pwn5 intruder_2

pwn_spbctf

Task: NON-PIE x86-64 reservation service with a signed upper-bound-only array index check (cmp idx,0xff; jg) allowing a negative index OOB 8-byte write relative to a global array. Solution: use idx=-9 to overwrite strcmp@GOT with system@plt (already resolved via a startup system(\"cal\")); the next loop's strcmp(cmd, \"order\\n\") then runs system(cmd) with rdi = the user buffer, giving a shell via cmd=\"/bin/sh\".