phone book — Pwn (tcache poisoning)

Lab: FlagYard Lab 5 (PWN) · Points: 150

Summary

A phone-book binary with a Use-After-Free in the delete path. Free chunks go into tcache unsorted, and the pointer is not nulled. We poison a tcache fd to redirect allocation to __free_hook, write system there, and trigger it with "/bin/sh".

The bug

After delete_contact(), the chunk is freed but the global pointer array still holds the address. A second free of the same index double-frees into tcache.

Exploit outline

  1. Allocate 2 chunks A, B.
  2. Free A, free B (B into tcache).
  3. Free A again → tcache now has A -> B -> A (cycle).
  4. Allocate to get A back, overwrite its fd with __free_hook - 0x10.
  5. Next allocations hand us __free_hook; write system.
  6. Place "/bin/sh" in a chunk, free it → system("/bin/sh").

Payload (pwntools)

from pwn import *
context.arch = "amd64"
# ... (full script in repo /home/kali/fy_challenges)

Flag

FlagY{062364abc9ade43694ea98da4ecf0f89} — submitted, +150.

Lesson

Never trust a free list after free() without nulling the source pointer. tcache poisoning is the fastest path to __free_hook on glibc 2.27–2.31.