pwnProhard

Common Offset

srdnlen

Task: Binary with shared offset between files, 16-bit word addition with 8-bit validation. Solution: Exploit uint16_t carry overflow to get OOB index, use ret2dlresolve with fake ELF structures in BSS to call system("sh").

$ ls tags/ techniques/
type_confusionstack_overflowret2dlresolveno_piepartial_relrono_canarynxuint16_overflowoob_writeelf_dynamic_linking
uint16_carry_overflow_to_oob_indexret2dlresolve_fake_structuresplt0_trampoline_resolveoverlapping_elf_structures_in_bss
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups

  • [pwn][free]Void— hackthebox
  • [pwn][Pro]Taste— grodno_new_year_2026
  • [pwn][free]Regularity— hackthebox
  • [pwn][Pro]Echo— srdnlen
  • [pwn][free]0xDiablos— hackthebox