BINARY EXPLOITATIONinsane
Heap Exploitation Techniques
2024-05-10
#Pwn#Heap#Linux
Comprehensive guide to modern heap exploitation including tcache poisoning and house of techniques.
Modern Heap Internals
Understanding glibc malloc internals is essential for heap exploitation.
Key Techniques
Tcache Poisoning
- Corrupt tcache chunk fd pointer
- Allocate chunk at arbitrary address
- Overwrite __free_hook or similar
House of techniques
- House of Force
- House of Spirit
- House of Orange
- House of Lore
Practical Example
from pwn import *
# Corrupt tcache fd
payload = b'A' * 0x20
payload += p64(0) # prev_size
payload += p64(0x91) # size
payload += p64(target) # fd pointer
// stack & references
glibcpwntools