pwncollege
DojosLeaderboardCommunity
Back to program-security

Dynamic Allocator Misuse

program-security
0/40 challenges completed

The glibc heap consists of many components distinct parts that balance performance and security. In this introduction to the heap, the thread caching layer, tcache will be targeted for exploitation. tcache is a fast thread-specific caching layer that is often the first point of interaction for programs working with dynamic memory allocations.

Dynamic Allocator Misuse Resources

Dynamic Allocator Misuse: What is the Heap?
Video
Slides
Dynamic Allocator Misuse: Dangers
Video
Slides
Dynamic Allocator Misuse: tcache
Video
Slides

Use After Free

1
Freebie (Easy)
2
Freebie (Hard)
3
Freebin Feint (Easy)
4
Freebin Feint (Hard)
5
Free Flag Fumble (Easy)
6
Free Flag Fumble (Hard)

Metadata Mischief Resources

Dynamic Allocator Misuse: Chunks and Metadata
Video
Slides
Dynamic Allocator Misuse: Metadata Corruption
Video
Slides

Metadata Mischief

7
Fickle Free (Easy)
8
Fickle Free (Hard)
9
Malloc Mirage (Easy)
10
Malloc Mirage (Hard)
11
Seeking Secrets (Easy)
12
Seeking Secrets (Hard)
13
Seeking Substantial Secrets (Easy)
14
Seeking Substantial Secrets (Hard)
15
Seeking Spanless Secrets (Easy)
16
Seeking Spanless Secrets (Hard)
17
Seeking Smuggled Secrets (Easy)
18
Seeking Smuggled Secrets (Hard)

Heap Hijinx

19
Sus Sequence (Easy)
20
Sus Sequence (Hard)
21
Echo Emanations (Easy)
22
Echo Emanations (Hard)
23
Stack Spoofing (Easy)
24
Stack Spoofing (Hard)
25
Stack Summoning (Easy)
26
Stack Summoning (Hard)
27
Enterprising Echo (Easy)
28
Enterprising Echo (Hard)
29
Ephemeral Echo (Easy)
30
Ephemeral Echo (Hard)

Subverting Safe-Linking Resources

Dynamic Allocator Misuse: Safe-Linking
Video
Slides

Subverting Safe-Linking Challenges

31
Seeking Safe Secrets (Easy)
32
Seeking Safe Secrets (Hard)
33
Sus Sequence Safety (Easy)
34
Sus Sequence Safety (Hard)
35
Safely Stack Summoning (Easy)
36
Safely Stack Summoning (Hard)

Exploitation

37
Overlapping Odyssey (Easy)
38
Overlapping Odyssey (Hard)
39
Tcache Terror (Easy)
40
Tcache Terror (Hard)