本项目主要为How2heap提供了一份中文翻译，尽可能的做到尊重原文，便于读者理解。

如果有帮到各位师傅，还请动动手点个Star吧！如果发现本文有任何谬误或对本文有任何建议，欢迎提交commit。

正在施工中。。。

这个仓库用于学习各种堆利用技术。我们使用Ubuntu的Libc版本作为黄金标准。每种技术都经过验证的，可以在相应的Ubuntu版本上正常工作。您可以运行“apt source libc6”来下载您在基于Debian的操作系统上使用的Libc的源代码。您还可以单击:arrow_forward:使用gdb在浏览器中调试技术。

我们在黑客会议期间想出了这个想法，并实现了以下技术：

获取仓库

$ git clone https://github.com/ffreeez/how2heap_zh
$ cd ./how2heap_zh
$ git submodule update --init --recursive

在根目录下直接make即可

$ cd ./how2heap_zh
$ make

使用glibc_run.sh来执行可执行文件，可以更方便的替换glibc 在使用这个脚本之前，需要安装patchelf，并且要在glibc-all-in-one项目中更新可下载的列表

$ sudo apt install patchelf

$ cd ./how2heap_zh/glibc-all-in-one
$ chmod +x ./*
$ ./update_list

执行update_list时，可能会提示-bash: ./update_list: /usr/bin/python: bad interpreter: No such file or directory ，在文本编辑器中把update_list文件中的第一行#!/usr/bin/python改为#!/usr/bin/python3即可

[用法] ./glibc_run.sh <glibc版本号> <可执行文件> [-h] [-i686] [-u] [-r] [-gdb | -r2 | -p]
-i686 -使用32位的libc
-u 在glibc-all-in-one中更新libc列表
-r 在glibc-all-in-one中下载libc
-gdb -在gdb中执行目标文件
-r2 -在radare2中执行目标文件
-p -只在可执行文件中修改interpreter和rpath来指向对应的glibc并且不执行

eg: ./glibc_run.sh 2.23 ./first_fit

Gnu Libc 正在不断发展，上面的几种技术已经允许在 malloc/free 逻辑中引入一致性检查。 因此，这些检查会定期破坏某些技术，并需要进行调整以绕过它们（如果可能）。 我们通过为每个需要调整的 Glibc 版本保留相同技术的多个版本来解决此问题。 项目结构为glibc_<version>/技术名称.c

这里有一些广为流传的堆利用工具，具体内容暂不做翻译（懒懒。

jemalloc exploitation framework: https://github.com/CENSUS/shadow

Examine the glibc heap in gdb: https://github.com/cloudburst/libheap

Examine the glibc heap in IDA Pro: https://github.com/danigargu/heap-viewer

A Python based heap playground with good visualization for educational purposes: https://github.com/matrix1001/heapinspect

Debugger that lets you set "checkpoints" as well as view and edit the heap using a hexeditor: https://github.com/haxkor/forkever

The malloc_playground.c file given is the source for a program that prompts the user for commands to allocate and free memory interactively.

Examine the glibc heap in gdb: https://github.com/scwuaptx/Pwngdb

Helps you visualize heap operations by replacing addresses with symbols: https://github.com/Arinerron/heaptrace

Search for applicable heap exploitation techniques based on primitive requirements: https://kissprogramming.com/heap/heap-search

Some good heap exploitation resources, roughly in order of their publication, are:

• glibc in-depth tutorial (https://heap-exploitation.dhavalkapil.com/) - book and exploit samples
• ptmalloc fanzine, a set of resources and examples related to meta-data attacks on ptmalloc (http://tukan.farm/2016/07/26/ptmalloc-fanzine/)
• A malloc diagram, from libheap (https://raw.githubusercontent.com/cloudburst/libheap/master/heap.png)
• Glibc Adventures: The Forgotten Chunk (https://go.contextis.com/rs/140-OCV-459/images/Glibc_Adventures-The_Forgotten_Chunks.pdf) - advanced heap exploitation
• Pseudomonarchia jemallocum (http://www.phrack.org/issues/68/10.html)
• The House Of Lore: Reloaded (http://phrack.org/issues/67/8.html)
• Malloc Des-Maleficarum (http://phrack.org/issues/66/10.html) - some malloc exploitation techniques
• Yet another free() exploitation technique (http://phrack.org/issues/66/6.html)
• Understanding the heap by breaking it (https://www.blackhat.com/presentations/bh-usa-07/Ferguson/Whitepaper/bh-usa-07-ferguson-WP.pdf) - explains heap implementation and a couple exploits
• The use of set_head to defeat the wilderness (http://phrack.org/issues/64/9.html)
• The Malloc Maleficarum (http://seclists.org/bugtraq/2005/Oct/118)
• OS X heap exploitation techniques (http://phrack.org/issues/63/5.html)
• Exploiting The Wilderness (http://seclists.org/vuln-dev/2004/Feb/25)
• Advanced Doug lea's malloc exploits (http://phrack.org/issues/61/6.html)
• GDB Enhanced Features (GEF) Heap Exploration Tools (https://gef.readthedocs.io/en/master/commands/heap/)
• Painless intro to the Linux userland heap (https://sensepost.com/blog/2017/painless-intro-to-the-linux-userland-heap/)
• Heap exploitation techniques that work on glibc-2.31 (https://github.com/StarCross-Tech/heap_exploit_2.31)
• Overview of GLIBC heap exploitation techniques (https://0x434b.dev/overview-of-glibc-heap-exploitation-techniques/)

There are a couple of "hardening" measures embedded in glibc, like export MALLOC_CHECK_=1 (enables some checks), export MALLOC_PERTURB_=1 (data is overwritten), export MALLOC_MMAP_THRESHOLD_=1 (always use mmap()), ...

More info: mcheck(), mallopt().

There's also some tracing support as mtrace(), malloc_stats(), malloc_info(), memusage, and in other functions in this family.