Quickstart

Learn heap exploitation techniques by running real examples. This guide will get you started quickly with the basics.

Quick Setup

The fastest way to get started is with the Quick Setup method, which uses your system’s glibc.

Install Required Tools

Make sure you have the following packages installed:

sudo apt install build-essential patchelf zstd wget git

Also ensure /usr/bin/python points to your Python binary:

sudo ln -s /usr/bin/python3 /usr/bin/python

Clone and Build

Clone the repository and build the base binaries:

git clone https://github.com/shellphish/how2heap
cd how2heap
make clean base

This builds the base binaries: malloc_playground, first_fit, and calc_tcache_idx.

Run Malloc Playground

The malloc playground is an interactive tool to experiment with heap operations:

./malloc_playground

You’ll see a prompt where you can enter commands:

pid: 12345
> 

Using Malloc Playground

The malloc playground allows you to allocate, free, and manipulate memory interactively.

Basic Commands

> malloc 100
==> OK, 0x5555557592a0

> free
==> ok

> malloc 100
> write HelloWorld
==> ok, wrote HelloWorld

> listp
0 - 0x5555557592a0 - HelloWorld - 100
==> ok

Available Commands

Command	Description	Example
`malloc n`	Allocate n bytes	`malloc 256`
`free [p]`	Free memory (default: last allocated)	`free` or `free 0`
`write str [p]`	Write string to pointer	`write test 0`
`listp`	List active pointers	`listp`
`listpall`	List all pointer slots	`listpall`
`clearlist`	Free all allocations	`clearlist`
`stats`	Show malloc statistics	`stats`
`info`	Show detailed malloc info	`info`

The malloc playground tracks up to 20 pointers at once. Use clearlist to reset and free all allocations.

Your First Technique: First Fit

Now let’s run your first heap exploitation technique demo.

Compile first_fit

The first_fit example demonstrates glibc’s first-fit allocation behavior:

make first_fit

Run the Example

Execute the compiled binary:

./first_fit

You’ll see output demonstrating how glibc reuses freed chunks:

This file doesn't demonstrate an attack, but shows the nature of glibc's allocator.
glibc uses a first-fit algorithm to select a free chunk.
If a chunk is free and large enough, malloc will select this chunk.
This can be exploited in a use-after-free situation.

Allocating 2 buffers. They can be large, don't have to be fastbin.
1st malloc(0x512): 0x5555557592a0
2nd malloc(0x256): 0x5555557597c0
...

Understand the Technique

The example shows:

Allocate chunk A (0x512 bytes)
Allocate chunk B (0x256 bytes)
Free chunk A
Allocate chunk C (0x500 bytes) - gets the same address as A!

This demonstrates the use-after-free condition where pointer A still points to data from allocation C.

Exploring Techniques

The repository includes dozens of techniques organized by glibc version:

# List available techniques for glibc 2.39
ls glibc_2.39/

# Compile all techniques for a specific version
make v2.39

# Run a specific technique
./glibc_2.39/fastbin_dup

Fastbin Techniques

fastbin_dup - Double free attack
fastbin_dup_into_stack - Arbitrary pointer
fastbin_dup_consolidate - Bypass checks

Tcache Techniques

tcache_poisoning - Poison tcache entries
tcache_dup - Double free in tcache
house_of_botcake - Advanced tcache exploit

House Techniques

house_of_spirit - Fake fastbin chunks
house_of_lore - Smallbin exploitation
house_of_einherjar - Null byte overflow

Advanced

unsafe_unlink - Arbitrary write
poison_null_byte - Single byte overflow
large_bin_attack - Large bin exploitation

The Quick Setup method links binaries against your system libc. For working with specific glibc versions, see the Setup Guide for complete configuration options.

Next Steps

Complete Setup

Configure specific glibc versions using Docker or linker methods

Debugging

Use GDB with heap visualization tools like pwndbg or gef

Running with GDB

To debug techniques with GDB:

# Quick method (system libc)
gdb ./first_fit

# With specific glibc version
./glibc_run.sh 2.39 ./malloc_playground -gdb

Recommended GDB plugins for heap exploitation:

pwndbg - Exploitation-focused GDB plugin
gef - GDB Enhanced Features
Pwngdb - Heap examination tools

Get Started

Fundamentals

Fastbin Techniques

Tcache Techniques

House Techniques

Bin & Chunk Manipulation

Advanced Techniques

Glibc Versions

Tools & Resources

Quick Setup

Using Malloc Playground

Basic Commands

Available Commands

Your First Technique: First Fit

Exploring Techniques

Fastbin Techniques

Tcache Techniques

House Techniques

Advanced

Next Steps

Complete Setup

Debugging

Running with GDB

​Quick Setup

​Using Malloc Playground

​Basic Commands

​Available Commands

​Your First Technique: First Fit

​Exploring Techniques

Fastbin Techniques

Tcache Techniques

House Techniques

Advanced

​Next Steps

Complete Setup

Debugging

​Running with GDB

Quick Setup

Using Malloc Playground

Basic Commands

Available Commands

Your First Technique: First Fit

Exploring Techniques

Next Steps

Running with GDB