pwnProeasy

Cmd

spbctf

Task: get a shell from a binary that calls system() with a stack variable. Solution: overflow the username buffer (256 bytes) via read() with a 1024-byte limit to overwrite the adjacent cmd variable with "cat flag*", which is then passed to system().

$ ls tags/ techniques/
command_injectionshellstack_overflowsystem
command_string_overwritesystem_hijackstack_overflow
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups