pwn4_local

pwn_spbctf

Task: x86-64 PIE shellcode challenge whose seccomp allowlist permits only socket/connect/read/write/close/exit_group, with the flag served by a loopback-only service on 127.0.0.1:31337. Solution: write a 103-byte connect-back relay shellcode that opens a TCP socket to 127.0.0.1:31337 and pipes the service output to stdout; the key pitfall is storing sin_port in network byte order (bytes 7A 69, not 69 7A).