pwnhard

GIF Splitter

undutmaning

Task: GIF splitting service with custom parser vulnerable to double-free via realloc(ptr, 0). Solution: Tcache poisoning to make FILENAMES[] point to /flag.txt, causing zip_source_file to read the flag.

$ ls tags/ techniques/
heap_exploitationtcache_poisoningdouble_freegif_parserreallocnginx_modulelibzip
tcache_poisoningheap_chunk_reusearbitrary_file_readrealloc_zero_free
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]