Name

grodno_new_year_2026

Task: Binary session manager with create/delete/feedback/greet operations where delete frees memory without clearing the pointer. Solution: Exploited a classic Use-After-Free: created a session, freed it (dangling pointer), allocated feedback of the same size (reusing the chunk), overwrote the function pointer at offset 0x18 with admin_shell address, then triggered greet to call it.