# mini_httpd — Heap Exploitation Practice Target

A deliberately vulnerable embedded-style HTTP server for practicing heap
exploitation techniques. Simulates a typical router/IoT web interface with
the kind of bugs you'd find during real firmware vulnerability research.

## Scenario

You've extracted firmware from a consumer router and found its `httpd`
binary. The device runs an old glibc (2.23) with no modern heap hardening.
ASLR is off. Your goal: find the heap bugs, understand the vulnerability
classes, and develop working exploits.

## Quick Start

```bash
# Option A: Docker (recommended — gives you glibc 2.23)
docker build -t mini_httpd_ctf .
docker run --rm -it -p 8080:8080 --cap-add=SYS_PTRACE \
           --security-opt seccomp=unconfined mini_httpd_ctf bash

# Inside container:
echo 0 > /proc/sys/kernel/randomize_va_space
./mini_httpd &
# Exploit from inside or from host via port 8080

# Option B: Local build (uses your system glibc)
make
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
./mini_httpd
```

## Target Info

- **Architecture**: x86-64
- **Allocator**: glibc 2.23 malloc (no tcache)
- **Protections**: No canary, no PIE, no RELRO, executable stack
- **Server model**: Single-threaded, persistent connections (keep-alive)
- **Port**: 8080 (or pass a custom port as argv[1])

The server handles multiple HTTP requests per connection, which means
multi-step exploits can chain requests within a single TCP session.

## Endpoints

| Method | Path             | Description                        |
|--------|------------------|------------------------------------|
| GET    | `/`              | Index page with endpoint listing   |
| GET    | `/api/info`      | Device info (reads X-Device-Id)    |
| GET    | `/api/log`       | Activity log (X-Log-Size controls) |
| GET    | `/api/debug`     | Address leak helper (cheat mode)   |
| POST   | `/api/login`     | Create session (user=X&pass=Y)     |
| GET    | `/api/logout`    | Destroy session (X-Session-Id)     |
| GET    | `/api/status`    | Session status (X-Session-Id)      |
| POST   | `/api/config`    | Update config (key=val&key=val)    |
| POST   | `/api/firmware`  | Firmware upload (X-Firmware-Size)  |
| POST   | `/api/diag`      | Diagnostic (PING/UPTIME/ECHO msg)  |

## Challenge

There are **6 vulnerabilities** in this server — 4 heap corruption
bugs and 2 information leak bugs. They represent different bug classes
commonly found in real embedded firmware and are exploitable on
glibc ≤ 2.27 (pre-tcache) or uClibc.

Your objectives:

1. **Find** each bug through source code audit
2. **Classify** the vulnerability type
3. **Develop a PoC** that triggers the corruption (verify with ASAN build)
4. **Write a working exploit** that achieves code execution

### Difficulty Progression

Start with the ASAN build (`make asan`) to confirm you've found and
triggered a real bug. Then switch to the router build and develop an
actual exploit against glibc 2.23.

```bash
# Step 1: Trigger bugs (ASAN catches them)
make asan
./mini_httpd_asan &
python3 your_trigger.py

# Step 2: Exploit bugs (glibc 2.23 in Docker)
# Use pwntools, raw sockets, or curl
```

### Hints

- Read the source like you'd audit unfamiliar firmware — function by
  function, tracing heap allocations and their lifetimes
- The `/api/debug` endpoint gives you addresses for free (cheat mode).
  For a realistic challenge, find the info leak bugs first and use
  those to bootstrap your exploit — this is the real-world workflow
- Think about what happens when a buffer's allocation size doesn't
  match the amount of data written OR the amount sent to the client
- Think about what happens when error paths free memory
- Think about object lifetimes across requests
- Think about what sits next to your allocation on the heap
- Think about what happens when user input is used as a format string
- A complete exploit chain: info leak → compute addresses → heap
  corruption → code execution

## Useful Commands

```bash
# Watch heap state in GDB
gdb -p $(pidof mini_httpd)
(gdb) heap            # if gef/pwndbg installed
(gdb) x/40gx <addr>  # examine heap manually

# Quick trigger test
curl http://localhost:8080/api/debug
curl -X POST http://localhost:8080/api/login -d "user=admin&pass=admin"
```

## Spoilers

See `BUGS.md` for full vulnerability descriptions, exploitation
strategies, and hints — but try to find them yourself first.
