Lion Cipher Lab
Forge a fake chunk with the House of Spirit
- Penetration Testing / Red Team
- Advanced
- ~75 min
- Free · no account required
Why it matters
House of Spirit is the cleanest illustration of the single most important idea in heap exploitation: if you can free a pointer you control, and you control the bytes around it, you can trick malloc into handing that memory back to you as a fresh allocation — an arbitrary-allocation primitive built out of nothing but a controllable free(). Every 'house-of' technique is a variation on making the allocator trust attacker-forged metadata. Learning to forge a valid-looking chunk, and learning why modern mitigations (tcache checks, safe-linking) blunt the naive version, is what lets a pro pick the…
What you'll learn
- glibc heap internals
- fastbin & tcache freelists
- fake-chunk forgery
- House of Spirit primitive
- heap exploitation judgment
- pwndbg / gef heap inspection
Steps in this lab
- The one-sentence idea, and when it applies
- Pin the glibc — the target's exact version is the whole game
- Build and run the example — watch malloc hand back your fake chunk
- Read the annotated source — why the fake chunk must look real
- Inspect the freelist in a debugger — see the fake chunk on the bin
- Why the naive version breaks today — tcache keys and safe-linking
- How a pro reasons about heap exploitation — the takeaway