C++ Exploitation

Heap exploitation is hard. There's safelinking, metadata corruption detection mechanisms, FILE_plus has vtable validation... If only there were a data structure that would contain a pointer and a length and whose corruption would allow arbitrary read and write!

They promised that C++ would be safe... They lied.

How simple it was to manipulate vtable and _wide_data in FILE_plus! As if libc developers wanted us to exploit programs this way. How nice of them. But what if FILE_struct_plus were not the only structure that makes use of vtables, i.e. tables of function pointers?

Leverage a vtable exploit to get a root shell.

Btw. I felt a bit paranoid, so I added some extra measures:

g++ -Wl,-z,relro,-z,now -fstack-protector -fcf-protection=full -o main main.cpp