Exploit exercises - Protostar - Heap 2

In this task we are able to control the sequence of malloc and free operations. Also the binary seems to be different from the source because binary allocates not enough memory for the auth struct. If you write auth 1, only 4 bytes are allocated for a whole 36 bytes auth structure. So if we are able to create another structure that has nonzero byte at 32-byte offset we will get a flag. Let's allocate service struct that has unlimited size and therefore can overwrite auth at offset 32 from auth pointer.

Exploit exercises - Protostar - Heap 1

In this task there is a bit more calls to malloc function. As we can see first strcpy is able to overwrite all other allocated data except first allocation. Data allocated in a way that is shown on the picture.

Next strcpy gets address from the allocated memory and write there second argument. So we can overwrite an arbitrary place in memory.
Since main function uses puts function to print something after second strcpy was finished and the fact that winner function doesn't use puts function, we can overwrite address in GOT for puts to move execution flow to the winner.

ASIS CTF 2013 - Reverse 200 - Masterpiece

Task:

file

Exploit exercises - Protostar - Heap 0

Heap 0 level teaches us that variables that are placed in a heap are referenced by different addresses in memory far from stack. Two sequential allocations have a high probability to be one after the other in memory. We can exploit this by overflowing buffer.