pwnhard
message-store
dicectf_2026
Task: Rust binary with color menu storing messages. Solution: OOB function pointer call via unbounded color index, stack pivot using xchg rsp,rax gadget with UTF-8-safe ROP chain in BSS buffer to execve shell.
$ ls tags/ techniques/
oob_function_pointer_callstack_pivot_xchg_rsp_raxutf8_safe_rop_chainbss_rop_chaincow_borrowed_exploitation
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]