文章浏览阅读329次。ciscn_2019_s_6：保护全开漏洞分析：指针未清零，存在uaf大致步骤：利用unsortbin泄露libc，doublefree劫持free_hook为systemexp：from pwn import *local_file = './ciscn_s_6'local_libc = './libc-2.27.so'remote_libc = './libc-2.27.so'select = 1if se......