pwnProhard
Military System
tamuctf
Task: ARM64 binary with UAF in close_channel (pointer not zeroed after free). Solution: Leak heap/PIE via stale metadata, tcache poisoning with safe-linking bypass to overwrite global auth, read flag.
$ ls tags/ techniques/
arbitrary_writesafe_linking_bypassuaf_tcache_poisoningstale_pointer_leakauth_bypass
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [pwn][Pro]pwn9_mc4 — Mic Check: leak and pwn!— spbctf
- [pwn][free]Portaloo— hackthebox
- [pwn][Pro]Easy ROP— hackerlab
- [pwn][Pro]pwn9_mc5 — Mic Check: leak and pwn 2!— spbctf
- [pwn][free]Void— hackthebox