pwnmedium
Tsar Admin
hackerlab
Task: a console admin login contains a one-byte overflow in the PIN input, and the archive includes a password generator seeded with time(NULL). Solution: flip a nearby flag with 133\\x01 to leak the seed, then reproduce Alpine 3.18.2 musl rand() to predict the correct temporary admin password.
$ ls tags/ techniques/
off_by_one_flag_flipseed_leak_exploitationmusl_rand_reimplementationpassword_prediction
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]