shellphish/how2heap

Features

• Glibc Heap Exploitation - Provides a laboratory for studying and implementing memory corruption techniques targeting the glibc malloc implementation.
• Exploit Development - Offers a technical testbed for developing and testing primitives like tcache poisoning and double frees.
• Bin Poisoning - Tricks the allocator into returning a pointer to an arbitrary location by overwriting forward pointers.
• Freelist Manipulation - Abuses the tcache freelist to trick the allocator into returning arbitrary aligned pointers.
• Cache Poisoning - Redirects allocations to target addresses by inserting arbitrary pointers into thread-local cache bins.
• Educational Examples - Provides a collection of source code examples and binaries to teach low-level memory management flaws.
• Vulnerable Lab Environments - Provides a containerized lab environment with compilers and debuggers to reproduce memory corruption vulnerabilities.
• Allocator Testbeds - Ships a containerized environment for compiling and analyzing how different glibc versions handle heap allocations.
• Exploit Primitives - Implements practical techniques for bypassing memory protections and manipulating heap metadata for arbitrary writes.
• Metadata Hijacking - Redirects subsequent allocations to arbitrary addresses by overwriting per-thread cache structures.
• Metadata Manipulation - Transforms use-after-free vulnerabilities into primitives that control allocator metadata via linked list manipulation.
• Heap Exploit Primitives - Implements techniques to trick the allocator into returning stack addresses through double-free vulnerabilities.
• Bypass Techniques - Provides implementations for bypassing memory protection mechanisms by manipulating chunk pointers.
• Allocator Metadata Manipulation - Demonstrates how to overwrite internal allocator structures such as chunk sizes and forward pointers for memory access.
• Interactive Manipulators - Provides a programmable interface to manually allocate and free memory chunks to observe real-time heap behavior.
• Heap Corruption Detection - Demonstrates how to corrupt fastbin pointers to treat stack addresses as heap chunks.
• Hardening Bypass Analysis - Analyzes methods for bypassing heap hardening and protection mechanisms using internal metadata manipulation.
• Arena Hijacking - Implements techniques to replace the main arena structure with a fake arena for arbitrary memory writes.
• Arena Hijacking - Achieves arbitrary memory writes by replacing the main arena with a crafted fake arena.
• Memory Allocation Tracers - Includes diagnostics and statistics to monitor allocation patterns and identify memory corruption.
• Chunk Size Corruption - Creates arbitrary bins for corruption by manipulating the wilderness chunk size.
• Stashing Unlink Attacks - Creates fake memory chunks and writes arbitrary addresses by manipulating smallbin to tcache transfers.
• Arbitrary Heap Writes - Implements techniques to write pointers to arbitrary heap locations by manipulating tcache indices.
• Chunk Overlapping - Provides implementations for tricking allocators into merging memory regions to allow active chunk overwrites.
• Freelist Poisoning - Implements forged pointer injection into tcache or fastbin lists to achieve arbitrary memory returns.
• Hardening Analysis - Evaluates memory protection mechanisms by triggering bypasses and monitoring allocation statistics.
• Hardening Evaluation - Tests how memory protections mitigate exploitation by configuring environment variables and internal checks.
• Large Bin Attacks - Provides implementations for overwriting target memory addresses by manipulating large bin pointers.
• Leakless Exploitation - Implements attacks that redirect execution to a shell using relative overwrites without an initial memory leak.
• Pointer Deobfuscation - Provides tools to recover original memory addresses by reversing XOR-based safe linking protections.
• Binary Exploitation - Educational resource for glibc heap exploitation techniques.

Star-Verlauf