Comments (4)
There is already a PoC in the webpage itself (just in case you haven't seen it): House of Rabbit.
It seems quite impractical without a scripting environment as you would need to write three times to the variable you control but really interesting however. Kudos for the creativity!
from how2heap.
I have been doing further analysis on this and it is a very similar vector to the house of force in the sense that it will trick the allocator to let us do a malloc of a huge size which will wrap around to our desired position.
However, it does not really defeat ASLR as the variables are always to the same offset from one another, and they are sitting on non-randomised data sections (.BSS and .data).
In this asciinema you can see the program running for a few seconds where target
and gbuf
are always on the same positions and offsets.
Other than overwriting variables in the global data sections (which already are not randomised), I don't see any ASLR bypass as all other addresses are randomised properly.
from how2heap.
House of rabbit won't be included here because there is some POC on the internet or that the attack is impractical? Asking because I've found a POC of another (very interesting for me) attack.
from how2heap.
No, I simply didn't had the time to deal with it yet. In general there is nothing that would speak against including it, if it is a novel way of exploiting the heap. However, I'm not super happy about attacks like house_of_orange, because even though they are super awesome techniques, they result from some specific exploit case and include multiple techniques to achieve certain states and most of them are not really novel by themselves. Still they are super fun and astonishing attacks, but maybe we should split them up more clearly to fit better into the idea of how2heap.
from how2heap.
Related Issues (20)
- wrong in unsafe_unlink.c in glibc2.31 HOT 1
- something not clearly when calculating on the size of padding in poision_null_byte.c in glibc2.31 HOT 9
- Shellphish
- tcache attacks on glibc2.27 no longer work on ubuntu 18.04 HOT 13
- House of Storm POC Randomization Issue HOT 12
- house_of_lore.c in glibc_2.31 is incorrect HOT 3
- House of Lore redundancy HOT 1
- tcache_dup.c link in readme points to 404 page HOT 2
- Add some heap information HOT 2
- House of spirit HOT 12
- House of lore HOT 3
- House of Gods HOT 25
- how2heap indexed JSON files HOT 4
- Not working on ubuntu 22.04, version `GLIBC_2.34' not found HOT 6
- New little trick in ptmalloc HOT 5
- "Complete Setup" doesn't work -> version `GLIBC_2.34' not found HOT 10
- [Feature] Link libc during compile time instead of using ./glibc_run.sh HOT 9
- fastbin_dup_consolidate wrong technique description HOT 1
- fastbin_dup_consolidate wrong explanation HOT 4
- unsafe_unlink links to old unlink_chunk function HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from how2heap.