pwn5_rw

pwn_spbctf

Task: stripped NON-PIE/NX/no-canary binary with a stack buffer overflow whose read is capped at 64 bytes — too small for a full leak+ret2libc ROP chain in one shot. Solution: forward-pivot reads — set rbp into .bss and return to main's own read+leave epilogue, pivoting rsp into the freshly-read .bss buffer to stage a longer chain across multiple reads, then GOT-leak write@libc and ret2libc system('/bin/sh').