$ cat writeup.md…
$ cat writeup.md…
pwn_spbctf
Task: 64-bit NON-PIE pwn with a 5-cell word storage; Store/Get take an unbounded signed array index leading to arbitrary write+read at data+index*8, and a startup maps dump leaks the libc base. Solution: leak libc from /proc/PPID/maps, plant /bin/sh in data[0], overwrite strcpy@GOT with libc system via a negative index, then trigger a Store to fire system(\"/bin/sh\").
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar