pwn4_win

pwn_spbctf

Task: 64-bit PIE ELF with executable stack reads exactly 12 bytes onto the stack and calls them; a win() function reading /flag exists but its PIE address is unknown. Solution: write tiny shellcode that reads the saved return address already on the stack (base+0x12af), subtracts the constant PIE-invariant delta 0xea to compute win() (base+0x11c5), and jumps there without popping to keep rsp 16-byte aligned and avoid a movaps fault in fopen.