CSC 472 · Lab 6

Heap Exploitation: Use-After-Free and tcache

glibc heap: a dangling pointer to a freed chunk becomes a read/write primitive.

The goals of this lab:

Understand the glibc heap allocator (chunks, bins, and the tcache).
Exploit a use-after-free (UAF) to leak information and to corrupt allocator metadata.
Turn a UAF / tcache poisoning primitive into control flow and a shell.

Background

The stack defenses you have seen (canaries) do not protect the heap. The provided lab6_heap is a "note manager" that free()s a note but never clears the pointer, leaving a dangling pointer. You can still show a freed note (a read/leak primitive) and edit it (a write primitive).

glibc keeps recently freed small chunks in a per-thread tcache: a singly linked LIFO list where each free chunk's first 8 bytes hold the fd pointer to the next free chunk of that size. tcache poisoning overwrites that fd (via the UAF write) so a later malloc of the same size returns an attacker-chosen address — an arbitrary write. (On glibc ≥ 2.32, safe-linking mangles fd; account for it if your server uses a newer libc.)

Experiment Setup

Log in to Badger CTF and copy the source and binary: cp /workdir/ss2026/lab6/lab6_heap.c . cp /workdir/ss2026/lab6/lab6_heap .
Explore the heap in GDB with pwndbg: heap, bins, and vis_heap_chunks after a few create/delete operations.
A pwntools skeleton with menu helpers (lab6_heap_exploit.py) is provided.

Lab Exercise

Task 1: Explore the allocator (2 points)

Create two notes, free one, and inspect the tcache.

Q1: After freeing a note, show the tcache bin (pwndbg bins). What does the freed chunk's fd field contain, and why? Include a screenshot. (2 pts)

Task 2: UAF leak (3 points)

Use the dangling pointer to leak an address.

Q2: Free a chunk and show it (or use an unsorted-bin chunk) to leak a heap or libc pointer. What did you leak, and how did you compute a base address from it? (3 pts)

Task 3: tcache poisoning to a shell (5 points)

Corrupt a freed chunk's fd so malloc returns a target you control (e.g., a GOT entry, or __free_hook on older glibc), then write the address of system/a one_gadget and trigger it.

Q3: Describe your poisoning steps: the two frees, the fd you wrote, and how the next allocations returned your target. (3 pts)

Q4: Provide your exploit and a screenshot of the shell (run id). If the server's glibc uses safe-linking, explain how you handled it. (2 pts)

Hint

Review Class 09: Heap Exploitation. Keep note sizes in the same tcache bin so your frees land in the same list.

Deliverables

A PDF report with Q1—Q4, screenshots of the heap state, and your exploit script.

Submission

The lab due date is available on our course website. Late submission will not be accepted.
Submit your assignment to D2L directly.
No copy or cheating is tolerated. If your work is based on others' or AI, please give clear attribution. Otherwise, you WILL FAIL this course.