pwnmedium
ByteCrusher
dicectf_2026
Task: PIE binary with 16 trial calls to crush function and gets() in feedback. Solution: Use controlled rate parameter for OOB read to leak canary and PIE base byte-by-byte, then stack overflow via gets() for ret2win to admin_portal().
$ ls tags/ techniques/
ret2winbyte_by_byte_stack_leak_via_oob_readcanary_leak_via_crush_ratepie_leak_via_return_addressgets_stack_overflow
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]