offensive-toctou

1# TOCTOU — Time-of-Check / Time-of-Use Exploitation
2 
3A TOCTOU bug exists wherever code checks a property (file owner, path target, token validity, balance) and then acts on it as if the property still holds. Between check and use is a window — your job is to widen it and swap the underlying object.
4 
5## Quick Workflow
6 
71. Identify the **check** (syscall, function, validation step) and the **use** (the privileged action)
82. Confirm the check and use don't operate on the same kernel object (FD, inode, atomic snapshot)
93. Build a primitive that swaps the object between check and use (symlink, mount, mv, parallel request)
104. **Widen the window** with FUSE, slow filesystems, scheduler tricks, or single-packet HTTP/2
115. Run a tight loop and confirm the post-use state corresponds to the swapped target
12 
13---
14 
15## The Core Pattern
16 
17```c
18// Vulnerable
19if (access(path, W_OK) == 0) {     // check  — resolves "path" now
20    fd = open(path, O_WRONLY);     // use    — re-resolves "path" later
21    write(fd, attacker_data, n);
22}
23```
24 
25Between `access` and `open`, an attacker replaces `path` with a symlink to `/etc/shadow`. The check sees an attacker-owned file; the use opens shadow as root.
26 
27The fix is always: **operate on the kernel object, not the path.** Use `O_NOFOLLOW`, `openat` with `AT_SYMLINK_NOFOLLOW`, `fstat` on the FD, etc.
28 
29---
30 
31## Filesystem TOCTOU
32 
33### Symlink Swap (Classic)
34 
35```bash
36# Setup target — privileged binary that writes to user-supplied path after access() check
37…