Linux Heap Exploitation - Part 1
What you'll learn
- Scripting exploits with pwntools
- Introspecting the heap with pwndbg
- The House of Force technique
- The Fastbin Dup technique
- The Unsafe Unlink technique
- The Safe Unlink technique
- The House of Orange technique
- Using one-gadgets to drop a shell
- Leveraging a single-byte heap overflow to drop a shell
Requirements
- Familiarity with the Linux command line environment
- Basic debugging skills
- A Linux VM or Host
Description
For nearly 20 years, exploiting memory allocators has been something of an art form. Become part of that legacy with HeapLAB.
The GNU C Library (GLIBC) is a fundamental part of most Linux desktop and many embedded distributions; its memory allocator is used in everything from starting threads to dealing with I/O. Learn how to leverage this vast attack surface via different heap exploitation techniques, from the original "Unsafe Unlink" to the beautiful overflow-to-shell "House of Orange".
In this hands-on course, students will alternate between learning new techniques and developing their own exploits based on what they've learned. We'll make use of the pwntools and pwndbg frameworks to drop shells from vulnerable practice binaries, and you'll take on challenges that test what you've learned.
Who this course is for:
- Exploit developers
- Capture The Flag (CTF) players
- Those wishing to learn more about exploit dev than just stack buffer overflows
- Anyone interested in weird machines
Course content
4 lectures • 14minIntroduction
- Preview01:33
- 04:48What is GLIBC?
- 02:40What is malloc?
- 04:37Environment setup
4 lectures • 47minThe House of Force
3 lectures • 42minThe Fastbin Dup
1 lecture • 24minCHALLENGE: Fastbin Dup 2
2 lectures • 32minUnsafe Unlink
1 lecture • 22minSafe Unlink
4 lectures • 1hr 2minThe House of Orange
2 lectures • 46minCHALLENGE: One-Byte
1 lecture • 3minFarewell
Instructor
![Max Kamper](data:image/svg+xml,%3Csvg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64"%3E%3C/svg%3E){kind=avatar}
- 4.8 Instructor Rating
- 105 Reviews
- 534 Students
- 1 Course
Max Kamper is a researcher and exploit developer. A former Royal Marines Commando, Max was a member of the Information Exploitation Group's electronic warfare squadron. Having traded radio signals for process signals, he now specializes in exploit development against Linux platforms. Max is also the author of the ROP Emporium website, a resource for learning practical x86 return-oriented programming.