pwneasy

Chains

hackerlab

Task: a stripped non-PIE ELF64 maze game asks for a name, but the real bug is an early stack overflow before the maze matters. Solution: leak __libc_start_main with write@plt, identify musl from the remote leak, read 'cat flag.txt' into .bss, and call system() with a second-stage ROP chain.

$ ls tags/ techniques/
stack_overflowx86_64ret2libcropno_piepartial_relrono_canarynxstripped_binarygot_leakmusl
remote_libc_fingerprintingtwo_stage_ret2libcgot_address_leakbss_command_staging
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]