$ cat writeup.md…
$ cat writeup.md…
pwn_spbctf
Task: NON-PIE, NX, no-canary x86-64 ALICE chat service with a stack buffer overflow (read 0x78 bytes into a 0x20 buffer, RET offset 0x28). Solution: two-stage ret2libc in one connection — leak puts via puts@got+return-to-main, then call system(\"/bin/sh\") with an extra ret for movaps alignment.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar