Leaking libc through an oversized mmap chunk, then a format-string bug redirects a writable libc GOT entry to system to get a shell.Leaking libc through an oversized mmap chunk, then a format-string bug redirects a writable libc GOT…
heap
3 posts
- Chonk Shortage
- House of Sice
A double free, a leaked
system(), and a detour through fastbins to reach__free_hook.A double free, a leakedsystem(), and a detour through fastbins to reach__free_hook. - Freeless
With no
freeavailable, a top-chunk overflow forces sysmalloc to free memory, enabling a libc leak and tcache poisoning of__free_hook.With nofreeavailable, a top-chunk overflow forces sysmalloc to free memory, enabling a libc leak…