netvar1337 Heap exploitation playbook
Primitive goals
- Write-what-where
- Controlled allocation content (fake objects)
- Leaks (heap/libc/base)
- Code exec via fp/vptr/
__free_hookhistorical / exit handlers / stack pivot
Linux glibc menu (version-sensitive)
| Technique | Idea |
|---|---|
| tcache poison | overwrite fd → arbitrary alloc |
| safe-linking bypass | need heap leak to craft fd |
| fastbin/dup | double-free constrained |
| unsorted bin leak | libc leak via fd/bk |
| largebin/attack variants | arb write primitives on older |
| house-of-* | various; check libc series |
Always pin exact libc and secure flags.
Windows menu
- LFH userblock corruption → controlled realloc content
- Backend freelist (legacy) vs segment heap VSIs
- FreeEntryOffset style attacks (historical) — verify OS build
- Prefer application-logic UAF of C++ objects for reliability
UAF / double-free
- Free while dangling ref remains
- Reclaim with controlled type (spray)
- Reinterpret fields (vptr, length, callback)
- Avoid modern freelist hardening when possible by staying in object layer
Grooming discipline
- Record allocator class/size
- Deterministic spray counts
- Thread pinning if concurrent heaps
Pair with
heap-overflow, use-after-free, integer-overflow, vuln-research.