pwnmedium

TicTacToed

hackthebox

Task: a Rust game binary hid a second-stage C2 interface behind a specific 5x5 tic-tac-toe pattern and access code. Solution: re-download the latest archive, recover the correct embedded ELF offsets, leak PIE with the H option, then use a use-after-free to overwrite a callback with getSecret and print the real remote flag.

$ ls tags/ techniques/
pieuse_after_freefunction_pointertcachepwnrusthidden_interfacebinary_extraction
hidden_pattern_unlockpie_leak_via_function_pointeruse_after_free_callback_hijacktcache_reuse
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]