### HITB-XCTF -PWN pt.487
## Review* I alway prefer ubuntu 16.04 version when i solve the ctf.* I could not find the vulnerability in this binary.* Finally, I found that the version of libc is 2.26.(CMD => `strings libc.so.6 | grep "libc-"`)* In server, this binary is running on ubuntu 17.10.* Then, I count`t execute this binary with server libc.* ubuntu 17.04 => libc-2.25, ubuntu 17.10 => libc-2.26* Because, I was install ubuntu 17.10....
## Vulnerability* libc-2.26 is a way to info leak, and the structure of the heap is very different.
* The biggest feature of libc-2.26 is that it is double-free regardless of its size, Because we initially use a heap space called tcache, not an unsorted bin, fastbin, and so on.
## Info Leak
* The heap leak and libc leak methods are different from previous versions of libc.* libc-2.26 use tcache. tcache is used like fastbin. Therefore Heap leak is easy..but libc leak is difficult
## Libc Leak
* tcache can have a maximun of 7 chunks. Therefore by freeing more than 7 chunks, the remaining chunks will be treated as usual.* If chunk of 0x100 size is freed after 7-tcache(all) has been freed, then the freed chunk goes into unsorted bin.* Therefore, We can libc leak.
## Exploit 
* libc-2.26 version can be double-free regardless of size.* So you can do exploit using **__free_hook()** address , **system()** address * It is recommended that you are debugging yourself for details.