What problem does it solve?
During authorized penetration tests and CTF-style binary exploitation, heap bugs like use-after-free and double-free are hard to convert into reliable arbitrary read/write because modern glibc mitigations (tcache key checks, safe-linking, hook removal) invalidate classic techniques. This Skill provides a version-aware methodology for turning heap corruption primitives into leaks and code execution.
Core Features & Use Cases
- Version-aware technique selection: Fingerprints the target glibc version first, since tcache double-free detection (2.29+), safe-linking (2.32+), and malloc hook removal (2.34+) each change the exploitation strategy.
- Bin-specific primitives: Covers tcache poisoning, fast-bin dup, unsorted/large-bin attacks, House of Botcake, and off-by-one size confusion, with pwntools code patterns for each.
- Leak and mitigation handling: Explains how to obtain libc leaks from unsorted-bin fd/bk pointers and heap leaks needed to forge safe-linked next pointers.
- Use Case: Given a binary with a UAF bug on glibc 2.35, follow the workflow to leak libc and heap bases, overlap chunks via House of Botcake, poison the tcache, and achieve arbitrary write over a FILE vtable for code execution.
Quick Start
Analyze the target binary with this skill to identify its heap bug class and glibc version, then build a working exploit chain from leak to arbitrary write.
