Pwn 20. Unsafe Unlink in unsorted bins
SPbCTF Meeting (https://vk.com/spbctf)
Egor demonstrates how to attack unsorted bins on the heap—they're built on doubly linked lists, so they can be attacked with the Unsafe Unlink attack: if we can reset prev_in_use on the chunk being freed and forge a fake header before it, we can force the pointer to point to itself, thus achieving an arbitrary write. Solve problems — https://pwn.spbctf.ru
✄ − − − − − − − − − − − − − − − − − − − − − −
If you liked our materials and found them helpful, please support the community with a donation: https://donate.spbctf.ru
CTF in St. Petersburg (SPbCTF) is an open, independent competitive hacking community based in St. Petersburg. We conduct computer security seminars and training sessions for students and schoolchildren in the city in the format of CTF competitions. We also organize competitions, educational intensives for universities and companies, and host events and master classes at conferences. We post edited recordings of our meetings on YouTube, discuss tasks, and stream for fun.
Read: https://vk.com/spbctf
Ask a question in the chat: https://t.me/spbctf
Subscribe to news: https://t.me/spbctfnews and our https://github.com/SPbCTF
Follow the movements of the community mascot: / theblzh2017
Write: [email protected]
0:00 Removing elements from doubly linked lists
15:10 Where are doubly linked lists in the allocator
22:23 Current mitigations in libc
24:42 Unsafe Unlink attack on the allocator
1:18:58 Unsafe Unlink demo based on how2heap
1:25:57 Mic Check analysis — ulnk
1:29:02 Mic Check analysis — ulnk2