Tags: heap pwn 2.32 safe-linking uaf 


8 byte UAF on 2.32 glibc (the libc version that introduced the safe linking protections) with only fastbin ranged sizes. Abuse scanf to trigger malloc_consolidate() and largebin activity on the heap to retrieve both a heap and libc leak. With a heap and libc leak, use the uaf to change the fd following the safe linking protection mechanism to overwrite one of the hook functions to pop a shell.

Original writeup (https://www.willsroot.io/2020/10/cuctf-2020-dr-xorisaurus-heap-writeup.html).