Lion Cipher Lab
Exploit the heap with the House of Einherjar (forge a chunk with a null-byte overflow and consolidate backward)
- Penetration Testing / Red Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
House of Einherjar is the technique that turns the single most common heap bug in real software — an off-by-one that writes ONE null byte past a buffer — into a controlled allocation anywhere you want. That is a huge amount of leverage from the smallest possible overflow: not a page of attacker bytes, just 0x00 in the wrong place. Learning it teaches two durable things. First, the mechanic: how the PREV_INUSE flag and the prev_size field let free() merge a chunk with the one before it, and how clearing one bit convinces the allocator to consolidate BACKWARD into memory you forged. Second, and…
What you'll learn
- glibc heap internals
- off-by-one / poison-null-byte primitives
- PREV_INUSE & prev_size metadata
- backward consolidation abuse
- House of Einherjar primitive
- fake-chunk forgery
- heap exploitation judgment
- pwndbg / gdb heap inspection
- reasoning about glibc mitigations
Steps in this lab
- The one-sentence idea: one null byte lies about who's free
- When this applied — the exact bug it needs
- Legal and ethical line — read before you run anything
- Spin up an OLD-glibc container — the version is the whole game
- Get how2heap and read the einherjar source before running it
- Run it and watch the backward consolidation land
- Inspect the consolidation in a debugger — see the chunk move backward
- Now watch the naive version DIE on modern glibc — and understand exactly why
- Where an off-by-null still bites — and the durable takeaway