how2heap Documentation

The how2heap repository is a collection of implementations for learning various heap exploitation techniques. It uses Ubuntu's Libc releases as the gold standard, ensuring each technique is verified to work on corresponding Ubuntu releases.

Techniques are organized by their target Glibc version. If a technique requires adjustments due to new consistency checks in malloc/free logic, multiple versions are provided in the directory structure: glibc_<version>/technique.c.

You can use a Docker-based approach to compile and run binaries inside an older Ubuntu container, ensuring compatibility with the target libc version. This allows for debugging with the correct symbols.

git clone https://github.com/shellphish/how2heap
cd how2heap

# Prepare the target binary to run with the expected libc version
make base
./glibc_run.sh 2.30 ./malloc_playground -d -p

# Verify the interpreter/runpath
readelf -d -W malloc_playground | grep RUNPATH
# or
checksec

# Debug with GDB
gdb -q -ex "start" ./malloc_playground

To perform a basic setup using your system's default libc, ensure you have patchelf, zstd, wget, build-essential (or a similar compiler suite), and make installed. Additionally, /usr/bin/python must point to your python binary (e.g., via a symlink to python3).

git clone https://github.com/shellphish/how2heap
cd how2heap
make clean base
./malloc_playground

To study the specific Libc implementation used in your environment, you can download the source code on a Debian-based operating system using the following command:

apt source libc6

To avoid symbol versioning issues when using LD_PRELOAD with different libc versions, you can instruct the linker to link the target binary directly against a specific target libc. This method includes debug symbols for the target version. Use the H2H_USE_SYSTEM_LIBC=N environment variable followed by the desired version (e.g., v2.23).

git clone https://github.com/shellphish/how2heap
cd how2heap
H2H_USE_SYSTEM_LIBC=N make v2.23

You can enable certain glibc hardening and checking measures using environment variables:

• MALLOC_CHECK_=1: Enables some heap consistency checks.
• MALLOC_PERTURB_=1: Overwrites data to help detect use-after-free or uninitialized memory issues.
• MALLOC_MMAP_THRESHOLD_=1: Forces the use of mmap() for allocations.