Linux Heap Exploitation - Part 1

Learn some basic heap mechanics, including how the malloc() function works and what the "top chunk" is. Along the way we get familiar with the GNU debugger and the pwndbg Python library.

We take a look at our first vulnerable practice binary, doing our due diligence to find out which protections it uses.

Learn the House of Force technique, which is part of the "Malloc Maleficarum" and leverage it to make an arbitrary write, overwriting target memory in our vulnerable binary. We'll make use of the pwntools Python library to script our exploit.

In this video we turn our House of Force arbitrary write into code execution.

To prepare for our next heap exploitation technique, we learn about the free() function and how the fastbins operate.

Learn our 2nd heap exploitation technique, the Fastbin Dup, and leverage it to make an arbitrary write.

In this video we turn our Fastbin Dup primitive into a shell, along the way we'll learn about "one-gadgets" and how to meet their constraints.

Take on your first heap exploitation challenge.

Your objective is to drop a shell from the challenge binary using what you've learned so far, but be aware that this challenge has a couple of tricks up its sleeve.

Learn about the unsortedbin and malloc's unlink() macro/function in preparation for the Unsafe Unlink technique.

Leverage the original heap exploitation technique, the Unsafe Unlink, developed by Alexander Peslyak a.k.a Solar Designer in the year 2000.

In this video we'll learn how to leverage the Safe Unlink technique to make an arbitrary write, followed by dropping a shell from the vulnerable binary.

A brief introduction to the House of Orange, a beautiful end-to-end heap exploitation technique developed in 2016 by Angelboy.

Learn about file stream exploitation, an alternative means of gaining, amongst other things, arbitrary code execution. This is how we'll drop a shell in the 3rd phase of the House of Orange.

Learn the 2nd phase of the House of Orange, the Unsortedbin Attack, which can write the address of an arena's unsortedbin to an arbitrary location.

Learn phase 1 of the House of Orange, top chunk extension, before putting all 3 phases together to finally drop a shell from our vulnerable binary.

Prepare for your final challenge binary by learning about "remaindering", a process in which chunks are broken down into smaller chunks.

Take on your final challenge: One-Byte, in which you're tasked with dropping a shell from a binary with modern protections. You'll need to forge a libc leak and leverage what you've learned so far about heap exploitation to complete this challenge.

Thank you for taking the HeapLAB part 1 course, now go exploit some heap bugs!