$ cat writeup.md…
$ cat writeup.md…
pwn_spbctf
Task: stripped NON-PIE x86-64 university state machine; an OOB grades[count]=grade write executes before the bound check and lands on the low byte of a format-string pointer used by a fixed-arg box printf. Solution: corrupt the format pointer to shift which directives run so %n targets a register-backed arg (rcx=code) set to the rector-flag address, abuse year==0 so %s(NULL) prints (null) instead of SIGSEGV, set the win global, then graduate to trigger system(\"cat flag.txt\").
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar