Tie-In to Lab 6
- Lab 6 (Heap corruption: UAF, tcache) puts this class into practice on the isolated Badger CTF platform.
- You will:
- Identify a use-after-free / double-free in a provided binary.
- Use pwndbg (
heap,bins,vis_heap_chunks) to map the layout. - Perform tcache poisoning to obtain an arbitrary write.
- Redirect control flow to reach a shell, then read the flag.
- Check the target's glibc version with
checksecand by inspecting the libc: it determines which mitigations (key, safe-linking, hooks) you must account for.
Key Takeaway
Layout first, primitive second, target last — and confirm every step in the debugger before firing the exploit.