how2heap - A repository for learning various heap exploitatio

项目说明

Educational Heap Exploitation

This repo is for learning heap exploitation techniques.
We use Ubuntu's Libc releases as the gold-standard. Each technique is to work on corresponding Ubuntu releases.
You can run apt source libc6 to download the 源码 代码 of the Libc you are using on a Debian-based operating system. You can also click :arrow_forward: to debug the technique in your browser using gdb.

We came up with the idea during a hack meeting, and ha the following techniques:

| File | :arrow_forward: | Technique | Glibc- | Patch | Applicable CTF Challenges |
|------|-----|-----------|---------------|-------|---------------------------|
| first_fit.c | | Demonstrating glibc malloc's first-fit behavior. | | | |
| calc_tcache_idx.c| | Demonstrating glibc's tcache index calculation.| | | |
| fastbin_dup.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Tricking malloc into returning an already-allocated heap pointer by abusing the fastbin freelist. | < 2.43 | patch | |
| fastbin_dup_into_stack.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Tricking malloc into returning a nearly-arbitrary pointer by abusing the fastbin freelist. | < 2.43 | patch | 9447-search-engine, 0ctf 2017-babyheap |
| fastbin_dup_consolidate.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Tricking malloc into returning an already-allocated heap pointer by putting a pointer on both fastbin freelist and the top chunk. | < 2.43 | patch | Hitcon 2016 SleepyHolder |
| unsafe_unlink.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting free on a corrupted chunk to get arbitrary write. | latest | | HITCON CTF 2014-stkof, Insomni'hack 2017-Wheel of Robots |
| house_of_spirit.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Frees a fake fastbin chunk to get malloc to return a nearly-arbitrary pointer. | latest | | hack.lu CTF 2014-OREO |
| poison_null_byte.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting a single null byte o. | latest | | PlaidCTF 2015-plaiddb, BalsnCTF 2019-PlainNote|
| house_of_lore.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Tricking malloc into returning a nearly-arbitrary pointer by abusing the smallbin freelist. | latest | | |
| o.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploit the o of a freed chunk size in the unsorted bin in order to make a new allocation o with an existing chunk | < 2.29 | patch | hack.lu CTF 2015-bookstore, Nuit du Hack 2016-night-deamonic-heap |
| o.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploit the o of an in use chunk size in order to make a new allocation o with an existing chunk | < 2.29|patch | |
| mmap_o.c | | Exploit an in use mmap chunk in order to make a new allocation o with a current mmap chunk | latest | | |
| house_of_force.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the Top Chunk (Wilderness) header in order to get malloc to return a nearly-arbitrary pointer | < 2.29 | patch | Boston Key Party 2016-cookbook, BCTF 2016-bcloud |
| unsorted_bin_into_stack.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the o of a freed chunk on unsorted bin freelist to return a nearly-arbitrary pointer. | < 2.29 | patch| |
| unsorted_bin_attack.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the o of a freed chunk on unsorted bin freelist to write a large value into arbitrary address | < 2.29 | patch | 0ctf 2016-zerostorage |
| large_bin_attack.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the o of a freed chunk on large bin freelist to write a large value into arbitrary address | < 2.42 | patch | 0ctf 2018-heapstorm2 |
| house_of_einherjar.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting a single null byte o to trick malloc into returning a controlled pointer | latest | | Seccon 2016-tinypad |
| house_of_water.c | | Exploit a UAF or double free to gain leakless control of the t-cache metadata and a leakless way to link libc in t-cache | latest | | 37c3 Potluck - Tamagoyaki|
| sysmalloc_int_free.c | | Demonstrating freeing the nearly arbitrary sized Top Chunk (Wilderness) using malloc (sysmalloc _int_free() ) | latest | | |
| house_of_orange.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the Top Chunk (Wilderness) in order to gain arbitrary 代码 execution | < 2.26 | patch | Hitcon 2016 houseoforange |
| house_of_tangerine.c | | Exploiting the Top Chunk (Wilderness) in order to trick malloc into returning a completely arbitrary pointer by abusing the tcache freelist | >= 2.26 | | PicoCTF 2024- high frequency troubles |
| house_of_roman.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Leakless technique in order to gain remote 代码 execution via fake fastbins, the unsorted\_bin attack and relati. |< 2.29 |patch ||
| tcache_poisoning.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Tricking malloc into returning a completely arbitrary pointer by abusing the tcache freelist. (requires heap leak on and after 2.32) | > 2.25 | patch | |
| tcache_house_of_spirit.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Frees a fake chunk to get malloc to return a nearly-arbitrary pointer. | > 2.25 | | |
| house_of_botcake.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Bypass double free restriction on tcache. Make tcache_dup great again. | > 2.25 | | |
| tcache_stashing_unlink_attack.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the o of a freed chunk on small bin freelist to trick malloc into returning an arbitrary pointer and write a large value into arbitraty address with the help of calloc. | > 2.25 | | Hitcon 2019 one punch man |
| fastbin_re.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the o of a freed chunk in the fastbin to write a large value into an arbitrary address. | 2.26 - 2.42 | patch | |
| house_of_mind_fastbin.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting a single byte o with arena handling to write a large value (heap pointer) to an arbitrary address | < 2.43 | patch | |
| house_of_storm.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting a use after free on both a large and unsorted bin chunk to return an arbitrary chunk from malloc| < 2.29 | | |
| house_of_gods.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | A technique to hijack a thread's arena within 8 allocations | < 2.27 | | |
| decrypt_safe_linking.c | <a href=" title="Debug Technique In Browser">:arrow_forward:</a> | Decrypt the poisoned value in linked list to recover the actual pointer | >= 2.32 | | |
| safe_link_double_protect.c | | Leakless bypass for PROTECT_PTR by protecting a pointer twice, allowing for arbitrary pointer linking in t-cache | >= 2.32 | | 37c3 Potluck - Tamagoyaki|
| tcache_dup.c(obsolete) | | Tricking malloc into returning an already-allocated heap pointer by abusing the tcache freelist. | 2.26 - 2.28 | patch | |
| tcache_metadata_poisoning.c | | Trick the tcache into pro arbitrary pointers by manipulating the tcache metadata struct | >= 2.26 | | |
| house_of_io.c | | Tricking malloc into return a pointer to arbitrary memory by manipulating the tcache management struct by UAF in a free'd tcache chunk. | 2.31 - 2.33 | | |
| tcache_relati.c | | Arbitrary decimal value and chunk pointer writing in heap by out-of-bounds tcache metadata writing | 2.30-2.41 | patch | |
| tcache_metadata_hijacking | | Arbitrary allocation by o into tcache metadata | >= 2.42 | | |

The GnuLibc is under constant de and several of the techniques above have let to consistency checks introduced in the malloc/free logic.
Consequently, these checks regularly break some of the techniques and require adjustments to bypass them (if possible).
We address this issue by keeping multiple of the same technique for each Glibc-release that required an adjustment.
The structure is glibc_<>/technique.c.

Have a good example?
Add it here!
Try to inline the whole technique in a single .c -- it's a lot easier to learn that way.

Get Started

Quick Setup

make sure you have the following packages/tools installed: patchelf zstd wget (of course also build-essential or similar for compilers, make, ...)

also, /usr/bin/python must be/point to your python binary (e. g. /usr/bin/python3)

Notice that this will link the binaries with your system libc. If you want to play with other libc . Please refer to Complete Setup.

Complete Setup

You will encounter symbol issues (see this) if you try to LD_PRELOAD libcs to a binary that's compiled on your host machine.
We have two ways to bypass it.

Method 1: link against older libc

This one tells linker to link the target binary with the target libc.

This will link all the binaries against corresponding libcs. What's better is that it comes with debug symbols. Now you can play with any libc on your host machine.
In this example, it will compile all glibc-2.23 binaries and link them with libc-2.23. You can change the number to play with other libc .

Method 2: use docker

This uses Docker-based approach to complie binaries inside an old ubuntu container so it is runnable with the target libc .

Heap Exploitation Tools

There are some heap exploitation tools floating around.

Malloc Playground

The malloc_playground.c file given is the 源码 for a program that prompts the user for commands to allocate and free memory interactively.

Pwngdb

Examine the glibc heap in gdb:

pwndbg

An exploitation-centric gdb plugin that provides the ability to view/tamper with the glibc heap:

gef

Another excellent gdb plugin that provides the ability to examine the glibc heap:

heap-

Examine the glibc heap in IDA Pro:

heaptrace

Helps you heap operations by replacing addresses with symbols:

Other resources

Some good heap exploitation resources, roughly in reverse order of their publication, are:

Useful heap exploitation tutorials

O of GLIBC heap exploitation techniques () <!-- 2022 -->

glibc in-depth tutorial () - book and exploit samples <!-- 2022 -->

Heap exploitation techniques that work on glibc-2.31 () <!-- 2020 -->

Painless intro to the Linux userland heap () <!-- 2017 -->

ptmalloc fanzine, a set of resources and examples related to meta-data attacks on ptmalloc () <!-- 2016 -->

Glibc Ad: The Forgotten Chunk () - ad heap exploitation <!-- 2015 -->

Historical heap exploitation (The History)

Pseudomonarchia jemallocum () <!-- 2012 -->

The House Of Lore: Reloaded () <!-- 2010 -->

Malloc Des-Maleficarum () - some malloc exploitation techniques <!-- 2009 -->

Yet another free() exploitation technique () <!-- 2009 -->

The use of set_head to defeat the wilderness () <!-- 2007 -->

Understanding the heap by breaking it () - explains heap implementation and a couple exploits <!-- 2007 -->

OS X heap exploitation techniques () <!-- 2005 -->

The Malloc Maleficarum () <!-- 2005 -->

Exploiting The Wilderness () <!-- 2004 -->

Ad Doug lea's malloc exploits () <!-- 2003 -->

Hardening

There are a couple of "hardening" measures embedded in glibc, like export MALLOC_CHECK_=1 (enables some checks), export MALLOC_PERTURB_=1 (data is o), export MALLOC_MMAP_THRESHOLD_=1 (always use mmap()), ...

More info: mcheck(), mallopt().

There's also some tracing support as mtrace(), malloc_stats(), malloc_info(), memusage, and in other functions in this family.

项目信息

开发语言：C

Star 数：8899

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A repository for learning heap exploitation techniques.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。