pwn4 getflag_no_zeroes

pwn_spbctf

Task: x86-64 non-PIE binary reads input with fgets, strcpy's it into an mmap RWX page, then calls it — shellcode must be both NUL-free (strcpy) and newline-free (fgets). Solution: 27-byte null/newline-free execve(/bin/sh) using the NEG trick to build the /bin/sh string, then `exec /bin/getflag` from the shell — getflag's 17-byte cmdline memcmp passes for free because the launcher is already `sh -c '/task 2>&1'`.