pivot (pevot)

pwn_spbctf

Task: 64-bit statically-linked NON-PIE pwn binary with a heap overflow that overwrites a function pointer stored at chunk+0x200, which is then invoked via `call r8` while RCX holds the heap-buffer base. Solution: overwrite the pointer with a `mov rsp, rcx ; ret` pivot to relocate the stack into the controlled heap buffer, then run a leak-free static execve(\"/bin/sh\") ROP chain using glibc-embedded gadgets.