mib (ret2libc 10)

pwn_spbctf

Task: x86-64 PIE binary that reads 8 bytes from fd 1 (stdout) into rdx, then does `call rdx` with rdi=stdout, then `_exit(1)` after a buffered `fprintf(stdout, \"flag: %s\")`. Solution: over a raw socket (pwntools hangs on the fd-1 read), leak runtime libc system() from GOT, compute libc base via low-12-bit offset (system low12=0x410 -> 0x55410), and set rdx=libc_base+fflush_offset so `call rdx` flushes the buffered flag before _exit kills the process.