Navalny (ret2libc 10)

pwn_spbctf

Task: NON-PIE x86-64 ELF with NO RELRO; an unbounded gets() into a fixed .bss buffer sits just below the GOT, while a pthread watchdog runs `kill -9 $PPID` ~9.7s after start — before main reaches the winning second gets()->system() at ~12.2s. Solution: overflow the .bss buffer into the GOT, overwrite usleep@GOT with a binary `ret` gadget so main's 6s usleep returns instantly (defeating the kill-thread race), while rewriting all other clobbered GOT entries back to their leaked libc addresses, then buffer `cat /flag*` as the second line that system() executes.