BUUCTF-PWN-pwnable_hacknote-UAF

1.checksec+运行

 标准的菜单模式

canary和NX保护

2.32位IDA

1.sub_8048646()

unsigned int sub_8048646()
{
  int v0; // ebx
  int i; // [esp+Ch] [ebp-1Ch]
  int size; // [esp+10h] [ebp-18h]
  char buf[8]; // [esp+14h] [ebp-14h] BYREF
  unsigned int v5; // [esp+1Ch] [ebp-Ch]

  v5 = __readgsdword(0x14u);
  if ( dword_804A04C <= 5 )
  {
    for ( i = 0; i <= 4; ++i )
    {
      if ( !*(&ptr + i) )
      {
        *(&ptr + i) = malloc(8u); //malloc 0x8 的chunk,叫note块
        if ( !*(&ptr + i) )
        {
          puts("Alloca Error");
          exit(-1);
        }
        *(_DWORD *)*(&ptr + i) = sub_804862B; //note[0]存放puts()函数的地址
        printf("Note size :");
        read(0, buf, 8u);
        s