The Heap: Once upon a free() - bin 0x17

[@samsemp10l23]

well that was a depressing ending.....

[@ashikombat]

You have an amazing talent at teaching and explaining!

[@LiveOverflow]

+ashikombat aww thank you!

[@GreenyDe]

I bet its really hard work :D But thank you so much for the videos!

[@denrua423]

I spent nearly 3 hours on this video for playing it 3 times to understand all concepts and technology. I'm a newbie at Exploiting. Thanks for all your videos.

[@1e1001]

did you also play at 0.25x speed?

[@shiskeyoffles]

@@1e1001 r/theydidthemath

[@thecrazzxz3383]

3:08 It allocated 32+8 = 40 bytes for the chunk, the 8 bytes are for the size dword + the 4 bytes before the size dword, it's logical : malloc(x) creates a chunk of x+8 bytes

[@thecrazzxz3383]

not really

[@omardarwish396]

Thank you so much for making this! My favorite security teacher on KZbin

[@zaphooxx8779]

that's why i love these videos so much. even the "pros" sometimes make "stupid" mistakes ...

[@acatisfinetoo3018]

Just got to say your videos are #1 tier.

[@nukexplosion6679]

I agree

[@nadavcohen4166]

where did you find the source code for this old malloc?

[@scarlas7071]

9:48 This solution would obviously not work if W^X is followed. This can't be bypassed using ret2libc or rop like with stack overflows. It may still be possible to switch around some data to cause further problems later on, but that will be application specific. Do you know if there is a more general technique to overcome this?

[@LiveOverflow]

+Scarlas totally depends on the Heap implementation. Current malloc/free version have this technique fixed anyway. Though Might also be not exploitable at all with these limited malloc/free steps. Sounds like a cool challenge to try :P You should also checkout the cookbook writeup. There I used the heap exploitation technique "house of force" in a modern environment but it requires that you control the size to a malloc() call.

[@myselcrun111]

#12:15 Hey ! this is LiveOverflow from the future , man u are freaking awesome :) :) :) i wish u were my teacher

[@FyberOptic]

What I learned from experimenting is that the heap algorithm differs depending on the compiler and OS, which is obviously relevant when creating an exploit.

[@steefant]

thumbs up for showing your failures and the whole plan collapse! it was way too straight forward and easy before that anyway :)

[@oleksijm]

Why didn't i see this channel 2 years ago?

[@nukexplosion6679]

A golden mine of knowledge

[@alastiertan1914]

#11:07 Can someone explain what he meant by "This will be the forward pointer where the 2nd pointer will be written to at +12"? Where did '12' come from?

[@uuuuuhhlettuce3909]

In this video (and jn the previous one) you saw how to access properties in an 'object' on a heap. With the '->' arrow like this: 'auth->service'. Now what that really means is: Take the pointer of the auth 'object' and add the proper amount of bytes until the service section begins. So the unlink part from the source code will say "take the address of the beginning of the heap chunk and add 12, since at that address will ALWAYS be the forward pointer in case this chunk wants to be unlinked". And since we are abusing this forward pointer stuff with the "->" arrow, the innocent unlink thingy thinks we wanna jump to the address we give to it + 12 bytes since at that address (in a normal heap chunk) will always be the forward pointer. So we give it the GOT address MINUS 12 because the unlink function will ADD 12. I hope u understood this now and didnt loose motivation since the month you posted this :)). If anything is unclear please let me know so I can better my teaching skills. Have fun

[@armorbackthursday2068]

@@uuuuuhhlettuce3909 wouldn't the +12 point to the backward pointer? still woefully new at this stuff, but i thought the forward pointer is first after the metadata (i.e., at +8)

[@TonelessR]

Another very interesting episode, thanks again for all your work Live. :)

[@FalcoGer]

and that right there is exactly why you don't leave out {...}, even if there is just one command afterwards. Always use {...} Especially if you're inept in indenting correctly.

[@mariuszmario5557]

Do you have irc chanel like Gynavale's #gynvaelstream-en on Freenode?

[@Rrancido]

You can do also a tutorial about jemalloc?

[@manju7717]

1. To make this attack be successful in the end, I suggest that you export shellcode into ENV (export EGG= "0x90909090" + "shellcode"). 2. Then find the address of the shellcode using " $ find $esp, $esp+2000, 0x90909090 " command. 3. Now you have the address of shellcode, replace the GOT for puts with this address Let me know, if it works for you Cheers!

[@LiveOverflow]

thanks for the suggestion, but that's not the issue here ;) I don't see why egghunting shellcode would help here. The issue here is a different one. But watch the following video where I successfully exploit it.

[@Briesanji]

This video is amazing.. Please continue teaching this

[@Occcc12]

I was waiting for this one, thanks a lot :)

[@antoniomh1061]

Can someone explain me what is the exact vulnerability he exploited? He says there are 3 mallocs and 3 frees, so I don't see there any obvious vuln So I'm confused, what is he exploiting? is the the old malloc algorithm? Is it some vulnerability in the code? what is his input?

[@cyancoyote7366]

Your videos are amazingly helpful :D You've become my favourite youtuber, because you can always teach me something new. Can you recommend me some books on the topic of computers and electronics? I'm currently 16 years old, and I'm now trying to learn as much about communications, computers, language, electronics and human interactions as possible. English is not my native language, so I'm still getting better and better at it, mainly by extending my vocabulary as much as possible, and I've passed an advanced language exam (written and verbal). Also, I'm learning German in school and Finnish in the meantime. Thanks again for being my inspiration in life :D You are better at teaching than all of my teachers combined!

[@LiveOverflow]

+cyancoyote that is so nice of you to say! I have never really read books. And books are so quickly outdated. But I plan to work through beginners.re myself. Also "the art of exploitation" is nice.

[@cyancoyote7366]

Thank you very much :)

[@benasin1724]

@@cyancoyote7366 How is your journey now :D?

[@vincenthaepp]

Damn till this video i've understood all very good but this and the next are screwing up my head. I think i need to watch them multiple times and play around with that, to understand the Heap-Architecture completely.

[@uuuuuhhlettuce3909]

So..did you wrap your head around it yet? :)

[@huyvuquang2041]

I'm in the same situation as yours now :((

[@Ryges]

Interesting. I did not know that Linux uses dlmalloc. Do you have any idea why this was chosen and not, say, phkmalloc? Also I’m curious if you think phkmalloc is susceptible to the same kind of attack?

[@amlamarra]

What font do you use in your editor?

[@sontapaa11jokulainen94]

Holy crap the ending was sad.

[@niektuytel9519]

mind blows off here

[@YumekuiNeru]

this is why you should put the curly braces on the far left you know :^) the brace is not part of the if-statement after all it just ties a block into a single line and that single line is what "belongs" to the if personally I think curly braces and C-style syntax is an absolute travesty that should never have happened

[@iuse9646]

YumekuiNeru explain please ?

[@YumekuiNeru]

in C the {}-blocks are not part of the if/while statements they just group a bunch of statements together and then the {}-block can appear immediately after say an if-statement, and that block is what will run if the condition is true it is pretty much the same as putting a single statement like i=1 after an if without any {}, except when not using a block multiple statements/lines can not be used so the point was that by placing the { on the far right on the same line it gives the false impression that the block is part of the if statement, not to mention it is easy to miss whether there is an opening brace or not (as happens in 12:36 of this video) by always placing the two braces aligned with eachother on the left, it is easy to tell at a glance when you have a block and when you have just a single line

[@typedeaf]

Confused. You are using the 15yr-old documentation on dlmalloc, but you aren't using the 15yr-old glibc, are you?

[@LiveOverflow]

This old VM still uses the old implementation. It’s an introduction practice VM

[@fsquad8191]

why ,,disassemble" instead of ,,disas" ?

[@LiveOverflow]

+F Squad clearer for the viewer. Also I'm used to do tab completion

[@Abdelhamidovitch]

i love you

[@nullnull6032]

Is anybody here having the feeling that he will never be something useful, like look at us struggling to understand a science that is 10 years old from now? Fuck My Life\0

[@heaptv2348]

headache teacher T.T

[@z4q.mictlan]

ヒープわからん、、、

[@dukap8669]

FIRST

[@payanggabang]

who cares...

[@TesikLP]

From my abstract high-level point of view, I've always thought heap metadata was owned by the kernel. I guess system devs are dumber than I thought.

[@ParallaxThe]

its about speed versus security. Having only one large block be the heap is easy. if the user needs to increase the heap or the process wants to fork all it has to do is copy the heap in one go.

[@TesikLP]

As you said, one heap block is easy, for the programmer it is. The performance isn't affected much by copying two blocks instead of one, in fact two blocks are easier to parallelize. The tradeoff here seems to be about security vs. complexity.

[@w0ttheh3ll]

what affects performance is that with kernel-controlled metadata you would need to make a system call every time the heap changes, even if it's just a couple of bytes, even if it happens dozens of times in a single function.