Conference Presentation
Hacking OCaml
- The approach involves applying adversarial CTF and day-job hacking skills to inspect OCaml runtime internals, identifying gaps between intended and actual code behavior to perform exploitation.
- Specific vulnerabilities targeted include soundness bugs in exceptional polymorphism where free betas emerge during exception raising, and potential weaknesses in standard library functions
callback.register,stdlib.input_value, andparse_file. - Exploitation of
callback.registeris anticipated via its call chain tosafe.registerandregister_named_value, enabling control over both arguments and functions to force unintended system actions withinprint_exec_handle_and_caught_exception. - Methodologies include dynamic analysis using GDB, PIDA, and PwnDBG, alongside static analysis tools like Yidra, IDA Pro, and Binary Ninja for scenarios where executing the program poses risks.
- Bypass strategies focus on controlling function pointers to jump to the
open_insyscall, circumventing integer representation restrictions (2x plus 1) and accessing blocked functionalities. - Alternative techniques involve overwriting glibc function pointers such as
mallocandfreehooks, writing shellcodes within integer literals, or leaking flags via heap control and MD5 API without requiring full code execution. - The challenge is noted as originating from an older OCaml version on archive.404.pl/ctf.com, though soundness bugs in the compiler itself remain a distinct risk even if standard libraries are patched.
- Contextual expectations highlight that while compiler developers effectively resolve soundness issues, the growing use of AI-generated code necessitates rigorous verification of actual versus perceived functionality.