house_of_botcake: demonstrate how to malloc back to stack_var#205
house_of_botcake: demonstrate how to malloc back to stack_var#205Kyle-Kyle merged 1 commit intoshellphish:masterfrom
stack_var#205Conversation
|
This is essentially using the chunk overlapping primitive to perform a tcache poisoning attack, which makes it clearer for beginners to realize the power of the technique. I think if you could add a sentence explaining what you could do with the chunk overlapping primitive (directly read/write objects, heap metadata etc) and say tcache poisoning attack is just one of them (write to heap metadata) will be great. |
|
that looks great. Can you please make the changes to all other files? |
|
Done. Sorry for keep you waiting! I was busy with other things. |
|
thanks for the contribution! |

The files for glibc version below 2.32 is unchanged, cause it is already using tcache poistoning technique
to get malloc returns a stack address.