pwnmedium

Chunks (Чанки)

duckerz

Task: Menu-based heap allocator with create/delete/view commands, no edit function. Solution: House of Botcake technique exploiting double-free vulnerability and uninitialized heap data leak to overwrite __free_hook with system() in glibc 2.33.

$ ls tags/ techniques/

heap safe-linking pwn double-free house-of-botcake tcache-poisoning glibc-2.33 __free_hook unsorted-bin-leak use-after-free

tcache_poisoningsafe_linking_bypasshouse_of_botcakedouble_freeunsorted_bin_leakheap_info_leak__free_hook_overwrite

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]