Simple PWN - 0x17(UAF - leak information)

Posted on | Post modified | In |

Simple PWN - 0x17(UAF - leak information)

tags: CTF PWN eductf

Version: Ubuntu 20.04

UAF backgroud

Original Code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
#include <stdio.h>
#include <stdlib.h>

int main()
{
    void *p1, *p2;
    p1 = malloc(0x30);
    p2 = malloc(0x30);

    free(p1);
    free(p2);

    puts(p2);
}

If we set the pointer to NULL after it was freed, then we can get some vital info. from this chunk.

Analyze

  • After malloc all pointer
  • After free p1
  • After free p2, the data section will transfer to store metadata, and fd store the address of p1 header
  • Thus, we print out the value of p2, we will leak something if it wasn’t set NULL after it was freed