I have met some problems when writing the exp, can you help me?

[5ma11wh1t3]

When I first overwrite the SSL structure, I get the above error and can't do the later exploit. My forgitate vm's version is 7.0.10 and 7.2.1

[delsploit]

I don't know what your situation is exactly. It seems that the rax value is broken and it may come from other sprayed objects, not the victim one. You should write something in victim object, leaving other objects clean. After that, you should do something only on the victim connection, remaining other connections.

[5ma11wh1t3]

But when i debug my exp, i have no idea to avoid this problem. when i alloc ssl
struct and free ssl struct like your code, it doesn't work. Will it be related to my SSL version, as I am using a trial version of my VM, and the SSL version seems to be low.

[delsploit]

I think that the rax value come from broken object. You need to check where the value come from, where the object is broken and recover it. All values must be clean without victim area which function pointer is written in.

[5ma11wh1t3]

Do you have a talned service in your Fortigate VM, I don't have it in my VM, I used port 443 to attach debugging, I suspect it's for this reason. If so, can you lend me your VM to learn, please. My e-mail address is 1974189628@qq.com.