skills.rest
yaklang
yaklangOFFICIAL
Explore all skills by this author →
GitHub

heap-exploitation

Exploit ptmalloc2 and glibc heap vulnerabilities for arbitrary write or code execution.

1.6k|204|Updated Apr 7, 2026
Search Tags:#heap-exploitation#glibc#ptmalloc2#tcache#fsop#arbitrary-write#safe-linking
One-click install
npx skills add https://github.com/yaklang/hack-skills --skill heap-exploitation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: heap-exploitation
Source: https://github.com/yaklang/hack-skills/tree/main/skills/heap-exploitation
Command: npx skills add https://github.com/yaklang/hack-skills --skill heap-exploitation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill consolidates expert techniques to analyze and exploit ptmalloc2/glibc heap vulnerabilities, enabling the conversion of UAFs, double frees, overflows, and off-by-one/null bugs into reliable arbitrary write or code execution primitives while accounting for glibc version constraints.

Core Features & Use Cases

  • Comprehensive Technique Catalog: Detailed named methods (House of Force, Spirit, Orange, Einherjar, Roman, Pig, Banana, Cat, Apple) and tcache-specific attacks with required primitives and glibc applicability.
  • Leak and Primitive Guidance: Practical methods for leaking libc and heap (unsortedbin, stdout corruption, tcache/fastbin reads), safe-linking (PROTECT_PTR) encoding/decoding, and choosing attack paths by glibc version.
  • FSOP & IO_FILE Chains: Step-by-step FSOP, vtable hijack, stdout/stdin abuse, exit-flow targets, and post-2.34 alternatives when hooks are removed, with decision trees and practical templates.

Quick Start

Use the heap-exploitation skill to analyze a discovered glibc heap overflow and recommend a step-by-step exploit chain tailored to the target's glibc version and available primitives.

Frequently Asked Questions about heap-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a glibc heap overflow to get arbitrary write?▼

Exploit glibc heap vulnerabilities by converting UAFs, double frees, and overflows into arbitrary write or code execution primitives using tcache poisoning, fastbin attacks, and largebin attacks tailored to the target's glibc version.

How does safe-linking affect tcache poisoning in modern glibc?▼

Safe-linking protects tcache and fastbin forward pointers using PROTECT_PTR encoding, requiring a heap address leak to correctly decode and encode pointers for successful tcache poisoning in modern glibc.

What FSOP techniques work for glibc 2.34 and later without hooks?▼

For glibc 2.34 and later, FSOP leverages IO_FILE chains, vtable hijacks, and exit-flow targets to achieve code execution without traditional hooks, guided by version-specific decision trees.

Can I use House of Orange for heap exploitation across different glibc versions?▼

House of Orange and other named heap techniques carry specific glibc version constraints, requiring you to verify version applicability and available primitives before execution.

What is the best way to leak libc and heap addresses for unsortedbin attacks?▼

Leak libc and heap addresses for unsortedbin attacks via unsortedbin reads, stdout corruption, or tcache and fastbin reads, selecting the appropriate leak method based on the target glibc version.

Why does my tcache double free fail on newer glibc allocators?▼

Tcache double free fails on newer glibc due to key checks and safe-linking protections, requiring adapted techniques like House of Spirit or off-by-null methods to bypass these constraints.

Related Skills

Explore More Software Engineering Skills→
Prohao42Prohao42
120

heap-exploitation

Identify and exploit glibc heap vulnerabilities like UAF and double free.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

ctf-pwn-heap

Execute heap exploitation workflows against authorized CTF binaries.

Community
Advanced
yhy0yhy0
518

rce

Automate detection and exploitation workflows for remote code execution vulnerabilities.

Community
Advanced
lNwNllNwNl
2

heap-exploitation

Convert glibc heap vulnerabilities into exploitation primitives across allocator versions.

Community
Advanced