Toward Automatic Heap Exploit Generation by Using Heap Layout Constraints on Binary Programs

Automatic exploit generation (AEG) is widely recognized as one of the most effective methods for assessing the risk level of vulnerabilities. To exploit heap-related vulnerabilities, it is necessary to precisely form a desired heap layout and construct an effective payload. However, prior AEG solutions are inefficient in analyzing heap operation traces for manipulating heap layout in a program, and often fail to consider how to precisely construct payloads that align with the structure of vulnerable objects, which ultimately results in the failure to exploit vulnerabilities.In this paper, we propose HEXP, a novel system that can generate working exploit samples that can result in exploitable states on binaries. Given a binary program and a PoC (proof-of-concept) input, HEXP first extracts heap operation traces and then determines their semantics, e.g., the size of each heap allocation. Subsequently, HEXP executes the program with the PoC to infer the target heap layout and analyzes the member types of the vulnerable object. As a result, HEXP inserts suitable heap operation traces into the PoC’s execution trace to synthesize a target trace and constructs corresponding data constraints, whose execution leads to the target heap layout. Finally HEXP generates exploit samples by symbolically executing the target trace while applying these data constraints. We evaluated HEXP against 18 CTF (Capture-the-Flag) programs and 12 real-world binary programs with 19 known CVEs. The results highlight that: 1) HEXP surpasses MAZE in accurately and efficiently identifying heap operation traces; 2) HEXP infers correct target heap layouts and generates exploit samples for 16 CTF programs, outperforming Revery by 7 programs; and 3) HEXP successfully achieves the target heap layouts for 16 out of 19 CVEs in real-world binaries.