word storage

pwn_spbctf

Task: 64-bit NON-PIE pwn with a 5-cell word storage; Store/Get take an unbounded signed array index leading to arbitrary write+read at data+index*8, and a startup maps dump leaks the libc base. Solution: leak libc from /proc/PPID/maps, plant /bin/sh in data[0], overwrite strcpy@GOT with libc system via a negative index, then trigger a Store to fire system(\"/bin/sh\").