Heap BINARY EXPLOITATION w/ Matt E!

แชร์
ฝัง
  • เผยแพร่เมื่อ 28 ส.ค. 2024

ความคิดเห็น • 28

  • @user-ts8dq7yv4p
    @user-ts8dq7yv4p ปีที่แล้ว +5

    Heres an analogy that helped me wrap my head around the concept of tcache.. So a construction worker rents a bunch of tools from a tool rental company. These tools come from the warehouse, which is down the street from the storefront. When the construction worker finishes with the tools, he brings them back to the store. Realizing that the tools are popular, the store worker puts the tools on a shelf in the store, instead of sending them back to the warehouse. That way they are easier to get for the next customer.
    The tools represent the blocks of memory, the tool rental company's warehouse represents the main memory, and the storefront represents the Tcache. When the tools (memory blocks) are returned (freed), instead of being sent back to the warehouse (main memory), they are kept at the storefront (Tcache) for faster access in future.
    So just like how it's more convenient and faster for the next construction worker (program or thread) to get the tools (memory blocks) from the storefront (Tcache) than from the warehouse (main memory), it's also more efficient for a program or thread to get memory blocks from the Tcache than from the main memory.

  • @Sam-wl7vn
    @Sam-wl7vn 2 ปีที่แล้ว +15

    When you stop Matt to ask for Ghidra keybindings and explanations, that is super useful. Definitely doing the right thing there 🙂

  • @DamianRyse
    @DamianRyse 2 ปีที่แล้ว +5

    3 days ago, I tried to solve that exact challenge on Pico and I also never heared of tcache before. When didn't get any further on the binary and didn't know how to proceed, I thought "pretty sure John Hammond did that already, let's see if he has a video online about that". But I didn't find one and searched for other write-ups to help me solving and understanding tcache. And now you uploaded the vid that I would have needed a few days ago. :-D

  • @jackcruz4936
    @jackcruz4936 2 ปีที่แล้ว +5

    15:20
    Matt says: "it's very basic program"
    me: 🤯🤯

  • @janosmarton7895
    @janosmarton7895 2 ปีที่แล้ว +39

    More binary exploitation pls. Can you link Matt’s TH-cam pls 🙏🏻

  • @ani-zxk
    @ani-zxk 7 หลายเดือนก่อน +1

    I can't stop coming back to this video, matt is so skilled and knowledgeable.

  • @pomberorajy
    @pomberorajy 2 ปีที่แล้ว +3

    I have been learning all the details of this challenge for the last 5 days, what a coincidence seeing this here!

  • @WhatTheWeb
    @WhatTheWeb 2 ปีที่แล้ว +5

    I would love to see a demo of kit engine. Even for more experienced pwners browser stuff is quite daunting. Even going forward it would be nice if he could showcase more advanced techniques like kernel exploitation, browser, race conditions, etc. Great video!

  • @tvathome562
    @tvathome562 2 ปีที่แล้ว +2

    Wow I just worked through the binary exploitation deep dive matt, yesterday.. Looking forward to learning more....

  • @Bashir_Khan
    @Bashir_Khan 6 หลายเดือนก่อน

    Thanks a lot dude!
    You really helped me out there

  • @cleightthejw2202
    @cleightthejw2202 2 ปีที่แล้ว +6

    Hey the guy is talking about some deep stuff :)
    This is a whole different level of knowledge (which is worth learning which is worth the time to learn) :)

  • @oussamaqazdar4787
    @oussamaqazdar4787 2 ปีที่แล้ว +1

    More of this please ❤️

  • @kryptux2463
    @kryptux2463 2 ปีที่แล้ว

    Love your work John. Keep it up.

  • @applePrincess
    @applePrincess 2 ปีที่แล้ว +1

    About patchelf, it overwrites a "cleaned" version by changing meta information stored in elf binary, so better keep original one just in case that broken??? path was the trick. And about Matt saying didn't run by applying patchelf, I bet env var messed up (I obviously didn't see the situation so don't quote me on this one 😆) again great video thank to both of you.

  • @ernestoo8313
    @ernestoo8313 2 ปีที่แล้ว

    Amazing content! Thanks very much!

  • @Bashir_Khan
    @Bashir_Khan 6 หลายเดือนก่อน

    Can you please provide the link to the video you're referring to when you said at 17:55 about how you set up the pawninit command.

  • @emdwyer7331
    @emdwyer7331 2 ปีที่แล้ว

    Aaand I'm lost very quickly. Lol. Need to backtrack my learning and start from the beginning

  • @chainsawmanfan3002
    @chainsawmanfan3002 ปีที่แล้ว +1

    This is a 'Basic' challenge.

  • @claymoody
    @claymoody 2 ปีที่แล้ว

    Go Tigers!!

  • @chainsawmanfan3002
    @chainsawmanfan3002 ปีที่แล้ว

    I'm really new to this field, may I know what pwninit does????

  • @KFLawless1412
    @KFLawless1412 ปีที่แล้ว

    Can we crowdfund a new microphone for Matt?

  • @ahmedahmedx9600
    @ahmedahmedx9600 2 ปีที่แล้ว

    You are not bug hunter and you have hackerone t-shirt 😂

  • @anwarulbashirshuaib5673
    @anwarulbashirshuaib5673 ปีที่แล้ว

    can anyone help me with the part at 10:12? I did not understand why he changed it to char[3]

  • @guilherme5094
    @guilherme5094 2 ปีที่แล้ว

    👍

  • @bhagyalakshmi1053
    @bhagyalakshmi1053 ปีที่แล้ว

    Linux what

  • @laurenlewis4189
    @laurenlewis4189 2 ปีที่แล้ว +8

    I searched M. Alpha and got a friggin Sigma grindset "life coach". Does Matt have any social media?

  • @bhagyalakshmi1053
    @bhagyalakshmi1053 ปีที่แล้ว

    Zoom