MrN1gativ3

Heap Exploitation Part 3

Thu, 26 Sep 2024 00:00:00 +0000

Intro

In this post I will walk through a small heap-overflow challenge and show how the overflow reaches a heap-resident function pointer. This is a toy binary, but it is a good lab for understanding chunk adjacency, overwrite distance, and one very important exploitation detail: why a partial pointer overwrite is enough in this program.

Binary Info

For this write-up I recompiled the binary from source and disabled PIE and the stack canary. Disabling those protections keeps function addresses stable between runs and makes the control-flow goal easier to explain.

No File, No Path, Still Running: Inside Linux Fileless Execution

Thu, 26 Sep 2024 00:00:00 +0000

Where It All Started

Honestly, I’m not even sure how I ended up here. It started with process injection on Linux something I was poking at in my spare time between work. One thing led to another, and at some point I searched online and stumbled across something called Linux fileless malware. I’d heard of fileless attacks on Windows, but Linux? That caught my attention. I thought I knew what it meant. Run something without dropping a file. Simple. Except it wasn’t. The more I read, the more questions I had. Where do the bytes actually live if there’s no file? What does the kernel think is happening? Which syscall actually triggers execution and why does it matter which one? I’d answer one question and three more would show up. That’s usually the sign that something is worth digging into properly. The articles I found were good but incomplete most covered one angle, one technique, one tool. Nobody had written the thing I actually wanted to read: a complete walkthrough of how this works at the kernel level, from the first syscall to a fully running in-memory process, with explanations for what’s happening at each step and why. So I wrote it myself. This series is the result of a few months of going through kernel source code, running experiments, and building a mental model that finally felt solid. It’s not a malware analysis and it’s not a threat intel report. It’s just me trying to understand something properly and documenting what I found the mechanics, the internals, and why this technique is considerably more interesting than the one-line definition suggests.

Heap Exploitation Part 2

Fri, 16 Aug 2024 00:00:00 +0000

Intro

In the first part I covered the allocator building blocks: arenas, chunks, metadata, and bins. In this post I want to connect those pieces into the actual allocation and free paths you will see while debugging a process or reading glibc source.

The most important thing to keep in mind is that glibc does not have one single “malloc path” or one single “free list”. The path depends on request size, tcache state, arena state, and the exact glibc version.

Heap Exploitation Part 1

Mon, 10 Jun 2024 00:00:00 +0000

Intro

This is the first part of the heap exploitation series. In this post I will build a clean mental model of the glibc allocator before getting into bugs and primitives. The goal here is not to memorize every macro in malloc.c, but to understand the objects that keep showing up in heap write-ups: arenas, chunks, the top chunk, and the different bins.

One important note before we start: glibc heap internals are version-sensitive. Constants, tcache behavior, and even which code path gets hit first can change between releases, so treat the structures in this post as the model you should verify against the exact glibc version on your target.