DEF CON 26 - Sanat Sharma - House of Roman a Leakless Heap Fengshui to Achieve RCE on PIE Binaries
2,216 views · Published 22 October 2018 · 21:35 · Indexed 8 October 2026
Channel: DEFCONConference · 2018 · Science & Technology
Regarding ptmalloc2, many heap exploitation techniques have been invented in the recent years, well documented on the famous how2heap repository, or as writeups of famous CTF challenges (like House of Orange). However, most of them require atleast a libc/heap leak , or fail in non-PIE binaries. My new technique titled House of Roman leverages a single bug to gain shell leaklessly on a PIE enabled Binary. I shall showcase the ease of aligning the heap to perform this attack, thus demonstrating its versatility. Since this a 20 mins talk, attendees should be aware of basic heap exploitation techniques, like fastbin attacks and unsorted bin attacks, and have a general idea of how the ptmalloc2 algorithm works. As a bonus, I also discuss how to land a fastbin chunk in memory regions with no size alignment (like __free_hook ).
More from this channel
-
7:53
DEF CON 20 Documentary Bonus Clips - CDC muxed
-
3:45
DEF CON 20 Documentary Bonus Clips - Not the Same Anymore
-
2:09
DEF CON 20 Documentary Bonus Clips - A Top Qualitty Production
-
1:36
DEF CON 20 Documentary Bonus Clips - Creme Brulee
-
2:39
DEF CON 20 Documentary Bonus Clips - Barkode and Bloodkode
-
2:14
DEF CON 20 Documentary Bonus Clips - Bed Jumping Mafia
-
2:58
DEF CON 20 Documentary Bonus Clips - Service Hallways on Segway
-
47:43
DEF CON 20 - Raphael Mudge - Cortana: Rise of the Automated Red Team