pwneasy

Cmd

spbctf

Task: get a shell from a binary that calls system() with a stack variable. Solution: overflow the username buffer (256 bytes) via read() with a 1024-byte limit to overwrite the adjacent cmd variable with "cat flag*", which is then passed to system().

$ ls tags/ techniques/
command_injectionshellstack_overflowsystem
command_string_overwritesystem_hijackstack_overflow
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]