Automatic Exploitation of Fully Randomized Executables
Author(s)
Gadient, Austin
Ortiz, Baltazar
Barrato, Ricardo
Davis, Eli
Perkins, Jeff
Rinard, Martin
Date Issued
June 11, 2019
Abstract
We present Marten, a new end to end system for automatically discovering, exploiting, and combining information leakage and buffer overflow vulnerabilities to derandomize and exploit remote, fully randomized processes. Results from two case studies high- light Marten’s ability to generate short, robust ROP chain exploits that bypass address space layout randomization and other modern defenses to download and execute injected code selected by an attacker.
Description
We present an automated system, Marten, that automatically generates control flow hijacking exploits against fully randomized executables by combining information leakage and buffer overflow exploits.
Subjects
exploit
Symbolic Execution
taint analysis
information leakage
Terms of Use
Attribution-NonCommercial-NoDerivs 3.0 United States
Persistent DSpace Link
