【技术分享】学习笔记：UAF释放后重用

// UAFv1.cpp : 定义控制台应用程序的入口点。//#include<iostream>using namespace std;#include "stdafx.h"#include<stdio.h>#include<Windows.h>#define size 32

class Base{public :int base;virtual void f(){ cout<<"Base::f()"<<endl;}virtual void g(){cout<<"Base::g()"<<endl;}virtual void h(){cout<<"Base::h()"<<endl;}};class Child:public Base{public:int child;void f(){cout<<"Child::f()"<<endl;}void g1(){cout<<"Child::g1()"<<endl;}void h1(){cout<<"Child::h1()"<<endl;}};
int _tmain(int argc, _TCHAR* argv[]){char *buf1;char * buf2;//Lab1    buf1=(char *)malloc(size);printf("buf1:0x%pn",buf1);free(buf1);
    buf2=(char *)malloc(size);printf("buf2:0x%pn",buf2);
memset(buf2,0,size);printf("buf2:%dn",*buf2);
printf("====Use Afrer Free====n");strncpy(buf1,"hack",5);printf("buf2:%snn",buf2);
free(buf2);//Lab2    Base *B=new Base();    Base *C=new Child();


    getchar();return 0;}

text:004117C3                 mov     eax, [ebp+var_8]
.text:004117C6                 mov     dword ptr [eax], offset ??_7Base@@6B@ ; const Base::`vftable'

$ scp -P2222 uaf@pwnable.kr:/home/uaf/uaf  /Users/p0kerface/
$ scp -P2222 [email protected]:/home/uaf/uaf.cpp  /Users/p0kerface/

uaf.cpp


#include <fcntl.h>
#include <iostream> 
#include <cstring>
#include <cstdlib>
#include <unistd.h>
using namespace std;


class Human{
private:
virtual void give_shell(){
        system("/bin/sh");
    }
protected:
int age;
string name;
public:
virtual void introduce(){
cout << "My name is " << name << endl;
cout << "I am " << age << " years old" << endl;
    }
};


class Man: public Human{
public:
    Man(string name, int age){
this->name = name;
this->age = age;
        }
virtual void introduce(){
        Human::introduce();
cout << "I am a nice guy!" << endl;
        }
};


class Woman: public Human{
public:
        Woman(string name, int age){
this->name = name;
this->age = age;
        }
virtual void introduce(){
                Human::introduce();
cout << "I am a cute girl!" << endl;
        }
};


int main(int argc, char* argv[]){
    Human* m = new Man("Jack", 25);
    Human* w = new Woman("Jill", 21);


size_t len;
char* data;
unsigned int op;
while(1){
cout << "1. usen2. aftern3. freen";
cin >> op;


switch(op){
case 1:
                m->introduce();
                w->introduce();
break;
case 2:
                len = atoi(argv[1]);
                data = new char[len];
                read(open(argv[2], O_RDONLY), data, len);
cout << "your data is allocated" << endl;
break;
case 3:
delete m;
delete w;
break;
default:
break;
        }
    }


return 0;    
}

case 1:
                m->introduce();
                w->introduce();
break;

gdb-peda$ b *0x400f13
Breakpoint 1 at 0x400f13
gdb-peda$ b *0x400fcd
Breakpoint 2 at 0x400fcd
gdb-peda$ b *0x40102d
Breakpoint 3 at 0x40102d
gdb-peda$ b *0x401076
Breakpoint 4 at 0x401076