# Core Heap Exploitation

> Heap exploitation playbook: freelist poisoning, tcache/safe-linking, UAF, double-free, house-of-*, Windows segment heap primitives.

- Skill: `netvar1337/core-heap-exploitation` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add netvar1337/core-heap-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/core-heap-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: GPL-3.0-or-later
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/core-heap-exploitation

---


# Heap exploitation playbook

## Primitive goals
- Write-what-where
- Controlled allocation content (fake objects)
- Leaks (heap/libc/base)
- Code exec via fp/vptr/`__free_hook` historical / exit handlers / stack pivot

## Linux glibc menu (version-sensitive)
| Technique | Idea |
|---|---|
| tcache poison | overwrite fd → arbitrary alloc |
| safe-linking bypass | need heap leak to craft fd |
| fastbin/dup | double-free constrained |
| unsorted bin leak | libc leak via fd/bk |
| largebin/attack variants | arb write primitives on older |
| house-of-* | various; check libc series |

Always pin **exact libc** and secure flags.

## Windows menu
- LFH userblock corruption → controlled realloc content
- Backend freelist (legacy) vs segment heap VSIs
- FreeEntryOffset style attacks (historical) — verify OS build
- Prefer application-logic UAF of C++ objects for reliability

## UAF / double-free
1. Free while dangling ref remains
2. Reclaim with controlled type (spray)
3. Reinterpret fields (vptr, length, callback)
4. Avoid modern freelist hardening when possible by staying in object layer

## Grooming discipline
- Record allocator class/size
- Deterministic spray counts
- Thread pinning if concurrent heaps

## Pair with
`heap-overflow`, `use-after-free`, `integer-overflow`, `vuln-research`.