pwn2_doublekill

pwn_spbctf

Task: 64-bit non-PIE pwn with a win() that prints /flag; play() leaks the stack buffer address, reads 0x30 bytes that overflow into an adjacent pointer variable, then writes 8 bytes through that pointer. Solution: use the first overflow to repoint the pointer at play()'s saved return address, then use the second write to overwrite it with win() — an indirect write-what-where ret2win with no canary.