Before we start learning the different heap exploitation techniques, we need to set up our exploit-dev
environment.
If you have some exploit-dev experience and want to use an existing environment, you can do that
too.
If you don't, the first thing we'll need is a 64 bit Linux host or virtual machine.
I recommend using a recent Ubuntu desktop build since not only is Ubuntu the platform that our tools
were designed for,
it's also free and works out of the box.
You can get the latest Ubuntu desktop image by visiting ubuntu.com and clicking the download tab
at the top of the page.
I'll be working from the Intel x86 architecture for the duration of this course, but the techniques
we'll learn are grounded in how the C library works,
so for the most part they're architecture agnostic.
You can install Ubuntu on your host or create a new virtual machine.
I'll be using an Ubuntu 18.04 VM virtualized under VMware because it has a very convenient easy-install
feature.
If you're using a different virtualization suite, for example, VirtualBox, you may need to take
some extra steps, such as installing VirtualBox guest additions to ensure that your VM supports features
like copy paste between host and guest and can be run in full screen.
Once your Linux desktop is up and running, you'll need to install a couple of tools.
The first of which is a Python framework called pwntools.
You can find its GitHub page at github.com/Gallopsled/pwntools where simple installation
steps are detailed.
pwntools is primarily a Capture The Flag framework, but it's great for rapid prototyping during exploit
development and we're going to use it to help script our exploits.
The second tool we need is an enhancement suite for the GNU Debugger, or GDB.
GDB isn't particularly user friendly or exploit development focused, which is why we're installing
a GDB Python library called pwndbg.
It can be found
at
github.com/pwndbg/pwndbg along with its simple installation guide.
pwndbg makes GDB a lot more user friendly and more importantly, has some great heap
introspection functionality.
Installing pwndbg will install GDB,
so there's no need to download it separately.
If your version of pwndbg ends up being more recent than the one I'm using, the output of some of
the commands may appear slightly different.
The third tool is something called a one gadget finder, which we'll learn about later. The GitHub page
is github.com/david942j/one_gadget.
Note that it requires the installation of Ruby first.
Once you've got everything installed, you need to copy the heaplab.tar.gz file included
in this section's resources into your environment.
You can download it directly or if you're working inside a VM, copy it across via a shared folder or
shared clipboard. Extract the archive with the command 'tar xzf' followed by the name of the
archive.
You can extract it anywhere you like as long as its internal directory structure remains intact.
The archive contains everything we need to begin.
There's also a PDF that serves as a reference guide for malloc internals and contains an overview
of each heap exploitation technique
we'll be learning. A separate copy of the PDF is also supplied in this section's resources
in case you want to browse it outside of your environment. Each directory contains a vulnerable binary
against which we'll leverage a different heap exploitation technique.
Most of them involve guided learning, whilst some are challenges that you'll approach on your own.
Lastly, go ahead and install a text editor of your choice,
we'll need it to edit our exploit scripts.
I'll be using vim,
but graphical editors like Atom or even an IDE like PyCharm will work just fine.
And that's all you need, now that your environment is set up
we're going to start learning how malloc works under the hood.