holy_cit

miptctf

Task: exploit a CRUD service written in HolyC (TempleOS language) compiled with hcc for Linux, featuring a custom allocator wrapping glibc malloc with an 8-byte size header. Solution: exploit _REALLOC bug that copies old_size instead of min(old_size, new_size) to overflow 8 bytes into adjacent chunks, forge HolyC size headers to create fake unsorted bin chunks for libc leak, overlapping chunks for heap leak, then tcache poisoning with safe-linking bypass for arbitrary write and ROP chain execution.