Lion Cipher Lab
Exploit the heap with the House of Force (and why modern glibc killed it)
- Penetration Testing / Red Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
House of Force is the most vivid lesson in heap exploitation history: a single unchecked subtraction inside malloc let an attacker turn one size overwrite plus one giant allocation request into an arbitrary write anywhere in memory. It ruled 2010s CTF and real-world heap exploitation — and then glibc 2.29 added one sanity check and killed it almost overnight. Learning it teaches two durable skills at once. First, the mechanic: how the top ('wilderness') chunk works and why unchecked pointer arithmetic on it is catastrophic. Second, and more importantly, the JUDGMENT: how a defensive change of…
What you'll learn
- glibc heap internals
- top chunk / wilderness manipulation
- House of Force primitive
- arbitrary-write construction
- heap exploitation judgment
- pwndbg / gdb heap inspection
- reasoning about glibc mitigations
Steps in this lab
- The one-sentence idea: bully the wilderness
- When this applied — and the one bug it needs
- Legal and ethical line — read before you run anything
- Spin up an OLD-glibc container — the version is the whole game
- Get how2heap and compile house_of_force.c with the right flags
- Run it and watch the arbitrary write land
- Inspect the top chunk moving in a debugger
- Now watch it DIE on modern glibc — and understand why
- What attackers moved to — and the durable takeaway