This repo is for learning various heap exploitation techniques. We use Ubuntu's Libc releases as the gold-standard. Each technique is verified to work on corresponding Ubuntu releases. You can run apt source libc6 to download the source code of the Libc your are using on Debian-based operating system. You can also click ▶️ to debug the technique in your browser using gdb.

We came up with the idea during a hack meeting, and have implemented the following techniques:

The GnuLibc is under constant development and several of the techniques above have let to consistency checks introduced in the malloc/free logic. Consequently, these checks regularly break some of the techniques and require adjustments to bypass them (if possible). We address this issue by keeping multiple versions of the same technique for each Glibc-release that required an adjustment. The structure is glibc_<version>/technique.c.

Have a good example? Add it here! Try to inline the whole technique in a single .c -- it's a lot easier to learn that way.

• make sure you have the following packages/tools installed: patchelf zstd wget (of course also build-essential or similar for compilers, make, ...)
• also, /usr/bin/python must be/point to your python binary (e. g. /usr/bin/python3)

git clone https://github.com/shellphish/how2heap
cd how2heap
make clean all
./glibc_run.sh 2.30 ./malloc_playground -u -r

Notice that it does not work if you compile the target binary (malloc_playground) using glibc >= 2.34 and try to run it on glibc < 2.34 because of glibc's symbol versioning. For details, please refer to this.

This uses Docker-based approach to prepare the needed environment

git clone https://github.com/shellphish/how2heap
cd how2heap

# the next command will prepare the target binary so it runs with
# the expected libc version
make
./glibc_run.sh 2.30 ./malloc_playground -d -p

# now you can play with the binary with glibc-2.30
# and even debug it with the correct symbols
readelf -d -W malloc_playground | grep RUNPATH # or use checksec
readelf -l -W malloc_playground | grep interpreter
gdb -q -ex "start" ./malloc_playground

There are some heap exploitation tools floating around.

jemalloc exploitation framework: https://github.com/CENSUS/shadow

Examine the glibc heap in gdb: https://github.com/cloudburst/libheap

Examine the glibc heap in IDA Pro: https://github.com/danigargu/heap-viewer

A Python based heap playground with good visualization for educational purposes: https://github.com/matrix1001/heapinspect

Debugger that lets you set "checkpoints" as well as view and edit the heap using a hexeditor: https://github.com/haxkor/forkever

The malloc_playground.c file given is the source for a program that prompts the user for commands to allocate and free memory interactively.

Examine the glibc heap in gdb: https://github.com/scwuaptx/Pwngdb

Helps you visualize heap operations by replacing addresses with symbols: https://github.com/Arinerron/heaptrace

Search for applicable heap exploitation techniques based on primitive requirements: https://kissprogramming.com/heap/heap-search

Some good heap exploitation resources, roughly in order of their publication, are:

• glibc in-depth tutorial (https://heap-exploitation.dhavalkapil.com/) - book and exploit samples
• ptmalloc fanzine, a set of resources and examples related to meta-data attacks on ptmalloc (http://tukan.farm/2016/07/26/ptmalloc-fanzine/)
• A malloc diagram, from libheap (https://raw.githubusercontent.com/cloudburst/libheap/master/heap.png)
• Glibc Adventures: The Forgotten Chunk (https://go.contextis.com/rs/140-OCV-459/images/Glibc_Adventures-The_Forgotten_Chunks.pdf) - advanced heap exploitation
• Pseudomonarchia jemallocum (http://www.phrack.org/issues/68/10.html)
• The House Of Lore: Reloaded (http://phrack.org/issues/67/8.html)
• Malloc Des-Maleficarum (http://phrack.org/issues/66/10.html) - some malloc exploitation techniques
• Yet another free() exploitation technique (http://phrack.org/issues/66/6.html)
• Understanding the heap by breaking it (https://www.blackhat.com/presentations/bh-usa-07/Ferguson/Whitepaper/bh-usa-07-ferguson-WP.pdf) - explains heap implementation and a couple exploits
• The use of set_head to defeat the wilderness (http://phrack.org/issues/64/9.html)
• The Malloc Maleficarum (http://seclists.org/bugtraq/2005/Oct/118)
• OS X heap exploitation techniques (http://phrack.org/issues/63/5.html)
• Exploiting The Wilderness (http://seclists.org/vuln-dev/2004/Feb/25)
• Advanced Doug lea's malloc exploits (http://phrack.org/issues/61/6.html)
• GDB Enhanced Features (GEF) Heap Exploration Tools (https://hugsy.github.io/gef/commands/heap/)
• pwndbg Heap Commands (https://browserpwndbg.readthedocs.io/en/docs/commands/heap/heap/)
• Painless intro to the Linux userland heap (https://sensepost.com/blog/2017/painless-intro-to-the-linux-userland-heap/)
• Heap exploitation techniques that work on glibc-2.31 (https://github.com/StarCross-Tech/heap_exploit_2.31)
• Overview of GLIBC heap exploitation techniques (https://0x434b.dev/overview-of-glibc-heap-exploitation-techniques/)

There are a couple of "hardening" measures embedded in glibc, like export MALLOC_CHECK_=1 (enables some checks), export MALLOC_PERTURB_=1 (data is overwritten), export MALLOC_MMAP_THRESHOLD_=1 (always use mmap()), ...

More info: mcheck(), mallopt().

There's also some tracing support as mtrace(), malloc_stats(), malloc_info(), memusage, and in other functions in this family.