tea-cash Writeup

Here is the exact writeup of how I solved it, step by step, including the tools I used.

Files and tools used

• Files: heapedit, heapedit.c
• Tools:
• cat
• nc
• python3 (for address arithmetic helper)

1) Understand program logic

cat heapedit.c

Program behavior:

• allocates 6 chunks of size 0x80
• stores flag in chunk 6
• frees chunks in reverse order
• asks you to provide the expected free-list traversal addresses

2) Connect to remote

nc candy-mountain.picoctf.net 50072

Read the printed tcache head:

• tcache head (start of free list) -> 0x...

3) Compute required addresses

Chunk stride is:

• 0x80 user data + 0x10 metadata = 0x90

Enter six addresses:

• head + 0x000
• head + 0x090
• head + 0x120
• head + 0x1b0
• head + 0x240
• head + 0x2d0

Helper:

python3 - << 'PY'
head = int('0x1fc1490',16)
for d in [0,0x90,0x120,0x1b0,0x240,0x2d0]:
    print(hex(head+d))
PY

4) Submit and get flag

After correct traversal, service prints Correct traversal! Flag: ...

Note about local behavior

Local glibc may use safe-linking and break this exact pointer expectation, while remote instance was solvable with plain traversal.

Final flag

picoCTF{<redacted>}