Overview

• Heap Training exploitation course for GLibC.
• If you are going through this WITHOUT an instructor, please follow the slides and do the exercises in the order listed below.

Get Started

Download the VM for the training! - TBD/TODO

Folder Structure

• modules/
  • Holds challenges for unique techniques (structure described in 'Assets Per Technique')
• demos/
  • Showcasing of techniques and other fun things
• libc_versions:
  • Versions of LibC and loader
• old_challenges:
  • Old/failed challenges
• resources:
  • Miscellaneous scripts and things

Introduction To Heap

• Introduction to Malloc
• Heap Vulnerability Classes:
  • Double free
  • Use after free
  • Arbitrary Frees

Techniques

1. Fd Poison:
   • Tcache
   • 2.32+ (pointer mangling)
2. Unlink and Unsafe Unlink
3. Overlapping chunks
4. House of Force
5. Unsorted Bin Attack && TCache Stashing Demo
6. House of Spirit (meh... not a huge fan of this technique in general)
7. Mmap Chunks + House of Muney -- not tested yet
8. Leaks
9. HTTP Server (final challenge)

Unused

• House of IO and New:
  • Pointer mangling and House IO. Fun challenges in there but not super relevant anymore.
• House of Orange:
  • Out of date + the POC doesn't work as you'd expect.

Assets Per Technique

All of these are helpful per challenge but not all are implemented yet

• Challenge file:
  • Challenge to test the knowledge of the technique
  • Source & compiled binary with the LD_PRELOAD section handled
• Solution - python pwntools solution:
  • Checkpoints for going from stage to stage, if stuck.
    • Currently, this is ONLY implemented for the House of Spirit
• Slides for the technique:
  • Background of heap mechanics needed
  • Technique description
  • Challenge
  • Challenge Walkthrough
  • Versions and situations
  • Other things to discuss
• compile script (make)
  • Patches the loader of the challenge files

Qemu

tar xvf Heap\ Course\ DEFCON\ 30.ova
qemu-img convert -f vmdk -O qcow2 Heap\ Course\ DEFCON\ 30-disk002.vmdk HeapCourse.qcow2

qemu-system-x86_64 \
    -smp 2 \
    -hda HeapCourse.qcow2 \
    -m 6G \
    -usb \
    -device usb-tablet