Skip to content

Commit b8bc665

Browse files
authored
Update first-fit.md
1 parent c3d9e00 commit b8bc665

File tree

1 file changed

+1
-5
lines changed
  • src/binary-exploitation/libc-heap/use-after-free

1 file changed

+1
-5
lines changed

‎src/binary-exploitation/libc-heap/use-after-free/first-fit.md‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -131,13 +131,9 @@ A practical application can be found in the 2024 HITCON Quals *Setjmp* challenge
131131
- It's possible to alloc some memory, write the desired value, free it, realloc it and as the previous data is still there, it will treated according the new expected struct in the chunk making possible to set the value ot get the flag.
132132
- [**https://guyinatuxedo.github.io/26-heap_grooming/swamp19_heapgolf/index.html**](https://guyinatuxedo.github.io/26-heap_grooming/swamp19_heapgolf/index.html)
133133
- In this case it's needed to write 4 inside an specific chunk which is the first one being allocated (even after force freeing all of them). On each new allocated chunk it's number in the array index is stored. Then, allocate 4 chunks (+ the initialy allocated), the last one will have 4 inside of it, free them and force the reallocation of the first one, which will use the last chunk freed which is the one with 4 inside of it.
134-
135-
136-
## References
137-
138134
- 2024 HITCON Quals Setjmp write-up (Quarkslab) – practical first-fit / unsorted-split overlap attack: <https://ctftime.org/writeup/39355>
139135
- Angstrom CTF 2024 *heapify* write-up – abusing unsorted-bin splitting to leak libc and gain overlap: <https://hackmd.io/@aneii11/H1S2snV40>
140136

141137

142138

143-
{{#include ../../../banners/hacktricks-training.md}}
139+
{{#include ../../../banners/hacktricks-training.md}}

0 commit comments

Comments
 (0)