Skip to content

house_of_botcake: demonstrate how to malloc back to stack_var#205

Merged
Kyle-Kyle merged 1 commit intoshellphish:masterfrom
tesuji:cake-to-stack
Mar 17, 2025
Merged

house_of_botcake: demonstrate how to malloc back to stack_var#205
Kyle-Kyle merged 1 commit intoshellphish:masterfrom
tesuji:cake-to-stack

Conversation

@tesuji
Copy link
Copy Markdown
Contributor

@tesuji tesuji commented Feb 21, 2025

The files for glibc version below 2.32 is unchanged, cause it is already using tcache poistoning technique
to get malloc returns a stack address.

@Kyle-Kyle
Copy link
Copy Markdown
Contributor

This is essentially using the chunk overlapping primitive to perform a tcache poisoning attack, which makes it clearer for beginners to realize the power of the technique.
However, I'm a little hesitant about merging this because chunk overlapping is a powerful primitive by itself, more than just the ability to perform tcache poisoning attack (for example, read/write other objects).

I think if you could add a sentence explaining what you could do with the chunk overlapping primitive (directly read/write objects, heap metadata etc) and say tcache poisoning attack is just one of them (write to heap metadata) will be great.

@tesuji
Copy link
Copy Markdown
Contributor Author

tesuji commented Feb 21, 2025

Here is a part of the output from the new changes:
image

I'm not great with words so I'm very happy to have feedback.

@Kyle-Kyle
Copy link
Copy Markdown
Contributor

that looks great. Can you please make the changes to all other files?

@tesuji tesuji marked this pull request as ready for review March 5, 2025 20:49
@tesuji
Copy link
Copy Markdown
Contributor Author

tesuji commented Mar 5, 2025

Done. Sorry for keep you waiting! I was busy with other things.

@Kyle-Kyle Kyle-Kyle merged commit d9c79f5 into shellphish:master Mar 17, 2025
12 checks passed
@Kyle-Kyle
Copy link
Copy Markdown
Contributor

thanks for the contribution!

@tesuji tesuji deleted the cake-to-stack branch March 17, 2025 21:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants