evaluated it on a set of Capture The Flag (CTF) binary programs and several real-world applications. Evaluation results reveal that EoLeak is effective at leaking data and generating exploits. |
| |
Keywords: | information leakage automatic exploit generation dynamic analysis taint analysis memory profiling |
|
| 点击此处可从《International Journal of Software and Informatics》浏览原始摘要信息 |
|
点击此处可从《International Journal of Software and Informatics》下载免费的PDF全文 |
|