Heap Overflow Exploitation

A vulnerable program has a heap overflow. Corrupt heap metadata to gain control.

Binary Analysis

• malloc() allocates chunks with metadata headers
• Two adjacent heap chunks are allocated sequentially
• The first chunk has an unbounded copy operation
• The second chunk contains a function pointer that gets called later

Overflow the first chunk to overwrite the function pointer in the second chunk, redirecting execution to the win() function.

Submit the payload size and the target address in the flag format: FLAG{size:hex_address}