pwnmedium

ReplaceMe

hackthebox

Task: sed-like string replacement utility with read() not adding null terminator and contiguous BSS buffers. Solution: 3-pass ret2libc exploiting strlen inflation across buffer boundary, partial return address overwrite for PIE leak, GOT read for libc leak.

$ ls tags/ techniques/
stack_overflowpieret2libcpartial_overwritepwnglibc_2.31no_canaryfull_relromemcpybss_overflowsed_parserread_no_nullstrlen_overflow
multi_pass_ret2libcpartial_ret_addr_overwritepie_leak_via_fputslibc_leak_via_gotbss_contiguous_strlen_inflationlocal_variable_overwrite_controlstack_alignment_tracking
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]