pwnmedium
По секрету всему свету
hackerlab
Task: WinRAR SFX containing a stripped ELF64 ncurses note-taking app with fake 'NOP encryption' (plaintext storage); read_note() has a buffer overflow where password[79] overwrites an adjacent flag variable. Solution: send 80-char payload ending with '}' to trigger system('cat ' + password), inject shell commands via semicolons to search the filesystem for the flag.
$ ls tags/ techniques/
command_injectionreverse_engineeringbuffer_overflowx86_64stripped_binarysystem_callncursessfx_archivenop_encryption
stack_variable_overwritesfx_archive_unpackingghidra_decompilationshell_metacharacter_injection_via_systemncurses_protocol_over_tcp
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]