← Back to Writeups
Modern Heap Internals
techniqueinsane
Heap Exploitation Techniques
2024-05-10
PwnHeapLinux
Modern Heap Internals
Understanding glibc malloc internals is essential for heap exploitation.
## Key Techniques
Tcache Poisoning
- Corrupt tcache chunk fd pointer
- Allocate chunk at arbitrary address
- Overwrite __free_hook or similar
### House of techniques
- House of Force
- House of Spirit
- House of Orange
- House of Lore
## Practical Example
``python
from pwn import *
# Corrupt tcache fd
payload = b'A' * 0x20
payload += p64(0) # prev_size
payload += p64(0x91) # size
payload += p64(target) # fd pointer
``
- Corrupt tcache chunk fd pointer
- Allocate chunk at arbitrary address
- Overwrite __free_hook or similar
### House of techniques
- House of Force
- House of Spirit
- House of Orange
- House of Lore
## Practical Example
``
python
from pwn import *
# Corrupt tcache fd
payload = b'A' * 0x20
payload += p64(0) # prev_size
payload += p64(0x91) # size
payload += p64(target) # fd pointer
``