pwn2_sequential

pwn_spbctf

Task: NON-PIE x86-64 ELF with a menu that dispatches echo/help/greet through on-stack function pointers, reached by an unbounded gets() overflow; a canary is present but irrelevant. Solution: overwrite the function pointers (which sit BELOW the canary and are invoked via `call` before any ret) to chain unused init()=fgets(CMD) and sys()=system(CMD) gadgets into arbitrary command execution and a shell.