popa-ot-ropa (Mic Check 10)

pwn_spbctf

Task: NON-PIE x86-64 ELF that dumps /proc/$PPID/maps at startup (leaking libc base) then does an unbounded gets() into a stack buffer. Solution: classic ret2libc — parse libc base from the leaked maps, overflow at offset 0x48, and use the in-binary 'pop rax; mov rdi, rax; ret' gadget plus a leading ret for movaps alignment to call system('/bin/sh').