hello-goodbye

pwn_spbctf

Task: NON-PIE 64-bit ELF reads 0x80 bytes into a 0x30 stack buffer, overflowing an on-stack function pointer that is then called with rdi pointing at the buffer. Solution: overwrite the function pointer (offset 0x28) with system@plt and place \"/bin/sh\" at the start of the buffer, turning the indirect call into system(\"/bin/sh\") — no libc leak needed.