Heap Exploitation

---
name: core-heap-exploitation
description: "Heap exploitation playbook: freelist poisoning, tcache/safe-linking, UAF, double-free, house-of-*, Windows segment heap primitives."
version: 1.0.0
license: GPL-3.0-or-later
metadata:
  package: unleash-skills
  author: NetVar1337/unleash
  category: exploit
  triggers:
    - "heap exploit"
    - "tcache poison"
    - "house of"
    - "freelist poison"
    - "segment heap"
---

# Heap exploitation playbook

## Primitive goals
- Write-what-where
- Controlled allocation content (fake objects)
- Leaks (heap/libc/base)
- Code exec via fp/vptr/`__free_hook` historical / exit handlers / stack pivot

## Linux glibc menu (version-sensitive)
| Technique | Idea |
|---|---|
| tcache poison | overwrite fd → arbitrary alloc |
| safe-linking bypass | need heap leak to craft fd |
| fastbin/dup | double-free constrained |
| unsorted bin leak | libc leak via fd/bk |
| largebin/attack variants | arb write primitives on older |
| house-of-* | various; check libc series |

Always pin **exact libc** and secure flags.

## Windows menu
- LFH userblock corruption → controlled realloc content
- Backend freelist (legacy) vs segment heap VSIs
- FreeEntryOffset style attacks (historical) — verify OS build
- Prefer application-logic UAF of C++ objects for reliability

## UAF / double-free
1. Free while dangling ref remains
2. Reclaim with controlled type (spray)
3. Reinterpret fields (vptr, length, callback)
4. Avoid modern freelist hardening when possible by staying in object layer

## Grooming discipline
- Record allocator class/size
- Deterministic spray counts
- Thread pinning if concurrent heaps

## Pair with
`heap-overflow`, `use-after-free`, `integer-overflow`, `vuln-research`.