New Age

0xl4ugh

Task: Read a flag file through a seccomp sandbox that blocks open, openat, execve, and other syscalls with conditional read/write buffer restrictions. Solution: Use openat2 syscall (number 437, added in Linux 5.6) which was not in the seccomp blocklist, read into the high-address allowed region, copy to low-address region, and write to stdout.