Perm

pwn_spbctf

Task: NON-PIE x86-64 fake UNIX mainframe login that parses /etc/passwd+/etc/shadow into a malloc'd user linked list; an unbounded gets() into a 0x1000 global sits immediately before the global list-head pointer USER_FIRST. Solution: overflow input to overwrite USER_FIRST with a pointer to a fully forged 21-node user list built inside the same global (no leak needed, NON-PIE), reproducing the exact node count to defeat the integrity check and using a self-chosen MD5-crypt hash to authenticate as uid 51337 (flagholder), reaching setresuid()+/bin/bash to read /flag.txt.