pwneasy

Admin

spbctf

Task: gain admin access in a binary that checks an is_admin flag. Solution: overflow a 256-byte username buffer in BSS using scanf("%s") to overwrite the adjacent is_admin byte with a non-zero value.

$ ls tags/ techniques/
scanfglobal_variablesbss_overflowadmin_bypass
bss_section_overflowscanf_exploitationadjacent_variable_overwrite
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]