Jabr Al-Otaibi
Security Researcher
Unidentified
I'm a 18-year-old security researcher focused on Exploit Development, Vulnerability Research, and reverse engineering. As a DarkCov founder, We're focused on counter-UAS systems built on real protocol and signal analysis, GPS spoofing and RF disruption grounded in signals research rather than off-the-shelf modules, and the development of military-grade embedded hardware where the threat model is embedded in the architecture from the first design decision.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
Schrodinger's Chunk: Is It Freed? Yes. Is It Allocated? Also Yes. Do We Have a Shell? Absolutely.
This session presents a novel heap exploitation technique targeting glibc 2.43 that derives a full use-after-free primitive from a target program that contains none. The entry point is a single null byte. Every modern mitigation Full RELRO, stack canary, NX, PIE remains active throughout.The technique chains five distinct bugs in glibc 2.43's allocator: the absence of cycle detection in the tcache freelist, an unbounded counter increment in tcache_get_n, a double-free gate that is silently defeated by key clearing on every pop, a fully deterministic heap layout introduced by lazy tcache initialization, and unprotected bin head pointers in tcache_perthread_struct.The session walks through the complete exploit chain from null byte to backward consolidation, libc leak, self-referencing tcache loop, manufactured UAF, arbitrary allocation via tcache poisoning, and final code execution through FSOP targeting the wide character vtable, which carries no range validation. Safe-linking key recovery is eliminated entirely; Bug 4 makes the key computable from heap base alone by arithmetic.
- 18:00
- Tue
- 01 Dec
Stage:
Briefing Stage 1
Sessions Type:
Keynote