pwn5_rhook

pwn_spbctf

Task: NON-PIE x86-64 binary exposes an arbitrary read (write(1, addr, 8)), an 8-byte write-what-where (read(0, addr2, 8)), and a save_name routine that CALLs a global hook pointer with rdi = the name buffer; addresses are parsed with atoi (decimal). Solution: leak read@GOT to recover libc 2.31 base, overwrite the hook with system, then call save_name(\"/bin/sh\") so the hook fires as system(\"/bin/sh\").