pwnProhard

GIF Splitter

undutmaning

Task: GIF splitting service with custom parser vulnerable to double-free via realloc(ptr, 0). Solution: Tcache poisoning to make FILENAMES[] point to /flag.txt, causing zip_source_file to read the flag.

$ ls tags/ techniques/
heap_exploitationtcache_poisoningdouble_freegif_parserreallocnginx_modulelibzip
tcache_poisoningheap_chunk_reusearbitrary_file_readrealloc_zero_free
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups