pwnProeasy

Admin

spbctf

Task: gain admin access in a binary that checks an is_admin flag. Solution: overflow a 256-byte username buffer in BSS using scanf("%s") to overwrite the adjacent is_admin byte with a non-zero value.

$ ls tags/ techniques/
scanfglobal_variablesbss_overflowadmin_bypass
bss_section_overflowscanf_exploitationadjacent_variable_overwrite
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups