| name | house-of-spirit-exploit |
| description | House of Spirit heap exploitation guide. Use this skill whenever the user mentions heap exploitation, fake chunks, tcache poisoning, fastbin attacks, binary exploitation with heap vulnerabilities, or needs to create fake heap chunks for CTF challenges. This skill helps create fake heap chunks that bypass glibc security checks to achieve arbitrary memory allocation. |
House of Spirit Exploitation
A guide for creating fake heap chunks to bypass glibc security checks and achieve arbitrary memory allocation.
What is House of Spirit?
House of Spirit is a heap exploitation technique where you create fake heap chunks in arbitrary memory locations (stack, BSS, etc.) and trick the allocator into thinking they're real chunks. When freed, these fake chunks enter the fastbin or tcache, allowing you to allocate them back and write to arbitrary addresses.
When to Use This Attack
- You have a way to control a pointer that will be freed
- You need to allocate memory at a specific address (e.g., to overlap with a target buffer)
- You want to achieve arbitrary write primitives
- You're working with heap vulnerabilities in CTF challenges
Requirements
Fastbin Variant (glibc < 2.26 or when tcache is disabled)
- Create two consecutive fake chunks with valid sizes
- First chunk's size must be in fastbin range (0x20-0x70 on x64)
- Second chunk's size must also be valid (for next-chunk size check)
- Both chunks must be properly aligned
Tcache Variant (glibc ≥ 2.26)
- Create one fake chunk (simpler!)
- Chunk must be 16-byte aligned
- Size must be in tcache bin range (0x20-0x410 on x64)
- Size must have
prev_inuse bit set (size | 1)
- Tcache for that bin must not be full (max 7 entries)
