pwnPromedium

Maze

spbctf

Task: collect 10 treasures in a maze game to get the flag. Solution: exploit a missing bounds check (no x >= 0 validation) in the movement function to move left into negative x territory, stepping on treasure characters (X) placed in the name buffer located before the maze array in memory.

$ ls tags/ techniques/
negative_indexarray_oobbounds_checkgame_exploitation
negative_array_indexout_of_bounds_memory_accessgame_logic_exploitation
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups