Daily Reminder: Mom's Spaghetti

Our compass through all of this is the desire for the following comfort food:

• CONQUER ADDRESS RANDOMIZATION by a USE-AFTER-FREE vulnerability to leak a glibc address
• WRITE-WHAT-WHERE using TCACHE-POISONING for arbitrary writing to glibc
• CONTROL INSTRUCTION POINTER by overwriting the **FREE_HOOK** in glibc with system where "/bin/sh" is written in the free'd chunk

Swapping glibcs

OK in the Mom's Spaghetti sense we want to move to 2.32 and experience encrypted pointers.

The plan:

• Learn how to use: glibc-all-in-one
• Learn how to use: patchelf --set-interpreter ./ld-linux-x86-64.so.2 --set-rpath . binaryhere
• See some "encrypted" pointers (in tcache bins not unsorted bins)
• Unencrypt them
• Re-encrypt target pointers
• Do Mom's Spaghetti but in glibc 2.32

(Link to) Heap Reference Materials

The Bins as Diagrams

Heap Flow Charts:

HEAP PLAYGROUND and STARTER SCRIPT: