added more samples and identified ideal candidates
This commit is contained in:
@@ -0,0 +1,889 @@
|
||||
<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>CTF Write-up: Heap Exploitation in glibc 2.35 | River Rooks</title>
|
||||
<style>
|
||||
@import url('https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:ital,wght@0,400;0,500;0,700;1,400&family=Inter:ital,wght@0,400;0,500;0,700;1,400&family=JetBrains+Mono:ital,wght@0,400;0,500;1,400&display=swap');
|
||||
|
||||
:root {
|
||||
--bg-canvas: #0d0f12; /* Deep slate/charcoal canvas */
|
||||
--bg-surface: #121417; /* Tile surface */
|
||||
--bg-elevated: #1c1f26; /* Hovered surface */
|
||||
--border-color: #2b303b; /* Crisp 1px border */
|
||||
--text-primary: #e0e6f0; /* Light off-white prose */
|
||||
--text-muted: #8a95a5; /* Monospace metadata */
|
||||
--accent-cyan: #00f0ff; /* Active accent */
|
||||
--accent-green: #00e676; /* Success / online */
|
||||
--accent-amber: #ffb700; /* Warning / highlight */
|
||||
--accent-red: #ff5252; /* Critical alert */
|
||||
}
|
||||
|
||||
* {
|
||||
box-sizing: border-box;
|
||||
margin: 0;
|
||||
padding: 0;
|
||||
}
|
||||
|
||||
body {
|
||||
background-color: var(--bg-canvas);
|
||||
color: var(--text-primary);
|
||||
font-family: 'Inter', sans-serif;
|
||||
line-height: 1.7;
|
||||
min-height: 100vh;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
align-items: center;
|
||||
padding: 24px 16px 48px 16px;
|
||||
}
|
||||
|
||||
.tiling-layout {
|
||||
width: 100%;
|
||||
max-width: 1160px;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 16px;
|
||||
}
|
||||
|
||||
/* Top Global Header Bar (Gateway 3 Standard) */
|
||||
.global-bar {
|
||||
background-color: var(--bg-surface);
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 4px;
|
||||
padding: 10px 18px;
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.8rem;
|
||||
flex-wrap: wrap;
|
||||
gap: 10px;
|
||||
}
|
||||
|
||||
.brand-group {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 10px;
|
||||
color: var(--text-primary);
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.status-indicator {
|
||||
width: 8px;
|
||||
height: 8px;
|
||||
background-color: var(--accent-green);
|
||||
display: inline-block;
|
||||
}
|
||||
|
||||
.bar-nav {
|
||||
display: flex;
|
||||
gap: 14px;
|
||||
align-items: center;
|
||||
}
|
||||
|
||||
.bar-link {
|
||||
color: var(--text-muted);
|
||||
text-decoration: none;
|
||||
transition: none;
|
||||
}
|
||||
|
||||
.bar-link:hover {
|
||||
color: var(--accent-cyan);
|
||||
}
|
||||
|
||||
/* Article Workspace: 2-Column Split (Sidebar on Left) */
|
||||
.article-workspace-grid {
|
||||
display: grid;
|
||||
grid-template-columns: 290px 1fr;
|
||||
gap: 16px;
|
||||
align-items: start;
|
||||
}
|
||||
|
||||
@media (max-width: 960px) {
|
||||
.article-workspace-grid {
|
||||
grid-template-columns: 1fr;
|
||||
}
|
||||
}
|
||||
|
||||
/* Left Sidebar */
|
||||
.article-sidebar {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 16px;
|
||||
position: sticky;
|
||||
top: 16px;
|
||||
}
|
||||
|
||||
.sidebar-tile {
|
||||
background-color: var(--bg-surface);
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 4px;
|
||||
padding: 18px;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 12px;
|
||||
}
|
||||
|
||||
.sidebar-heading {
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.82rem;
|
||||
font-weight: 700;
|
||||
color: var(--text-muted);
|
||||
text-transform: uppercase;
|
||||
letter-spacing: 0.05em;
|
||||
border-bottom: 1px solid var(--border-color);
|
||||
padding-bottom: 8px;
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
}
|
||||
|
||||
.toc-nav {
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 4px;
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.78rem;
|
||||
}
|
||||
|
||||
.toc-link {
|
||||
color: var(--text-muted);
|
||||
text-decoration: none;
|
||||
padding: 4px 6px;
|
||||
border-radius: 2px;
|
||||
transition: none;
|
||||
line-height: 1.4;
|
||||
display: block;
|
||||
}
|
||||
|
||||
.toc-link:hover {
|
||||
background-color: var(--bg-elevated);
|
||||
color: var(--accent-cyan);
|
||||
}
|
||||
|
||||
.toc-link.active {
|
||||
color: var(--accent-cyan);
|
||||
background-color: var(--bg-canvas);
|
||||
border-left: 2px solid var(--accent-cyan);
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.toc-sub {
|
||||
padding-left: 14px;
|
||||
color: var(--text-muted);
|
||||
font-size: 0.74rem;
|
||||
}
|
||||
|
||||
/* Collapsible Menu */
|
||||
.collapsible-drawer {
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 3px;
|
||||
background-color: var(--bg-canvas);
|
||||
overflow: hidden;
|
||||
}
|
||||
|
||||
.collapsible-summary {
|
||||
background-color: var(--bg-elevated);
|
||||
padding: 8px 12px;
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.76rem;
|
||||
font-weight: 700;
|
||||
color: var(--text-primary);
|
||||
cursor: pointer;
|
||||
list-style: none;
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
user-select: none;
|
||||
}
|
||||
|
||||
.collapsible-summary::-webkit-details-marker {
|
||||
display: none;
|
||||
}
|
||||
|
||||
.collapsible-summary::after {
|
||||
content: "[+]";
|
||||
color: var(--accent-cyan);
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.collapsible-drawer[open] .collapsible-summary::after {
|
||||
content: "[-]";
|
||||
}
|
||||
|
||||
.drawer-content {
|
||||
padding: 10px;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 8px;
|
||||
}
|
||||
|
||||
.related-card {
|
||||
background-color: var(--bg-surface);
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 2px;
|
||||
padding: 8px 10px;
|
||||
text-decoration: none;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 3px;
|
||||
transition: none;
|
||||
}
|
||||
|
||||
.related-card:hover {
|
||||
border-color: var(--accent-cyan);
|
||||
background-color: var(--bg-elevated);
|
||||
}
|
||||
|
||||
.related-date {
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.7rem;
|
||||
color: var(--accent-cyan);
|
||||
}
|
||||
|
||||
.related-title {
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.8rem;
|
||||
font-weight: 700;
|
||||
color: var(--text-primary);
|
||||
line-height: 1.35;
|
||||
}
|
||||
|
||||
.related-card:hover .related-title {
|
||||
color: var(--accent-cyan);
|
||||
}
|
||||
|
||||
/* Main Article Tile */
|
||||
.article-tile {
|
||||
background-color: var(--bg-surface);
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 4px;
|
||||
padding: 36px 40px;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 24px;
|
||||
}
|
||||
|
||||
@media (max-width: 600px) {
|
||||
.article-tile {
|
||||
padding: 24px 18px;
|
||||
}
|
||||
}
|
||||
|
||||
.article-header-block {
|
||||
border-bottom: 1px solid var(--border-color);
|
||||
padding-bottom: 24px;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 12px;
|
||||
}
|
||||
|
||||
.article-breadcrumbs {
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.78rem;
|
||||
color: var(--text-muted);
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 8px;
|
||||
}
|
||||
|
||||
.article-main-title {
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 2.3rem;
|
||||
font-weight: 700;
|
||||
color: var(--text-primary);
|
||||
letter-spacing: -0.02em;
|
||||
line-height: 1.25;
|
||||
}
|
||||
|
||||
@media (max-width: 768px) {
|
||||
.article-main-title {
|
||||
font-size: 1.8rem;
|
||||
}
|
||||
}
|
||||
|
||||
.article-meta-row {
|
||||
display: flex;
|
||||
flex-wrap: wrap;
|
||||
align-items: center;
|
||||
gap: 14px;
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.8rem;
|
||||
color: var(--text-muted);
|
||||
}
|
||||
|
||||
.tag-chip {
|
||||
background-color: var(--bg-canvas);
|
||||
border: 1px solid var(--border-color);
|
||||
padding: 2px 6px;
|
||||
border-radius: 2px;
|
||||
color: var(--text-muted);
|
||||
}
|
||||
|
||||
/* Markdown Body */
|
||||
.markdown-prose {
|
||||
max-width: 68ch;
|
||||
font-size: 1.02rem;
|
||||
color: var(--text-primary);
|
||||
line-height: 1.7;
|
||||
}
|
||||
|
||||
.markdown-prose p {
|
||||
margin-bottom: 18px;
|
||||
}
|
||||
|
||||
.markdown-prose h2 {
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 1.45rem;
|
||||
font-weight: 700;
|
||||
color: var(--text-primary);
|
||||
margin: 36px 0 16px 0;
|
||||
padding-bottom: 8px;
|
||||
border-bottom: 1px solid var(--border-color);
|
||||
}
|
||||
|
||||
.markdown-prose h3 {
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 1.15rem;
|
||||
font-weight: 700;
|
||||
color: var(--text-primary);
|
||||
margin: 28px 0 12px 0;
|
||||
}
|
||||
|
||||
.markdown-prose code:not(pre code) {
|
||||
font-family: 'JetBrains Mono', monospace;
|
||||
font-size: 0.88rem;
|
||||
background-color: var(--bg-canvas);
|
||||
border: 1px solid var(--border-color);
|
||||
padding: 2px 6px;
|
||||
border-radius: 3px;
|
||||
color: var(--accent-cyan);
|
||||
}
|
||||
|
||||
/* Mathematical / Algorithm Formula Box */
|
||||
.formula-card {
|
||||
background-color: var(--bg-canvas);
|
||||
border: 1px solid var(--border-color);
|
||||
border-left: 3px solid var(--accent-cyan);
|
||||
border-radius: 3px;
|
||||
padding: 14px 18px;
|
||||
margin: 20px 0;
|
||||
font-family: 'JetBrains Mono', monospace;
|
||||
font-size: 0.88rem;
|
||||
line-height: 1.6;
|
||||
}
|
||||
|
||||
.formula-title {
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.76rem;
|
||||
color: var(--text-muted);
|
||||
text-transform: uppercase;
|
||||
margin-bottom: 6px;
|
||||
}
|
||||
|
||||
/* Code Block Containers */
|
||||
.code-block-container {
|
||||
margin: 22px 0;
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 4px;
|
||||
background-color: var(--bg-canvas);
|
||||
overflow: hidden;
|
||||
}
|
||||
|
||||
.code-block-header {
|
||||
background-color: var(--bg-surface);
|
||||
border-bottom: 1px solid var(--border-color);
|
||||
padding: 6px 14px;
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.74rem;
|
||||
color: var(--text-muted);
|
||||
}
|
||||
|
||||
.copy-btn {
|
||||
background: transparent;
|
||||
border: 1px solid var(--border-color);
|
||||
color: var(--text-muted);
|
||||
padding: 2px 8px;
|
||||
font-family: inherit;
|
||||
font-size: 0.72rem;
|
||||
cursor: pointer;
|
||||
border-radius: 2px;
|
||||
transition: none;
|
||||
}
|
||||
|
||||
.copy-btn:hover {
|
||||
border-color: var(--accent-cyan);
|
||||
color: var(--accent-cyan);
|
||||
}
|
||||
|
||||
.code-block-container pre {
|
||||
padding: 14px 16px;
|
||||
overflow-x: auto;
|
||||
font-family: 'JetBrains Mono', monospace;
|
||||
font-size: 0.82rem;
|
||||
line-height: 1.5;
|
||||
color: var(--text-primary);
|
||||
}
|
||||
|
||||
/* GitHub-style Alerts */
|
||||
.markdown-callout {
|
||||
margin: 20px 0;
|
||||
padding: 14px 18px;
|
||||
border-radius: 3px;
|
||||
border: 1px solid var(--border-color);
|
||||
background-color: var(--bg-canvas);
|
||||
font-size: 0.94rem;
|
||||
line-height: 1.6;
|
||||
}
|
||||
|
||||
.callout-caution {
|
||||
border-left: 4px solid var(--accent-red);
|
||||
}
|
||||
|
||||
.callout-note {
|
||||
border-left: 4px solid var(--accent-cyan);
|
||||
}
|
||||
|
||||
.callout-title {
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-weight: 700;
|
||||
font-size: 0.82rem;
|
||||
margin-bottom: 6px;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 6px;
|
||||
}
|
||||
|
||||
.callout-caution .callout-title { color: var(--accent-red); }
|
||||
.callout-note .callout-title { color: var(--accent-cyan); }
|
||||
|
||||
/* Tables */
|
||||
.table-container {
|
||||
width: 100%;
|
||||
overflow-x: auto;
|
||||
margin: 22px 0;
|
||||
}
|
||||
|
||||
.markdown-table {
|
||||
width: 100%;
|
||||
border-collapse: collapse;
|
||||
font-size: 0.84rem;
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
text-align: left;
|
||||
}
|
||||
|
||||
.markdown-table th {
|
||||
background-color: var(--bg-canvas);
|
||||
border: 1px solid var(--border-color);
|
||||
padding: 8px 12px;
|
||||
color: var(--text-muted);
|
||||
font-weight: 700;
|
||||
}
|
||||
|
||||
.markdown-table td {
|
||||
border: 1px solid var(--border-color);
|
||||
padding: 8px 12px;
|
||||
color: var(--text-primary);
|
||||
}
|
||||
|
||||
/* Footnotes Section */
|
||||
.footnotes-section {
|
||||
margin-top: 36px;
|
||||
padding-top: 20px;
|
||||
border-top: 1px solid var(--border-color);
|
||||
font-size: 0.84rem;
|
||||
color: var(--text-muted);
|
||||
}
|
||||
|
||||
.footnote-item {
|
||||
margin-bottom: 8px;
|
||||
}
|
||||
|
||||
/* Global Footer Tile (Gateway 3 Exact Match) */
|
||||
.footer-tile {
|
||||
background-color: var(--bg-surface);
|
||||
border: 1px solid var(--border-color);
|
||||
border-radius: 4px;
|
||||
padding: 12px 20px;
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
font-family: 'IBM Plex Mono', monospace;
|
||||
font-size: 0.78rem;
|
||||
color: var(--text-muted);
|
||||
flex-wrap: wrap;
|
||||
gap: 10px;
|
||||
}
|
||||
|
||||
.footer-links-cluster {
|
||||
display: flex;
|
||||
gap: 12px;
|
||||
align-items: center;
|
||||
}
|
||||
|
||||
.footer-btn {
|
||||
color: var(--text-primary);
|
||||
text-decoration: none;
|
||||
padding: 2px 4px;
|
||||
transition: none;
|
||||
}
|
||||
|
||||
.footer-btn:hover {
|
||||
background-color: var(--accent-cyan);
|
||||
color: var(--bg-canvas);
|
||||
}
|
||||
|
||||
.pipe {
|
||||
color: var(--border-color);
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
|
||||
<main class="tiling-layout">
|
||||
|
||||
<!-- Top Global Header Bar (Gateway 3 Standard) -->
|
||||
<header class="global-bar">
|
||||
<div class="brand-group">
|
||||
<span class="status-indicator"></span>
|
||||
<span>RIVER ROOKS // CTF EXPLOITATION ARCHIVE</span>
|
||||
</div>
|
||||
<nav class="bar-nav" aria-label="Navigation">
|
||||
<a href="service-gateway-tiling.html" class="bar-link">Gateway 3 ↗</a>
|
||||
<a href="blog-tiling-lead.html" class="bar-link">← Back to Blog Feed</a>
|
||||
<a href="https://git.rooks.dev" target="_blank" rel="noopener" class="bar-link">Git Forge</a>
|
||||
<a href="feed.xml" class="bar-link">RSS</a>
|
||||
<a href="index.html" class="bar-link">Catalog ↗</a>
|
||||
</nav>
|
||||
</header>
|
||||
|
||||
<!-- Main Workspace: Sidebar TOC + Reading Canvas -->
|
||||
<div class="article-workspace-grid">
|
||||
|
||||
<!-- Left Sidebar: Document Outline + Collapsible Series -->
|
||||
<aside class="article-sidebar" aria-label="Table of Contents">
|
||||
|
||||
<!-- Outline Tile -->
|
||||
<div class="sidebar-tile">
|
||||
<div class="sidebar-heading">
|
||||
<span>DOCUMENT OUTLINE</span>
|
||||
<span style="color: var(--accent-cyan);">INDEX</span>
|
||||
</div>
|
||||
|
||||
<nav class="toc-nav" aria-label="Table of Contents">
|
||||
<a href="#challenge-intro" class="toc-link active">> 1.0 Challenge Synopsis</a>
|
||||
<a href="#safe-linking" class="toc-link">> 2.0 Safe-Linking Pointer Mangling</a>
|
||||
<a href="#mangling-math" class="toc-link toc-sub">2.1 Mathematical Derivation</a>
|
||||
<a href="#gdb-session" class="toc-link">> 3.0 GDB Memory Inspection</a>
|
||||
<a href="#house-of-apple" class="toc-link">> 4.0 House of Apple Hijacking</a>
|
||||
<a href="#mitigation-matrix" class="toc-link">> 5.0 Mitigation History</a>
|
||||
<a href="#footnotes" class="toc-link">> 6.0 References & Notes</a>
|
||||
</nav>
|
||||
</div>
|
||||
|
||||
<!-- Collapsible Related Dispatches Tile -->
|
||||
<div class="sidebar-tile">
|
||||
<div class="sidebar-heading">
|
||||
<span>SECURITY REPOSITORY</span>
|
||||
<span>DRAWER</span>
|
||||
</div>
|
||||
|
||||
<details class="collapsible-drawer" open>
|
||||
<summary class="collapsible-summary">
|
||||
<span>Security Dispatches (3)</span>
|
||||
</summary>
|
||||
<div class="drawer-content">
|
||||
|
||||
<a href="article-tiling-firmware.html" class="related-card">
|
||||
<span class="related-date">2026-07-20 • 8 min</span>
|
||||
<span class="related-title">Reverse Engineering IoT Firmware: SPI Flash</span>
|
||||
<span style="color: var(--text-muted); font-size: 0.7rem;">[#firmware] [#hardware]</span>
|
||||
</a>
|
||||
|
||||
<a href="article-tiling-traefik.html" class="related-card">
|
||||
<span class="related-date">2026-07-15 • 12 min</span>
|
||||
<span class="related-title">High-Availability Traefik Router with Docker</span>
|
||||
<span style="color: var(--text-muted); font-size: 0.7rem;">[#homelab] [#networking]</span>
|
||||
</a>
|
||||
|
||||
<a href="blog-tiling-lead.html" class="related-card">
|
||||
<span class="related-date">2026-07-10 • 6 min</span>
|
||||
<span class="related-title">POSIX sh vs. Bash: Portability in Modern Scripts</span>
|
||||
<span style="color: var(--text-muted); font-size: 0.7rem;">[#posix-sh] [#unix]</span>
|
||||
</a>
|
||||
|
||||
</div>
|
||||
</details>
|
||||
</div>
|
||||
|
||||
<!-- Target Binary Info Tile -->
|
||||
<div class="sidebar-tile" style="font-family: 'IBM Plex Mono', monospace; font-size: 0.76rem; color: var(--text-muted);">
|
||||
<div style="display: flex; justify-content: space-between; margin-bottom: 6px;">
|
||||
<span>ALLOCATOR:</span>
|
||||
<span style="color: var(--accent-cyan); font-weight: 700;">GLIBC 2.35-0UBUNTU3</span>
|
||||
</div>
|
||||
<div style="display: flex; justify-content: space-between; margin-bottom: 6px;">
|
||||
<span>EXPLOIT PRIMITIVE:</span>
|
||||
<span style="color: var(--accent-amber); font-weight: 700;">TCACHE POISONING</span>
|
||||
</div>
|
||||
<div style="display: flex; justify-content: space-between;">
|
||||
<span>TARGET HOOK:</span>
|
||||
<span style="color: var(--accent-green);">_IO_FILE VTABLE</span>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</aside>
|
||||
|
||||
<!-- Center Article Tile -->
|
||||
<article class="article-tile">
|
||||
|
||||
<!-- Article Header Block -->
|
||||
<header class="article-header-block">
|
||||
<div class="article-breadcrumbs">
|
||||
<span>~/notes/</span>
|
||||
<span>></span>
|
||||
<span style="color: var(--accent-cyan);">ctf-heap-glibc-2-35.md</span>
|
||||
</div>
|
||||
|
||||
<h1 class="article-main-title">CTF Write-up: Heap Exploitation in glibc 2.35</h1>
|
||||
|
||||
<div class="article-meta-row">
|
||||
<div><span style="color: var(--accent-cyan);">2026-06-28</span></div>
|
||||
<span>•</span>
|
||||
<div><span>15 MIN READ</span></div>
|
||||
<span>•</span>
|
||||
<div><span>AUTHOR: RIVER ROOKS</span></div>
|
||||
<span>•</span>
|
||||
<div>
|
||||
<span class="tag-chip">[#ctf]</span>
|
||||
<span class="tag-chip">[#binary-exploitation]</span>
|
||||
<span class="tag-chip">[#security]</span>
|
||||
<span class="tag-chip">[#glibc]</span>
|
||||
</div>
|
||||
</div>
|
||||
</header>
|
||||
|
||||
<!-- Markdown Prose Content -->
|
||||
<div class="markdown-prose">
|
||||
|
||||
<h2 id="challenge-intro">1.0 Challenge Synopsis</h2>
|
||||
<p>
|
||||
During the DEFCON qualifier challenges, our team encountered a hardened 64-bit Linux binary linked against <code>glibc 2.35</code>. Standard legacy heap exploitation techniques—such as poisoning <code>__malloc_hook</code> or <code>__free_hook</code>—are rendered obsolete because upstream glibc maintainers removed all allocation hook pointer symbols entirely in version 2.34.
|
||||
</p>
|
||||
<p>
|
||||
This write-up covers breaking modern <strong>tcache safe-linking pointer mangling</strong> and redirecting execution control flow using the <strong>House of Apple 2</strong> technique against the wide character vtable pointers inside <code>_IO_FILE</code> structures.
|
||||
</p>
|
||||
|
||||
<h2 id="safe-linking">2.0 Safe-Linking Pointer Mangling</h2>
|
||||
<p>
|
||||
Introduced in glibc 2.32, safe-linking protects single-linked singly linked list pointers (such as entries inside the Thread Local Cache <code>tcache</code> and fastbins) against off-by-one overwrites and UAF corruption.
|
||||
</p>
|
||||
|
||||
<h3 id="mangling-math">2.1 Mathematical Derivation</h3>
|
||||
|
||||
<!-- Formula Callout Box Showcase -->
|
||||
<div class="formula-card">
|
||||
<div class="formula-title">POINTER MANGLING FORMULA</div>
|
||||
<div>Mangled_Pointer (P') = (Address_of_Chunk >> 12) ^ Target_Pointer (P)</div>
|
||||
</div>
|
||||
|
||||
<p>
|
||||
Since the lowest 12 bits of <code>Address_of_Chunk >> 12</code> are randomized by ASLR, overwriting <code>P'</code> directly without an address leak causes the kernel to dereference invalid virtual memory pages, aborting with <code>SIGSEGV</code>.
|
||||
</p>
|
||||
<p>
|
||||
However, when an arbitrary read primitive leaks the mangled value of the terminal chunk in the tcache bin (where <code>Target_Pointer = NULL</code>), the equation simplifies:
|
||||
</p>
|
||||
|
||||
<div class="formula-card">
|
||||
<div>Leaked_Mangled = (Chunk_Addr >> 12) ^ 0x0 ==> ASLR_Key = Leaked_Mangled</div>
|
||||
</div>
|
||||
|
||||
<!-- Alert Callout Showcase -->
|
||||
<div class="markdown-callout callout-caution">
|
||||
<div class="callout-title">[!CAUTION] Pointer Alignment Constraints</div>
|
||||
<p>
|
||||
In glibc 2.35, chunks inserted into tcache bins must also adhere to strict 16-byte address alignment. Forging a fake chunk unaligned to a 16-byte boundary triggers <code>malloc(): unaligned tcache chunk detected</code> aborts.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<h2 id="gdb-session">3.0 GDB Memory Inspection</h2>
|
||||
<p>
|
||||
Attaching GDB with the <code>pwndbg</code> extension confirms the tcache bin layout and reveals the mangled pointer representation in memory:
|
||||
</p>
|
||||
|
||||
<!-- Code Block Showcase -->
|
||||
<div class="code-block-container">
|
||||
<div class="code-block-header">
|
||||
<div class="code-title">
|
||||
<span>gdb-pwndbg stdout: heap inspection</span>
|
||||
<span>GDB</span>
|
||||
</div>
|
||||
<button class="copy-btn" onclick="copySnippet(this)">Copy GDB</button>
|
||||
</div>
|
||||
<pre><code>pwndbg> tcachebins
|
||||
tcachebins
|
||||
0x40 [ 2]: 0x55555555a2a0 → 0x55555555a260
|
||||
pwndbg> x/4gx 0x55555555a2a0
|
||||
0x55555555a2a0: 0x0000555555550730 0x0000000000000000
|
||||
0x55555555a2b0: 0x0000000000000000 0x0000000000000041
|
||||
pwndbg> tele 0x55555555a2a0
|
||||
00:0000 │ 0x55555555a2a0 → 0x555555550730 (MANGLED POINTER: 0x55555555a260 ^ (0x55555555a >> 12))</code></pre>
|
||||
</div>
|
||||
|
||||
<h2 id="house-of-apple">4.0 House of Apple Hijacking</h2>
|
||||
<p>
|
||||
With the ability to allocate chunks onto arbitrary memory addresses via tcache poisoning, we target <code>_IO_list_all</code>. When <code>exit()</code> or <code>abort()</code> is invoked by the runtime, the glibc standard I/O cleanup routine iterates through the <code>_IO_FILE</code> linked list and invokes <code>_IO_wfile_overflow()</code>:
|
||||
</p>
|
||||
|
||||
<!-- C Exploit Snippet Showcase -->
|
||||
<div class="code-block-container">
|
||||
<div class="code-block-header">
|
||||
<div class="code-title">
|
||||
<span>house_of_apple_payload.c</span>
|
||||
<span>C99</span>
|
||||
</div>
|
||||
<button class="copy-btn" onclick="copySnippet(this)">Copy C Code</button>
|
||||
</div>
|
||||
<pre><code>// Constructing fake _IO_FILE_plus structure
|
||||
struct _IO_FILE_plus *fake_file = (struct _IO_FILE_plus *)payload;
|
||||
fake_file->file._flags = 0x6873; // "sh" in ASCII
|
||||
fake_file->file._mode = 1; // Force wide character stream mode
|
||||
fake_file->vtable = (const struct _IO_jump_t *)wide_vtable_addr;
|
||||
|
||||
// Trigger call to system("/bin/sh") on stream flush
|
||||
fake_file->file._wide_data->_wide_vtable->doallocate = (void *)system_addr;</code></pre>
|
||||
</div>
|
||||
|
||||
<h2 id="mitigation-matrix">5.0 Glibc Heap Mitigation History</h2>
|
||||
<p>
|
||||
Tracking defensive hardening milestones across recent glibc releases:
|
||||
</p>
|
||||
|
||||
<!-- Table Showcase -->
|
||||
<div class="table-container">
|
||||
<table class="markdown-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>glibc Version</th>
|
||||
<th>Defensive Mitigation Added</th>
|
||||
<th>Status</th>
|
||||
<th>Impact on Attackers</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td><code>2.26</code></td>
|
||||
<td>Thread Cache (tcache) introduced</td>
|
||||
<td>Active</td>
|
||||
<td>Initially lacked double-free and count sanity checks.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>2.29</code></td>
|
||||
<td>tcache double-free check (key field)</td>
|
||||
<td>Active</td>
|
||||
<td>Stores pointer to tcache struct in chunk data.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>2.32</code></td>
|
||||
<td>Safe-Linking Pointer Mangling</td>
|
||||
<td>Hardened</td>
|
||||
<td>Requires ASLR heap base leak to forge pointers.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>2.34</code></td>
|
||||
<td>Removal of <code>__malloc_hook</code> / <code>__free_hook</code></td>
|
||||
<td>Enforced</td>
|
||||
<td>Forces targeting of <code>_IO_FILE</code> and stack frames.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>2.35</code></td>
|
||||
<td>Alignment verification on tcache chunks</td>
|
||||
<td>Enforced</td>
|
||||
<td>Eliminates misaligned chunk allocations entirely.</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
|
||||
<!-- Footnotes Section Showcase -->
|
||||
<div class="footnotes-section" id="footnotes">
|
||||
<div class="footnote-item">
|
||||
<sup>[1]</sup> Safe-Linking was first proposed by Eyal Itkin for memory allocators in modern operating systems.
|
||||
</div>
|
||||
<div class="footnote-item">
|
||||
<sup>[2]</sup> House of Apple exploitation methodology authored by roderickchan, targeting wide character I/O functions.
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
</article>
|
||||
|
||||
</div>
|
||||
|
||||
<!-- Global Footer Tile (Gateway 3 Exact Match) -->
|
||||
<footer class="footer-tile">
|
||||
<div>River Rooks • University of Alabama College of Engineering</div>
|
||||
<nav class="footer-links-cluster" aria-label="Global Footer Links">
|
||||
<a href="service-gateway-tiling.html" class="footer-btn">Gateway Lander</a>
|
||||
<span class="pipe">|</span>
|
||||
<a href="feed.xml" class="footer-btn">RSS</a>
|
||||
<span class="pipe">|</span>
|
||||
<a href="https://git.rooks.dev" target="_blank" rel="noopener" class="footer-btn">Forgejo</a>
|
||||
<span class="pipe">|</span>
|
||||
<a href="mailto:river@rooks.dev" class="footer-btn">river@rooks.dev</a>
|
||||
<span class="pipe">|</span>
|
||||
<a href="#" title="Fingerprint: 0x4A8E92F1C0B3D4E7" class="footer-btn">PGP</a>
|
||||
<span class="pipe">|</span>
|
||||
<a href="index.html" class="footer-btn">Catalog ↗</a>
|
||||
</nav>
|
||||
</footer>
|
||||
|
||||
</main>
|
||||
|
||||
<script>
|
||||
function copySnippet(btn) {
|
||||
const code = btn.closest('.code-block-container').querySelector('pre').innerText;
|
||||
navigator.clipboard.writeText(code).then(() => {
|
||||
const orig = btn.innerText;
|
||||
btn.innerText = 'Copied!';
|
||||
btn.style.color = 'var(--accent-green)';
|
||||
btn.style.borderColor = 'var(--accent-green)';
|
||||
setTimeout(() => {
|
||||
btn.innerText = orig;
|
||||
btn.style.color = '';
|
||||
btn.style.borderColor = '';
|
||||
}, 1800);
|
||||
});
|
||||
}
|
||||
|
||||
// ScrollSpy for TOC
|
||||
window.addEventListener('DOMContentLoaded', () => {
|
||||
const links = document.querySelectorAll('.toc-link');
|
||||
const sections = [];
|
||||
|
||||
links.forEach(link => {
|
||||
const targetId = link.getAttribute('href').substring(1);
|
||||
const section = document.getElementById(targetId);
|
||||
if (section) sections.push({ link, section });
|
||||
});
|
||||
|
||||
window.addEventListener('scroll', () => {
|
||||
const scrollPos = window.scrollY + 100;
|
||||
for (let i = sections.length - 1; i >= 0; i--) {
|
||||
if (sections[i].section.offsetTop <= scrollPos) {
|
||||
links.forEach(l => l.classList.remove('active'));
|
||||
sections[i].link.classList.add('active');
|
||||
break;
|
||||
}
|
||||
}
|
||||
});
|
||||
});
|
||||
</script>
|
||||
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user