skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

heap-exploitation

Convert glibc heap vulnerabilities into exploitation primitives across allocator versions.

2|Updated May 15, 2026
Search Tags:#glibc#ptmalloc2#tcache#fsop#arbitrary write#heap exploitation#io-file exploitation
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill heap-exploitation-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: heap-exploitation
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/heap-exploitation
Command: npx skills add https://github.com/lNwNl/Methodos --skill heap-exploitation-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you convert ptmalloc2/glibc heap vulnerabilities (UAF, double free, overflow, off-by-one/null) into working exploitation primitives like arbitrary allocation/write and RCE, correctly accounting for tcache/fastbin/unsortedbin behavior and glibc version constraints.

Core Features & Use Cases

  • PTMALLOC2 mental model: Quick reference for chunk layout, bin types, and global allocator structures to reason about heap state transitions.
  • Leak + primitive toolbox: Practical methods for leaking libc/heap (unsortedbin/smallbin/stdout FILE abuse and tcache fd leakage) and turning that into controllable writes.
  • Attack selection by glibc version: Decision guidance for whether hooks are available and which technique families (House of Force/Spirit/Orange/Einherjar/Roman/Pig/Banana/Cat/Apple, FSOP, vtable hijack) are compatible.
  • Recommended exploitation paths: Integrates IO_FILE exploitation and heap “house” techniques into end-to-end flows.
  • Technique dependencies surfaced: Highlights safe-linking requirements (PROTECT_PTR), tcache key handling (glibc 2.29+), and post-2.34 hook removals.

Quick Start

Use this Skill to plan an exploitation chain for a glibc heap vulnerability by mapping your bug type to the correct bin behavior, choosing an appropriate leak strategy if needed, and selecting a version-compatible technique family (e.g., tcache poisoning, House of Orange, or _IO_FILE FSOP) to reach arbitrary write or code execution.

Frequently Asked Questions about heap-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a glibc heap vulnerability when malloc hooks are removed?▼

Glibc heap exploitation without malloc hooks requires pivoting to IO_FILE exploitation or exit flow paths. You can use technique families like House of Apple/Cat/Banana to achieve arbitrary write and code execution by abusing FILE vtable hijacking and FSOP.

What is the tcache safe-linking bypass for heap poisoning?▼

Tcache safe-linking protects the fd pointer using PROTECT_PTR, requiring heap base leakage to bypass. Heap exploitation must also handle the tcache key introduced in glibc 2.29+ to correctly perform tcache poisoning and achieve arbitrary allocation.

How does House of Orange work for ptmalloc2 heap exploitation?▼

House of Orange is a ptmalloc2 heap exploitation technique that corrupts the top chunk to trigger an unsorted bin attack, eventually pivoting to FSOP via the _IO_FILE structure. It is selected when specific glibc version constraints and heap state transitions allow controlled writes.

Can I use tcache poisoning for arbitrary writes across different glibc versions?▼

Tcache poisoning works for arbitrary writes but requires version-specific handling for glibc. You must account for safe-linking protections and tcache key checks to ensure reliable heap exploitation and controlled allocations across the target allocator behaviors.

What is the best way to leak libc addresses using heap bins?▼

Leaking libc addresses using heap bins involves corrupting unsorted bin or smallbin structures to expose main_arena pointers. Alternatively, stdout FILE structure abuse and tcache fd leakage provide reliable heap and libc leaks for building exploitation primitives.

Why does my double free exploitation fail on newer glibc versions?▼

Double free exploitation fails on newer glibc versions because tcache introduced a key field to detect duplicate frees. Reliable heap exploitation requires bypassing this tcache key alongside handling safe-linking to successfully execute double free primitives.

Related Skills

Explore More Software Engineering Skills→
Prohao42Prohao42
120

heap-exploitation

Identify and exploit glibc heap vulnerabilities like UAF and double free.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

ctf-pwn-heap

Execute heap exploitation workflows against authorized CTF binaries.

Community
Advanced
langbyyilangbyyi
96

ctf-pwn

Solve CTF binary exploitation challenges with pwntools, ROPgadget, and GDB-pwndbg.

Community
Advanced
dcbzdcbz
1

weirdmachine

Model heap allocator state transitions to plan exploitation steps.

Community
Advanced