pwnProeasy

cat /flag under seccomp

spbctf

Task: shellcode runner with a libseccomp allow-list limited to read/write/open/close/exit_group that calls the stack buffer directly. Solution: 71-byte hand-assembled shellcode that does open('/flag') -> read -> write(stdout) -> exit_group, all inside the allow list.

$ ls tags/ techniques/
seccompopen_read_writeamd64shellcodinglibseccomp
stack_string_buildallow_list_seccomp_bypassdirect_syscall_chain
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups