ints (ret2libc 10)

pwn_spbctf

Task: NON-PIE x86-64 ELF with a menu loop that writes user qwords into a fixed-size stack array with NO bounds check (unbounded sequential stack write), plus a /proc/self/maps libc leak; an on-stack function pointer is invoked via call rdx. Solution: overwrite the called pointer with an 'add rsp,0x18; ret' stack-pivot gadget to realign and land in a planted execve(\"/bin/sh\",0,0) ROP chain, sidestepping the system() movaps alignment crash and the decoy exit command.