pwnProeasy
Temporal
bluehensctf
Task: a note manager stores a callable function pointer inside each heap note object and exposes hidden menu actions. Solution: leak libc through a negative-index /proc/self/maps read, overwrite the note function pointer with system, and dispatch the note to execute a flag-reading command.
$ ls tags/ techniques/
function_pointer_hijackproc_maps_libc_leaksystem_command_execution
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [pwn][Pro]iz_heap_lv1 — BSS-pointer overlap + tcache poisoning— spbctf
- [pwn][Pro]Taste— grodno_new_year_2026
- [pwn][Pro]pwn9_mc5 — Mic Check: leak and pwn 2!— spbctf
- [pwn][Pro]Easy ROP— hackerlab
- [pwn][free]Void— hackthebox