pwneasy

Hackbin

hackerlab

Task: a 64-bit non-PIE ELF with a menu and an unsafe gets() call in add_note() lets user input overflow a stack note buffer. Solution: overwrite RIP at offset 0x488 and use ret2win with an extra ret gadget for x86_64 stack alignment before calling get_flag().

$ ls tags/ techniques/
buffer_overflowgetsx86_64ret2winstack_alignmentno_pie
ret2winstack_buffer_overflow
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]