Vortex11
Vortex Level 11 — corrupt the heap to gain arbitrary control of a program that uses the phkmalloc allocator.
Table of Contents
Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.
Chunk Corruption
You must corrupt the heap in order to gain arbitrary control of this program. Do recall, the application is using phkmalloc.
Reading Material
Study guide
Level map: logged in as vortex11, obtain access to vortex12.
What this level teaches
Heap exploitation against a specific allocator.
Key ideas
- The heap. Dynamically allocated memory managed by an allocator that keeps its own metadata.
- phkmalloc. The BSD allocator named in the level; its structure determines which corruptions are useful.
- Chunk corruption. Overflowing one allocation into a neighbour’s metadata can turn later allocator operations into controlled writes.
- Reading. The page lists BSD heap smashing, “Once upon a free()”, Doug Lea malloc exploits and “Exploiting the Wilderness”.
How to approach it
- Read the papers and then the allocator’s behaviour in this program.
- Map how allocations are laid out for a given input.
- Craft the overflow and confirm its effect in a debugger.
Why it matters
Heap bugs dominate modern vulnerability reports, and the techniques follow the same ideas.