Skip to content

Latest commit

 

History

History
76 lines (67 loc) · 2.18 KB

README.md

File metadata and controls

76 lines (67 loc) · 2.18 KB
Raw

Overview

  • Heap Training exploitation course for GLibC.
  • If you are going through this WITHOUT an instructor, please follow the slides and do the exercises in the order listed below.

Get Started

Download the VM for the training! - TBD/TODO

Folder Structure

  • modules/
    • Holds challenges for unique techniques (structure described in 'Assets Per Technique')
  • demos/
    • Showcasing of techniques and other fun things
  • libc_versions:
    • Versions of LibC and loader
  • old_challenges:
    • Old/failed challenges
  • resources:
    • Miscellaneous scripts and things

Introduction To Heap

  • Introduction to Malloc
  • Heap Vulnerability Classes:
    • Double free
    • Use after free
    • Arbitrary Frees

Techniques

  1. Fd Poison:
    • Tcache
    • 2.32+ (pointer mangling)
  2. Unlink and Unsafe Unlink
  3. Overlapping chunks
  4. House of Force
  5. Unsorted Bin Attack && TCache Stashing Demo
  6. House of Spirit (meh... not a huge fan of this technique in general)
  7. Mmap Chunks + House of Muney -- not tested yet
  8. Leaks
  9. HTTP Server (final challenge)

Unused

  • House of IO and New:
    • Pointer mangling and House IO. Fun challenges in there but not super relevant anymore.
  • House of Orange:
    • Out of date + the POC doesn't work as you'd expect.

Assets Per Technique

All of these are helpful per challenge but not all are implemented yet

  • Challenge file:
    • Challenge to test the knowledge of the technique
    • Source & compiled binary with the LD_PRELOAD section handled
  • Solution - python pwntools solution:
    • Checkpoints for going from stage to stage, if stuck.
      • Currently, this is ONLY implemented for the House of Spirit
  • Slides for the technique:
    • Background of heap mechanics needed
    • Technique description
    • Challenge
    • Challenge Walkthrough
    • Versions and situations
    • Other things to discuss
  • compile script (make)
    • Patches the loader of the challenge files

Qemu

tar xvf Heap\ Course\ DEFCON\ 30.ova
qemu-img convert -f vmdk -O qcow2 Heap\ Course\ DEFCON\ 30-disk002.vmdk HeapCourse.qcow2

qemu-system-x86_64 \
    -smp 2 \
    -hda HeapCourse.qcow2 \
    -m 6G \
    -usb \
    -device usb-tablet