cyberdream.blog

Heap Exploitation Lab 01 - House of Force

Fri, 07 Aug 2026 11:52:47 +0000

Introduction Link to heading

Most heap exploitation tutorials focus on isolated CTF challenges or a single binary with one bug and a clear path to the flag. Real embedded firmware is different. Vulnerabilities are spread across multiple handlers, exploitation requires chaining several bugs together, and you’re working against an allocator with its own quirks and version-specific behaviors.

To bridge that gap, I built a practice target from scratch using Claude: a deliberately vulnerable HTTP server modeled after the kind of httpd daemons found in consumer routers. This post walks through the target design, the vulnerabilities I embedded in it, and the full exploit chain I developed: from information leak to remote code execution using the House of Force technique against glibc 2.23.

D-Link DCS-935l | CVE-2025-10779

Tue, 30 Jun 2026 17:16:45 +0000

This exploit was developed in EMUX firmware emulation framework where target is build in.

Vulnerability type: Stack buffer overflow
Tested firmware version: 1.06
Exploit mitigations: None
Executable: /web/cgi-bin/hnap/hnap_service
Function reported: sub_402280
Real function: sub_401f5c, strcpy at 0x402230

Tools Link to heading

Ubuntu 24.04.4 LTS
- qemu-user-static
- gcc-mips-linux-gnu
- binutils-mips-linux-gnu
- python3-pip
- python3-venv
- gdb-multiarch
EMUX framework (https://github.com/therealsaumil/emux)
Binary Ninja
- VulnFanatic plugin
python3
- pwntools
- requests
static mips tools (https://github.com/CyberDanube/medusa-embedded-toolkit)
- gdbserver
- strace

Research Link to heading

This N-day vulnerability was reported for newer firmware version so we must do research for right vulnerable function. When we search for vulnerable function address 0x402280 in Binary Ninja, we land in the middle of function sub_401f5c.

About me

Sat, 23 May 2026 00:00:00 +0000