$ cat writeup.md…
$ cat writeup.md…
pwn_spbctf
Task: NON-PIE x86-64 'EnCoder' pwn that hides a stack buffer overflow behind a strlen length gate; the XOR-random encoding output and clock() timing are deliberate red herrings. Solution: bypass the strlen(buf)>0x10 check with a leading NUL byte (read() still copies the full 1024-byte payload), then ret2plt ROP an open/read/puts chain to dump /home/task/flag.txt — brute-forcing the file descriptor (open returns fd 5 under socat, not 3).
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar