Recent content on MrN1gativ3
Intro In this post I will walk through a small heap-overflow challenge and show how the overflow reaches a heap-resident function pointer. This is a toy binary, but it is a good lab for understanding chunk adjacency, overwrite distance, and one very important exploitation detail: why a partial pointer overwrite is enough in this program. Binary Info For this write-up I recompiled the binary from…
Where It All Started Honestly, I’m not even sure how I ended up here. It started with process injection on Linux something I was poking at in my spare time between work. One thing led to another, and at some point I searched online and stumbled across something called Linux fileless malware. I’d heard of fileless attacks on Windows, but Linux? That caught my attention. I thought I knew…
Intro In the first part I covered the allocator building blocks: arenas, chunks, metadata, and bins. In this post I want to connect those pieces into the actual allocation and free paths you will see while debugging a process or reading glibc source. The most important thing to keep in mind is that glibc does not have one single “malloc path” or one single “free list”. The…
Intro This is the first part of the heap exploitation series. In this post I will build a clean mental model of the glibc allocator before getting into bugs and primitives. The goal here is not to memorize every macro in malloc.c , but to understand the objects that keep showing up in heap write-ups: arenas, chunks, the top chunk, and the different bins. One important note before we start: glibc…