look at me (ASLR 10)

pwn_spbctf

Task: 64-bit PIE/NX ELF with a printf(user_input) format string but a filter that only allows the chars {%, p, .} — exactly the alphabet of a %p leak. Solution: leak stack with %p.%p..., fingerprint the libc (glibc 2.31 Ubuntu) by matching strtol/fgets/printf offsets, compute base, then submit hex(base+system_offset) to pass the value-equality check that prints /flag.