Lion Cipher Lab
Exploit the heap with the House of Orange (free the top chunk without free(), then hijack _IO_FILE/FSOP for code execution)
- Penetration Testing / Red Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
House of Orange is the technique that broke a rule everyone thought was safe: it turns a heap overflow into a full shell WITHOUT the program ever calling free(). Presented at HITCON 2016 for a challenge that gave you no free() primitive, it showed that the allocator will free a chunk FOR you — corrupt the top chunk's size, ask for something bigger than the top, and glibc's own heap-extension code (sysmalloc) frees the old top into the unsorted bin. From there it chains an unsorted-bin attack into FSOP (file-stream-oriented programming): overwrite _IO_list_all with a forged _IO_FILE and let…
What you'll learn
- glibc heap internals
- top-chunk (wilderness) mechanics and sysmalloc
- manufacturing a free() without calling free()
- unsorted-bin attack primitive
- _IO_FILE / _IO_FILE_plus internals and FSOP (file-stream-oriented programming)
- forging a vtable to hijack the abort/flush path
- House of Orange end-to-end
- heap exploitation judgment
- reasoning about glibc mitigations (vtable check, top-size check)
Steps in this lab
- The one-sentence idea: make glibc free the top chunk FOR you, then hijack the crash
- When this applied — the exact preconditions (and why 'no free()' was the whole point)
- Legal and ethical line — read before you run anything
- Spin up an OLD-glibc container — the version is the whole game
- Get how2heap and read house_of_orange.c before running it
- Run it and get the shell — a free() you never wrote, cashed into RCE
- Inspect the manufactured free and the unsorted bin in a debugger
- Now watch the naive version DIE on modern glibc — and understand exactly why
- Where FSOP still bites — and the durable takeaway