Dissecting House of Apple 2 on modern glibc

This report dissects House of Apple 2, an exploitation technique that functions in modern glibc versions. The technique exploits file stream structures in glibc, specifically manipulating the vtable dispatch mechanism of _IO_FILE_plus. Modern glibc validates this vtable, making a direct replacement with an arbitrary address ineffective.

House of Apple 2 bypasses this restriction by using a valid _IO_FILE_plus vtable to access the wide-character stream machinery, which has an unvalidated secondary vtable. By overwriting the vtable pointer, an arbitrary call primitive can be created, enabling a stack pivot and a ROP chain. This exploration assumes the ability to overwrite a FILE structure and possession of both a heap leak and a libc leak.

The target binary already provides these conditions. The sandbox environment used for this dissection runs Ubuntu 26.04 LTS, ensuring a modern and relevant testing ground. The binary includes an interactive menu for invoking file stream operations, facilitating debugging and experimentation. The analysis begins with an inspection of the _IO_FILE and _IO_FILE_plus structures, revealing that _IO_FILE_plus is essentially an _IO_FILE with an additional vtable pointer.

By controlling this pointer, an indirect call can be redirected, thereby hijacking control flow. The report outlines the steps taken to inspect the vtable, including breakpoint placement, breakpoint inspection, backtrace examination, and validation of the vtable pointer. It is clear that modern glibc imposes a strict range validation on the vtable pointer, making a straightforward attack impractical.

However, the report also reveals an alternative path through the wide-character stream machinery, which bypasses the range validation check. This path leads to the _IO_wdoallocbuf function, where the vtable pointer can be overwritten without validation. By satisfying certain conditions, such as setting the _lock field to a zero-initialized region of 0x10 bytes, the technique can successfully reach the _IO_wdoallocbuf function and ultimately achieve arbitrary code execution.