They

hackerlab

Task: 64-bit login service split between a main ELF and `libanswer.so`; after valid credentials, `answer_f()` reads 145 bytes into a 32-byte stack buffer. Solution: use a short ROP chain in the non-PIE main binary to set the gate byte to 1, rewrite `ls` to `sh`, and fall back into the built-in `jmp()` path to execute `system(\"sh\")`.