$ cat writeup.md…
$ cat writeup.md…
pwn_spbctf
Task: NON-PIE x86-64 ELF with a printf(buf) format-string leak followed by a second gets() stack overflow; ASLR is on. Solution: leak _IO_2_1_stdin_ via %3$p to recover libc base, then ret2libc with a single extra ret gadget for 16-byte movaps stack alignment under glibc 2.31.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar