pwnmedium

По секрету всему свету

hackerlab

Task: WinRAR SFX containing a stripped ELF64 ncurses note-taking app with fake 'NOP encryption' (plaintext storage); read_note() has a buffer overflow where password[79] overwrites an adjacent flag variable. Solution: send 80-char payload ending with '}' to trigger system('cat ' + password), inject shell commands via semicolons to search the filesystem for the flag.

$ ls tags/ techniques/
stack_variable_overwritesfx_archive_unpackingghidra_decompilationshell_metacharacter_injection_via_systemncurses_protocol_over_tcp

🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]