pwnmedium
Memorator3000
hackerlab
Task: a 64-bit menu-driven ELF exposes both a format string and a stack overflow, with save_password() reading 0x100 bytes into a 0x80-byte stack buffer. Solution: use the overflow in option 2 for a two-stage ret2libc attack, first leaking puts from the GOT and then calling system(\"/bin/sh\") to read /flag.
$ ls tags/ techniques/
stack_alignmentret2libcgot_leaktwo_stage_rop
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]