House of Eggs

[4f3rg4n]

Implement House of Eggs, a newer heap technique that leverages a UAF write primitive for RCE.

[Kyle-Kyle]

A few comments:

• we discourage doing things like free(large_end-0x10);, because this is an implicit invalid free primitive. We made an exception for house-of-water because 1.it is achievable from a double-free primitive 2. the technique abuses the tcache_perthread_struct in a smart way that may inspire other techniques. So we document the simulation of the arbitrary-free/invalid-free primitive clearly in the technique
• FSOP is out-of-scope for this repo: there are so many heap techniques and FSOP techniques, if we track the combination of them, this repo will not be maintainable. We usually stop at arbitrary allocation or chunk overlapping. For how to obtain shell after overwriting IO_FILE, I recommend removing the details from the technique and just mention that you can use FSOP to get shell (I think the wide_data vtable variant is quite well-known, there is no need to stress it again in this repo).

[4f3rg4n]

Thanks for the really fast response, I appreciate it.

I'll focus on the FSOP since I've seen you did something similar in the House of Orange code, so I'm just wondering which FSOP techniques you prefer to use and which ones you avoid...

[Kyle-Kyle]

The house-of-orange technique is there because that was the only FSOP technique back then, so we kept it for historical reasons. After that, FSOP exploded and it became hard to track the combinations of heap techniques and FSOP techniques, so we want to avoid it in this repo.
I'd be nice to have a separate repo that tracks FSOP techniques though.

[4f3rg4n]

Thanks! really appreciate your work guys.
closing PR.

[oliness]

The house-of-orange technique is there because that was the only FSOP technique back then, so we kept it for historical reasons. After that, FSOP exploded and it became hard to track the combinations of heap techniques and FSOP techniques, so we want to avoid it in this repo. I'd be nice to have a separate repo that tracks FSOP techniques though.

I've made a new repo: https://github.com/oliness/fsop2shell

That can become a repository of FSOP techniques. @4f3rg4n do you want to put House of Eggs code there, we can fill out the repo for different libc's, architectures, etc.