Novel Exploitation Tactics in Linux Userspace One Byte OOB Write to ROP Chain

The talk starts from "houses," reusable exploitation patterns that turn heap bugs into code execution through glibc internals. The speaker argues that the runtime loader, rtld, has been less explored than malloc or stdio. Looking at the exit path, the speaker finds that thread destructors and exit handlers are protected by pointer mangling, so a weak bug cannot easily hijack them. Attention then moves to the dynamic loader's finalizer handling, which offers a different route.

Using that surface, the talk walks through a chain of techniques built for a CTF challenge. The target offered a single-byte out-of-bounds write, no output channel, no leak, a seccomp sandbox, and no brute force. The first step uses a link map field to keep the program looping, which turns the write into infinite writes. Next, a forged dynamic section lets the loader resolve and call arbitrary library functions without knowing the base address. A final construction uses the loader's symbol resolution to write chosen pointers to chosen locations, which is enough to assemble a ROP chain.

The main takeaway is that offsets are more useful than absolute addresses when no leak exists, because the loader works in relative terms. The Q&A made clear that statically linked binaries and full RELRO remove the lazy resolution this relies on, while partial RELRO leaves it exposed. The speaker pointed to a written write-up and slides for the detailed mechanics.