pwn5_exit

pwn_spbctf

Task: NON-PIE Partial-RELRO binary with a single-shot printf(buf) format-string bug and a tight 63-byte fgets limit, ending in exit(0). Solution: overwrite exit@GOT low-2-bytes to main (exit-to-main loop) for infinite fmt attempts, leak libc via %N$s of a planted GOT pointer, then convert printf@GOT->system with a single short %hn write and send /bin/sh.