offensive-toctou

# TOCTOU — Time-of-Check / Time-of-Use Exploitation A TOCTOU bug exists wherever code checks a property (file owner, path target, token validity, balance) and then acts on it as if the property still holds. Between check and use is a window — your job is to widen it and swap the underlying object. ## Quick Workflow 1. Identify the **check** (syscall, function, validation step) and the **use** (the privileged action) 2. Confirm the check and use don't operate on the same kernel object (FD, inode, atomic snapshot) 3. Build a primitive that swaps the object between check and use (symlink, mount, mv, parallel request) 4. **Widen the window** with FUSE, slow filesystems, scheduler tricks, or single-packet HTTP/2 5. Run a tight loop and confirm the post-use state corresponds to the swapped target --- ## The Core Pattern ```c // Vulnerable if (access(path, W_OK) == 0) { // check — resolves "path" now fd = open(path, O_WRONLY); // use — re-resolves "path" later write(fd, attacker_data, n); } ``` Between `access` and `open`, an attacker replaces `path` with a symlink to `/etc/shadow`. The check sees an attacker-owned file; the use opens shadow as root. The fix is always: **operate on the kernel object, not the path.** Use `O_NOFOLLOW`, `openat` with `AT_SYMLINK_NOFOLLOW`, `fstat` on the FD, etc. --- ## Filesystem TOCTOU ### Symlink Swap (Classic) ```bash # Setup target — privileged binary that writes to user-supplied path after access() check victim --o...