$ cat writeup.md…
$ cat writeup.md…
duckerz
Task: a non-PIE heap menu binary on glibc 2.27 lets us free descriptions without clearing pointers, edit freed chunks, and read raw bytes from stale heap pointers. Solution: leak libc from an unsorted-bin chunk, poison the 0x100 tcache list to land on __free_hook, write system, then free /bin/sh.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar