uaf4b - CakeCTF2021

Plan Overwrite the function pointer with system function by Use After Free. About CAWSAY struct In freed chunk, fn_dialogue is assigned to fd and message is assigned to bk. typedef struct { void (*fn_dialogue)(char*); char *message; } COWSAY; Also, you pay attention to execute cowsay->fn_dialogue(cowsay->message); in L167~171 in main.c. case 1: /* Use cowsay */ printf("[+] You're trying to call 0x%016lx\n", (addr)cow say->fn_dialogue); cowsay->fn_dialogue(cowsay->message); break; malloced chunk When it malloced, Heap area is following....

2022-05-10 · 1 min · Me