$ cat writeup.md…
$ cat writeup.md…
bluehensctf
Task: a note manager stores a callable function pointer inside each heap note object and exposes hidden menu actions. Solution: leak libc through a negative-index /proc/self/maps read, overwrite the note function pointer with system, and dispatch the note to execute a flag-reading command.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar