rbp2

pwn_spbctf

Task: 64-bit PIE+NX+canary ELF (no libc) that leaks adjacent stack via strlen/write over a non-NUL-terminated buffer and offers a 34-byte fgets overflow; goal is to read /flag using the binary's own open/read/write PLT. Solution: leak canary+PIE from the strlen echo, then RBP-pivot by returning into a re-entrant code path that re-runs the canary check with attacker-controlled rbp (fake canary in a .bss buffer) so its leave;ret pivots into an open/read/write ROP chain — accounting for fgets stdin leftover, the 255-char fgets rule, and open() returning fd=5.