You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ We came up with the idea during a hack meeting, and have implemented the followi
23
23
|[house_of_force.c](glibc_2.27/house_of_force.c)| <ahref="https://wargames.ret2.systems/level/how2heap_house_of_force_2.27"title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the Top Chunk (Wilderness) header in order to get malloc to return a nearly-arbitrary pointer | < 2.29 |[patch](https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=30a17d8c95fbfb15c52d1115803b63aaa73a285c)|[Boston Key Party 2016-cookbook](https://github.com/ctfs/write-ups-2016/tree/master/boston-key-party-2016/pwn/cookbook-6), [BCTF 2016-bcloud](https://github.com/ctfs/write-ups-2016/tree/master/bctf-2016/exploit/bcloud-200)|
24
24
|[unsorted_bin_into_stack.c](glibc_2.27/unsorted_bin_into_stack.c)| <ahref="https://wargames.ret2.systems/level/how2heap_unsorted_bin_into_stack_2.23"title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the overwrite of a freed chunk on unsorted bin freelist to return a nearly-arbitrary pointer. | < 2.29 |[patch](https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=b90ddd08f6dd688e651df9ee89ca3a69ff88cd0c)||
25
25
|[unsorted_bin_attack.c](glibc_2.27/unsorted_bin_attack.c)| <ahref="https://wargames.ret2.systems/level/how2heap_unsorted_bin_attack_2.27"title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the overwrite of a freed chunk on unsorted bin freelist to write a large value into arbitrary address | < 2.29 |[patch](https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=b90ddd08f6dd688e651df9ee89ca3a69ff88cd0c)|[0ctf 2016-zerostorage](https://github.com/ctfs/write-ups-2016/tree/master/0ctf-2016/exploit/zerostorage-6)|
26
-
|[large_bin_attack.c](glibc_2.35/large_bin_attack.c)| <ahref="https://wargames.ret2.systems/level/how2heap_large_bin_attack_2.34"title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the overwrite of a freed chunk on large bin freelist to write a large value into arbitrary address |latest ||[0ctf 2018-heapstorm2](https://dangokyo.me/2018/04/07/0ctf-2018-pwn-heapstorm2-write-up/)|
26
+
|[large_bin_attack.c](glibc_2.35/large_bin_attack.c)| <ahref="https://wargames.ret2.systems/level/how2heap_large_bin_attack_2.34"title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting the overwrite of a freed chunk on large bin freelist to write a large value into arbitrary address |< 2.42 |[patch](https://patchwork.sourceware.org/project/glibc/patch/20250214053454.2346370-1-benjamin.p.kallus.gr@dartmouth.edu/)|[0ctf 2018-heapstorm2](https://dangokyo.me/2018/04/07/0ctf-2018-pwn-heapstorm2-write-up/)|
27
27
|[house_of_einherjar.c](glibc_2.35/house_of_einherjar.c)| <ahref="https://wargames.ret2.systems/level/how2heap_house_of_einherjar_2.34"title="Debug Technique In Browser">:arrow_forward:</a> | Exploiting a single null byte overflow to trick malloc into returning a controlled pointer | latest ||[Seccon 2016-tinypad](https://gist.github.com/hhc0null/4424a2a19a60c7f44e543e32190aaabf)|
28
28
|[house_of_water.c](glibc_2.36/house_of_water.c)|| Exploit a UAF or double free to gain leakless control of the t-cache metadata and a leakless way to link libc in t-cache | latest ||[37c3 Potluck - Tamagoyaki](https://github.com/UDPctf/CTF-challenges/tree/main/Potluck-CTF-2023/Tamagoyaki)|
29
29
|[sysmalloc_int_free.c](glibc_2.39/sysmalloc_int_free.c)|| Demonstrating freeing the nearly arbitrary sized Top Chunk (Wilderness) using malloc (sysmalloc `_int_free()` ) | latest |||
0 commit comments