RELRO STACK CANARY NX PIE Partial RELRO Canary found NX enabled No PIE
堆的题目基本都是选择菜单，这里可以添加，删除，选择，编辑，展示球员，还可以显示队伍，
Welcome to your TeamManager (TM)! 0.- Exit 1.- Add player 2.- Remove player 3.- Select player 4.- Edit player 5.- Show player 6.- Show team Your choice:
Your choice: 1 Found free slot: 0 Enter player name: 1 Enter attack points: 1 Enter defense points: 1 Enter speed: 1 Enter precision: 1 上面就是球员这个结构有什么信息，第一个free slot就相当于球员的id，这个不用我们输入
remove就删除咯
Your choice: 2 Enter index: 0 She's gone! select会输出球员的信息 Your choice: 3 Enter index: 0 Player selected! Name: 1 A/D/S/P: 1,1,1,1 edit当前的palyer，基于上面的select Your choice: 4 0.- Go back 1.- Edit name 2.- Set attack points 3.- Set defense points 4.- Set speed 5.- Set precision Your choice: show palyer，这个显示的是select的player Your choice: 5 Name: 2 A/D/S/P: 1,1,1,1 show team会将所有球员信息打印出来 Your choice: 6 Your team: Player 0 Name: 2 A/D/S/P: 1,1,1,1 Player 1 Name: 3 A/D/S/P: 3,3,3,3 经过对add_player的逆向，可以推出palyer的结构 struct palyer{ int attackPoint; int defensePoints; int speed; int precision; char* name; } unsigned __int64 delete_player() { void **ptr; // ST08_8 unsigned int v2; // [rsp+4h] [rbp-1Ch] char nptr; // [rsp+10h] [rbp-10h] unsigned __int64 v4; // [rsp+18h] [rbp-8h] v4 = __readfsqword(0x28u); printf("Enter index: "); fflush(stdout); readline(&nptr, 4LL); v2 = atoi(&nptr); if ( v2 <= 0xA && players[v2] ) { ptr = (void **)players[v2]; players[v2] = 0LL; free(ptr[2]); free(ptr); puts("She's gone!"); fflush(stdout); } else { puts("Invalid index"); fflush(stdout); } return __readfsqword(0x28u) ^ v4; } uaf漏洞点
# The 'selected' array contains the 3rd player object # We are abusing the UAF vuln to leak libc # show_player just checks if the 'selected' array is empty # if it's not, it will print the value of the player's object # without checking if it's actually free'd or not show()