title: Use a heap overflow to write arbitrary data
body: <p>I've been trying to learn the basics of a heap overflow attack. I'm mostly interested in using a corruption or modification of the chunk metadata for the basis of the attack, but I'm also open to other suggestions. I know that my goal of the exploit should be do overwrite the <code>printf()</code> function pointer with that of the <code>challenge()</code> function pointer, but I can't seem to figure out how to achieve that write.
  I have the following piece of code which I want to exploit, which is using <code>malloc</code> from <code>glibc 2.11.2</code> :</p>
  
  <pre class="lang-c prettyprint-override"><code>void challenge()
  {
          puts("you win\n");
  }
  
  int main(int argc, char **argv)
  {
          char *inputA, *inputB, *inputC;
  
          inputA = malloc(32);
          inputB = malloc(32);
          inputC = malloc(32);
  
          strcpy(inputA, argv[1]);
          strcpy(inputB, argv[2]);
          strcpy(inputC, argv[3]);
  
          free(inputC);
          free(inputB);
          free(inputA);
  
          printf("execute challenge to win\n");
  }
  </code></pre>
  
  <p>Obviously, achieving an actual overwrite of an allocated chunk's metadata is trivial. However, I have not been able to find a way to exploit this code using any of the standard techniques. 
  I have read and attempted to implement the techniques from:</p>
  
  <ul>
  <li>The paper: w00w00 on <a href="http://www.windowsecurity.com/uplarticle/1/heaptut.txt" rel="noreferrer">Heap Overflows</a>
  
  <ul>
  <li>Although the paper is very clear, the <code>unlink</code> technique has been obsolete for some time.</li>
  </ul></li>
  <li><a href="http://dl.packetstormsecurity.net/papers/attack/MallocMaleficarum.txt" rel="noreferrer">Malloc Maleficarum.txt</a>
  
  <ul>
  <li>This paper expands upon the exploit techniques from the w00w00 days, and accounts for the newer versions of glibc. However, I have not found that given the 5 techniques detailed in the paper, that the code above matches any of the prerequisites for those techniques.</li>
  </ul></li>
  <li><a href="https://www.blackhat.com/presentations/bh-usa-07/Ferguson/Whitepaper/bh-usa-07-ferguson-WP.pdf" rel="noreferrer">Understanding the Heap By Breaking it(pdf)</a>
  
  <ul>
  <li>The pdf gives a pretty good review of how the heap works, but focuses on double free techniques.</li>
  </ul></li>
  </ul>
  
  <p>I originally tried to exploit this code by manipulating the size value of the chunk for inputC, so that it pointed back to the head of the inputC chunk. When that didn't work, I tried pointing further back to the chunk of inputB. That is when I realized that the new glibc performs a sanity check on the size value.</p>
  
  <p>How can a user craft an exploit to take advantage of a free, assuming he has the ability to edit the allocated chunk's metadata to arbitrary values, and user it to overwrite a value in the GOT or write to any other arbitrary address?</p>
  
  <p>Note: When I write 'arbitrary address' I understand that memory pages may be read only or protected, I mean an address that I can assume I can write to.</p>