https://algoatson.github.io/series/glibc-heap-exploitation/ glibc 2.34 deleted __free_hook and __malloc_hook, and everyone's muscle memory broke. The modern answer is to forge a FILE — but the vtable is validated now. House of Apple 2 slips past that check by abusing a legitimate vtable that dereferences a second, unchecked one. en Tue, 16 Jun 2026 02:47:52 +0000 https://algoatson.github.io/p/glibc-heap-internals/ https://algoatson.github.io/p/glibc-heap-internals/ Mon, 08 Jun 2026 00:00:00 +0000 heappwnglibc Part 1 of the heap series — the only internals that matter for exploitation: chunk anatomy, the size field's flag bits, and the six places a free chunk can live (tcache, fastbins, unsorted, small, large, top). Everything later is corrupting one of these on purpose. https://algoatson.github.io/p/house-of-force/ https://algoatson.github.io/p/house-of-force/ Tue, 09 Jun 2026 00:00:00 +0000 heappwnglibc Part 2 — overwrite the top chunk's size with -1 and malloc will hand you a chunk anywhere in the address space. The cleanest "arbitrary allocation" there ever was, and a clean look at why glibc 2.29 killed it. https://algoatson.github.io/p/fastbin-dup/ https://algoatson.github.io/p/fastbin-dup/ Thu, 11 Jun 2026 00:00:00 +0000 heappwnglibc Part 3 — free a fastchunk twice past glibc's one-line double-free check, get the same chunk handed out twice, then poison its fd to allocate straight onto __malloc_hook. The classic that teaches "allocate where you want". https://algoatson.github.io/p/unsafe-unlink/ https://algoatson.github.io/p/unsafe-unlink/ Fri, 12 Jun 2026 00:00:00 +0000 heappwnglibc Part 4 — when a free chunk is pulled out of a doubly-linked list, four pointer writes happen. Forge the pointers and one of them lands wherever you want. Then the modern twist: how to pass the "corrupted double-linked list" check that was supposed to kill this. https://algoatson.github.io/p/the-unsorted-bin-attack/ https://algoatson.github.io/p/the-unsorted-bin-attack/ Sat, 13 Jun 2026 00:00:00 +0000 heappwnglibc Part 5 — corrupt one freed chunk's bk and the next malloc writes a libc pointer to an address you choose. You control WHERE, not WHAT — which sounds useless until you aim it at global_max_fast and unlock the whole fastbin. https://algoatson.github.io/p/tcache-poisoning-explained/ https://algoatson.github.io/p/tcache-poisoning-explained/ Sun, 18 Jan 2026 00:00:00 +0000 heappwnglibc a from-scratch walk through the most reliable beginner heap primitive — what the tcache is, why poisoning works, and how safe-linking changed the recipe. Educational target, not a real CVE. https://algoatson.github.io/p/house-of-spirit/ https://algoatson.github.io/p/house-of-spirit/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 7 — instead of corrupting a real chunk, you forge a fake one in memory you already control and trick free() into filing it away. The next malloc hands it right back, so you get malloc to return the stack. https://algoatson.github.io/p/poison-null-byte/ https://algoatson.github.io/p/poison-null-byte/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 8 — the most innocent-looking heap bug there is: one null byte written one byte too far. It lands on a neighbouring chunk's size field, desyncs the allocator's bookkeeping, and ends with two chunks overlapping the same memory. https://algoatson.github.io/p/the-house-of-orange/ https://algoatson.github.io/p/the-house-of-orange/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 9, the capstone — no free() in the binary at all. Force malloc to free the top chunk for you, leak libc from it, then turn the unsorted bin attack into a forged FILE struct whose vtable call drops a shell. Heap meets FSOP. https://algoatson.github.io/p/tcache-dup/ https://algoatson.github.io/p/tcache-dup/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 10 — the fastbin dup's lazier cousin. The tcache had no double-free check at all for two glibc releases, and the one it finally got is a single field you can overwrite. Free a chunk twice, get it twice, poison. https://algoatson.github.io/p/the-house-of-einherjar/ https://algoatson.github.io/p/the-house-of-einherjar/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 11 — one null byte clears a chunk's PREV_INUSE, a forged prev_size says "the previous chunk starts way over there", and free() consolidates backward into a fake chunk you placed anywhere. Arbitrary allocation from a single off-by-one. https://algoatson.github.io/p/the-house-of-lore/ https://algoatson.github.io/p/the-house-of-lore/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 12 — the smallbins are doubly-linked and handed out from the tail. Overwrite a smallbin chunk's bk to point at a fake chunk and malloc will walk right into it, returning a chunk on the stack. The unlink check just needs a back-pointer. https://algoatson.github.io/p/the-house-of-rabbit/ https://algoatson.github.io/p/the-house-of-rabbit/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 13 — fastbins don't consolidate… until malloc_consolidate sweeps them. Forge a fastbin chunk's size to something enormous, trigger the sweep, and that little chunk becomes a giant free chunk overlapping everything after it. Overlap from almost no primitive. https://algoatson.github.io/p/the-house-of-corrosion/ https://algoatson.github.io/p/the-house-of-corrosion/ Sun, 14 Jun 2026 00:00:00 +0000 heappwnglibc Part 14, the finale — for the challenge that gives you no libc leak and barely any allocations. Blow open global_max_fast and the fastbin index arithmetic starts pointing into libc itself, turning "free a chunk of size N" into "write a heap pointer to a libc address". Bootstrap a leak from nothing. https://algoatson.github.io/p/tcache-stashing-unlink/ https://algoatson.github.io/p/tcache-stashing-unlink/ Thu, 04 Jun 2026 00:00:00 +0000 heappwnglibc When a smallbin serves a request, glibc stashes the leftover chunks into the tcache — and that stashing does a doubly-linked-list unlink with a far weaker check than the real thing. Corrupt one bk pointer and you get a libc write and an allocation at an address you choose. https://algoatson.github.io/p/house-of-apple-2/ https://algoatson.github.io/p/house-of-apple-2/ Mon, 15 Jun 2026 00:00:00 +0000 heappwnglibcfsop glibc 2.34 deleted __free_hook and __malloc_hook, and everyone's muscle memory broke. The modern answer is to forge a FILE — but the vtable is validated now. House of Apple 2 slips past that check by abusing a legitimate vtable that dereferences a second, unchecked one.