phone book

Author: 0xIDA

Summary

FlagYard PWN medium (150 pts). glibc 2.27 contacts menu with an 8-operation budget, malloc_usable_size overflow into the next chunk header, UAF, and signed OOB index. Solved with wrap House of Force onto tcache entries, free_hook=system, and free("/bin/sh").

Solution

• print(-8) → libc via stdout FILE fields.
• Add with top poison -1, free + UAF print → heap (tcache key).
• Wrap HoF so the next user lands on tcache entries (heap+0x50).
• Write entries[5]=__free_hook and keep /bin/sh as the land phone field.
• malloc(0x68) returns __free_hook; set phone to system. Skip the name read (cltq + EINVAL).
• delete the land chunk → system("/bin/sh").

Solvers

• exploit.py

Flag

FlagY{60f432f87eb172e8cd5608588586bd29}