skills.rest
3xecutablefile
3xecutablefileCOMMUNITY
Explore all skills by this author →
GitHub

heap-exploitation

Convert ptmalloc2/glibc heap vulnerabilities into arbitrary write and code execution.

Updated Aug 27, 2026
Search Tags:#glibc#ptmalloc2#safe-linking#arbitrary write#heap exploitation#tcache poisoning#FSOP
One-click install
npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill heap-exploitation-3xecutablefile
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: heap-exploitation
Source: https://github.com/3xecutablefile/opencode-rev-forensics/tree/main/skills/heap-exploitation
Command: npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill heap-exploitation-3xecutablefile

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Heap exploitation guidance that helps you convert ptmalloc2/glibc heap vulnerabilities (UAF, double free, overflow, off-by-one/null) into dependable arbitrary write and code execution paths with version-correct attack selection.

Core Features & Use Cases

  • Glibc-version aware attack selection: Chooses the right heap primitive and technique across pre-tcache, tcache-era, safe-linking (PROTECT_PTR), and post-hook-removal regimes.
  • Reusable exploitation playbooks: Covers core leaks (unsortedbin/main_arena, smallbin, tcache/fastbin-derived heap base, stdout-based libc leaks) and common vulnerability patterns and exploitation flows.
  • Named advanced technique coverage: Provides “House of …” methods and tcache-specific strategies, plus deep notes on constraints that commonly break real exploits.
  • Execution-path upgrading for modern glibc: Links heap exploitation outcomes to higher-level targets like _IO_FILE vtable hijack and exit-flow execution for post-2.34 environments.

Quick Start

Use the heap-exploitation skill with your binary and suspected glibc version to map your heap bug to the best matching primitive, then outline a concrete step-by-step plan for leaking what you need and achieving arbitrary write or control flow.

Frequently Asked Questions about heap-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a glibc heap vulnerability to get arbitrary write?▼

You convert glibc heap vulnerabilities into arbitrary write by mapping your specific bug to the correct primitive across your glibc version, applying techniques like tcache poisoning or House of methods to achieve code execution.

How does safe-linking affect tcache poisoning in modern glibc?▼

Safe-linking protects tcache pointers via PROTECT_PTR encoding, requiring you to leak the heap base address to decode and encode pointers correctly before performing tcache poisoning for arbitrary write.

What is the best way to leak libc addresses using unsortedbin and smallbin?▼

The best way to leak libc via unsortedbin involves freeing a chunk to place main_arena pointers in its fd/bk fields, then reading those pointers to calculate the libc base address for your exploit.

Does heap exploitation work the same across different glibc versions?▼

Heap exploitation varies significantly across glibc versions, as pre-tcache, tcache-era, safe-linking, and post-hook-removal regimes each require different primitives and attack strategies to achieve reliable code execution.

How do I achieve code execution after hooks are removed in glibc 2.34+?▼

For glibc 2.34+ post-hook-removal environments, you achieve code execution by upgrading heap primitives to target _IO_FILE vtable hijacking and exit-flow execution instead of relying on deprecated malloc hooks.

When should I use House of techniques for heap exploitation?▼

Use House of techniques when standard tcache poisoning is constrained by version-specific protections, leveraging specific bin structures and advanced methods to bypass mitigations and achieve arbitrary write.

Related Skills

Explore More Software Engineering Skills→
Prohao42Prohao42
120

heap-exploitation

Identify and exploit glibc heap vulnerabilities like UAF and double free.

Community
Advanced
eanzhaoeanzhao
1

slugify-helper

Convert arbitrary text into URL-friendly slugs for URLs, filenames, and identifiers.

Community
Basic
utsavthakurutsavthakur

heap-exploitation

Guide glibc heap exploitation techniques including tcache, fastbin, and unsortedbin attacks.

Community
Advanced
yaklangyaklang
1.6k

heap-exploitation

Exploit ptmalloc2 and glibc heap vulnerabilities for arbitrary write or code execution.

Official
Advanced