pwnProeasy

Knight Squad Academy

knightctf

Task: Binary with buffer overflow in registration function, read() reads 240 bytes into 112-byte buffer. Solution: ret2win ROP chain using pop rdi gadget to pass magic value 0x1337c0decafebeef to hidden win function.

$ ls tags/ techniques/
buffer_overflowret2winropx64
ret2winstack_buffer_overflowrop_chain
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups