Rating:
## CACHE_7
- This is a heap challenge where we are given a filename and the libc file.
- Since the libc version is 2.27 that means we are dealing with the tcache that was introduced in libc version 2.26.
*static Analysis*
- Using the commands `file chall && checksec chall && rabin2 -i chall rabin2 -z chall`. Therefore we can definately see
the type of file and the different file protections there is.
- The file has all protections enabled and it is a 64-elf binary that is `not stripped` and `dynamically linked`.
*Dyamic Analysis*
- There are various functions in the binary and they are `add, view, delete and quit`. The function of focus here are the
`delete`, `view` and `add` functions.
- These functions do the following
1. Add:
- This is a function that is used to malloc a chunk based on the input that we give. That is the size and the data.
- The chunk refrence is stored in the bss section.
- When another chunk is allocated the refrence chunk is replaced with the address of the new chunk.
3. Delete:
- This is used to free the chunk and therefore the chunk is placed in a tcache bin based on the given libc version.
- The chunk refrence at the bss section at ptr is not replaced with a null value
5. View
- This is used to print the value at ptr in the bss section.
# Exploitation
- For a heap exploitation challenge I do look for the following common bugs that will therefore lead to some more complicated bugs
1. Heap Overflow
2. Use After Free
3. Double Free
- Since the pointer that was `freed` is not replaced by null therefore this leads to a `UAF` bug.
- The `UAF` bug leads to `Double Free` bug and this is where we can free out chunk more than 2 times.
- Therefore we can use these bugs to leak libc address and gain shell =)
*Leak Address*
- Using the `Double Free Bug` we can tcache dup into bss at `ptr`.
- When a chunk is deleted 2 times therefore the tcache will be a follows [chunk1---->chunk1]
- Therefore this means that we can control the fd pointer to point to the address of `ptr` in memory.
- When we then allocate a chunk we will therefore end up with `ptr` as a chunk and write into it the value of `elf.got.setbuf`
- We will then leak the address at libc by calling `view` that will print the value at `ptr` which is out got address.
*pop shell*
- tcache dup into `__free_hook` and that address with the address of system or the address of `one_gadget` and gain a shell.
- Therefore the final [exploit](exploit.py)
