Corwin de Zahr

Hacking OCaml

Corwin de Zahr

In a 2021 CTF challenge titled "Secure OCaml Sandbox," the speaker demonstrates how to bypass type safety by exploiting exceptional polymorphism and runtime inconsistencies within the OCaml standard library. By leveraging functions like `callback.register` alongside low-level insights into integer tagging and closure memory layouts, the attacker constructs a custom `obj.magic` to redirect code execution toward blocked primitives such as `open_in`. This successful exploitation retrieves the hidden flag, illustrating how deep knowledge of the OCaml runtime can undermine soundness guarantees even when standard file and command execution are restricted.