CSAW 2019 — popping_caps (high-level)

What this is

Archived notes on popping_caps from CSAW CTF 2019: a 64-bit Linux heap challenge with a small menu (allocate / free / write / exit). The binary enables common hardening (canary, NX, PIE) while leaving RELRO off and intentionally leaking a libc-related pointer at startup.

Vulnerability class (concept)

• Heap metadata / tcache trust issues: freeing and reallocating chunks in ways that confuse allocator bookkeeping.
• House-of-Spirit–style fake-chunk ideas: planting a chunk-looking structure so a later allocation returns an attacker-chosen location.
• Signed integer / index handling in the size or offset path so references can walk outside the intended object (negative offsets into nearby heap state such as tcache_perthread_struct).
• Eventual function-pointer / hook corruption themes common to older glibc heap challenges (e.g., targeting allocator hooks once a controlled chunk is returned).

Impact (abstract)

In the CTF setting, successful abuse yields arbitrary write primitives and typically code execution in the challenge process. The same class of bugs in real allocators historically enabled local or remote code execution when exposed.

Lessons / what to check

• Keep allocator versions and mitigations current; many classic hook targets are removed or hardened in modern glibc.
• Treat user-controlled sizes and signed lengths as high risk near heap managers.
• Prefer safe languages or hardened allocators for untrusted input; fuzz free/realloc sequences.
• For defenders reviewing similar CTF-style code: look for missing bounds on indices into heap-managed arrays and for “free of non-malloc pointers.”

Solve steps and PoC omitted.