Enigma * (one_gdgt)

pwn_spbctf

Task: NON-PIE x86-64 ELF that runs a 16-round 'enigma' loop, keeping a 16-entry function-pointer table on the stack while writing one output byte per round; the category 'one_gdgt' demands a one_gadget. Solution: the fn-table pointer marches +8 bytes/round while the output pointer marches +1, so on the 17th round the table index lands on the output buffer itself, giving an attacker-controlled `call rcx`; survive past the bounded loop by abusing scanf(\"%128s\")'s NUL terminator to reset the loop counter, fill output[0:8] with a glibc-2.31 one_gadget (0xcbde0, execve /bin/sh with rsi=rdx=0), and pop a shell.