inspector the ONE

pwn_spbctf

Task: 64-bit NON-PIE ELF with an unbounded scanf(\"%s\") stack overflow; startup dumps /proc/$PPID/maps leaking the libc base, ASLR is off. Solution: ret2libc, but call execve(\"/bin/sh\",0,0) instead of system() because system's absolute address contains a 0x20 (space) byte that terminates scanf %s — pick gadget/string addresses with no whitespace bytes.