Linux under Fastbin use summary--FD overwrite with arbitrary address free

The Fastbin under Linux is the key point of the PWN problem in CTF. Last year (2015), XCTF two stations are using Fastbin as the pwn400 of the use of the axis of the problem to appear, which is also my first contact with the use of Fastbin, referring to the K0sh1 master wrote on the freebuf of an article. I wrote a few demos to illustrate the problem.

Directory

1. About Fastbin

2. Overlay FD Pointer Implementation utilization

3. Free use of any address (house of Spirit)

1. About Fastbin

The heap we are generally familiar with is the chunk of a doubly linked list, but for a heap block of size (bytes~ Bytes) It is managed using Fastbin.

The heap block structure of the fastbin is exactly the same as the conventional chunk, except that the single-linked list is used.

As is the structure of a fastbin block in use

This is the use of Fastbin

Linux under Fastbin use summary--FD overwrite with arbitrary address free