pwnmedium

Echo

srdnlen

Task: Echo server with off-by-one vulnerability in read loop. Solution: Overwrite maxlen to expand buffer, progressive stack leak via puts without null terminator, bypass canary and PIE via leaks, ret2libc ROP chain.

$ ls tags/ techniques/
pieoff_by_oneret2libcropnxfull_relrostack_canaryputs_leaklibc_identification
off_by_one_maxlen_overwriteputs_no_null_terminator_leakprogressive_stack_leakcanary_bypass_via_leakret2libc_rop
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]