Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache/fastbin/unsortedbin attacks for arbitrary write or code execution.

SKILL: Heap Exploitation — Expert Attack Playbook AI LOAD INSTRUCTION : Expert glibc heap exploitation techniques. Covers ptmalloc2 internals, bin structures, tcache mechanics, libc/heap leak methods, and attack selection by glibc version. Distilled from ctf wiki heap sections, how2heap, and real world exploitation. Base models often confuse glibc version constraints and miss safe linking (PROTECT PTR) introduced in 2.32. 0. RELATED ROUTING [stack overflow and rop](../stack overflow and rop/SKILL.md) — when the overflow is on the stack rather than the heap [format string exploitation](../format string exploitation/SKILL.md) — leak heap/libc addresses via format string [arbitrary write to rce](../arbitrary write to rce/SKILL.md) — convert heap arbitrary write into code execution [binary protection bypass](../binary protection bypass/SKILL.md) — bypass ASLR/RELRO to use heap write effectively Advanced References [HOUSE OF TECHNIQUES.md](./HOUSE OF TECHNIQUES.md) — House of Force/Spirit/Orange/Einherjar/Roman/Pig/Banana/Cat/Apple and tcache attacks [IO FILE EXPLOITATION.md](./IO FILE EXPLOITATION.md) — IO FILE vtable hijack, FSOP, stdout/stdin abuse, exit flow exploitation 1. PTMALLOC2 STRUCTURE QUICK REFERENCE malloc chunk Layout (64 bit) Bin Types Bin Size Range (64 bit) Structure LIFO/FIFO tcache (per thread) ≤ 0x410 (7 entries per size) Singly linked (next pointer) LIFO fastbin ≤ 0x80 (default) Singly linked (fd) LIFO unsortedbin Any freed size Doubly linked circular FIFO smallbin < 0x400 Doubly linked circular FIFO largebin ≥ 0x400 Doubly linked + size sorted Sorted Key Global Structures Structure Location Purpose main arena libc .data segment Contains bin heads, top chunk, system mem mp libc .data malloc parameters (tcache settings, mmap threshold) tcache perthread struct Heap (first allocation) Per thread tcache bins and counts 2. LEAK METHODS Libc Base Leak Method Precondition Technique Unsortedbin fd/bk Free a chunk tcache range (or fill tcache) fd/bk → main arena + 0x60 (or +0x70 depending on version) → libc base Smallbin fd/bk Chunk moved from unsortedbin to smallbin Same as unsortedbin leak stdout FILE leak Write to IO 2 1 stdout Corrupt IO write base to leak libc data (see IO FILE) Heap Base Leak Method Precondition Technique Tcache fd pointer Free two tcache chunks, read first's fd fd → heap address (XOR'd in ≥ 2.32) Fastbin fd Free two fastbin chunks fd → heap address UAF read Use after free on freed chunk Read fd/bk directly Safe Linking Decode (glibc ≥ 2.32) 3. ATTACK CATEGORIES BY GLIBC VERSION glibc < 2.26 (No tcache) Attack Primitive Needed Result Fastbin dup Double free Arbitrary allocation Unsortedbin attack Corrupt unsortedbin bk Write main arena addr to target (used for malloc hook nearby overwrite) Unlink attack Heap overflow into prev size + fd/bk Arbitrary write (with known heap pointer) House of Force Top chunk size overwrite Arbitrary allocation House of Spirit Write fake chunk header Fastbin allocation at fake chunk Off by one null Null byte overflow into next chunk size Overlapping chunks glibc 2.26–2.28 (tcache, no key) Attack Notes Tcache poisoning Overwrite tcache fd → arbitrary allocation, no size check Tcache dup Double free into tcache (no double free detection yet) All previous attacks Still work, but chunks go to tcache first glibc 2.29–2.31 (tcache key introduced) Attack Bypass for tcache key Tcache dup Corrupt key field (at chunk+0x18) before second free House of Botcake Double free: one in unsortedbin, one in tcache → overlapping Tcache stashing unlink Abuse smallbin→tcache refill to get arbitrary chunk glibc 2.32–2.33 (safe linking / PROTECT PTR) Attack Adaptation Tcache poisoning Encode target with (chunk addr 12) ^ target Heap leak required Need heap addr to decode/encode safe linked pointers Fastbin dup Same encoding required glibc ≥ 2.34 (hooks removed) Change Impact malloc hook removed Cannot overwrite hook for one gadget free hook removed Cannot overwrite hook realloc hook removed Cannot use realloc trick for one gadget constraints Post 2.34 targets : see [arbitrary write to rce](../arbitrary write to rce/SKILL.md) for IO FILE , exit funcs , TLS dtor list , dl fini . 4. COMMON VULNERABILITY PATTERNS Vulnerability Description Exploitation Path UAF (Use After Free) Access chunk after free Read: leak fd/bk; Write: corrupt fd for tcache poisoning Double Free free() same chunk twice Tcache dup (bypass key) or fastbin dup Heap Overflow Write past chunk boundary Corrupt next chunk's metadata (size, fd, bk) Off by one One byte overflow Null byte → shrink next chunk size → overlapping chunks Off by null Specifically \x00 overflow Clear PREV INUSE → trigger backward consolidation Uninitialized read Read heap memory without clearing Leak fd/bk from recycled chunk 5. TOOLS 6. DECISION TREE

heap-exploitation