# Exploitation 500 "OracleVote"

Disclaimer: I wrote this challenge.

## Link to paper

[Using Memory Errors to Attack a Virtual Machine](https://www.cs.princeton.edu/~appel/papers/memerr.pdf)

## Meanings of files
- {`Exploit.java`,`Exploit.smartcard`} - the full exploit
- {`UnsafePOC.java`,`unsafePOC.smartcard`} - a demonstration of how to bypass SecurityManager sandboxes using read/write/getAddress, decoupled from bitflipping
- {`onlyCreateClassLoader.policy`,`unsafe.policy`} - policy files (the first was used in the live deploy, the second for local testing, to get a deterministic exploit)
- `OracleVote.java` - the server itself
- `prepareSmartCard.sh` - a helper script for compiling the smartcards
- `procdump` - the binary that induces bitflips in the server
- `successful_output.txt` - a log of a successful run of the exploit against the live server

# Exploitation 500 "OracleVote"

Disclaimer: I wrote this challenge.

## Link to paper

[Using Memory Errors to Attack a Virtual Machine](https://www.cs.princeton.edu/~appel/papers/memerr.pdf)

## Meanings of files
- {`Exploit.java`,`Exploit.smartcard`} - the full exploit
- {`UnsafePOC.java`,`unsafePOC.smartcard`} - a demonstration of how to bypass SecurityManager sandboxes using read/write/getAddress, decoupled from bitflipping
- {`onlyCreateClassLoader.policy`,`unsafe.policy`} - policy files (the first was used in the live deploy, the second for local testing, to get a deterministic exploit)
- `OracleVote.java` - the server itself
- `prepareSmartCard.sh` - a helper script for compiling the smartcards
- `procdump` - the binary that induces bitflips in the server
- [main.rs](https://github.com/aweinstock314/procdump/blob/6c2b0d2912490ed2ca03a2d0163cd2a0a551be42/src/main.rs#L185-L255) - source of bitflipper in procdump
- `successful_output.txt` - a log of a successful run of the exploit against the live server

Add reference to procdump's source for OracleVote.
Add reference to procdump's source for OracleVote.
