pwn6boi

pwn_spbctf

Task: NON-PIE x86-64 binary with a stack canary reads 0x58 bytes into a 0x60 buffer, stopping exactly before the canary; a magic int gate (0xbaaaaaad) selects system(\"/bin/bash\") vs system(\"/bin/date\"). Solution: overwrite only the magic int (offset 0x44) with 0xc001d00d without touching the canary, spawning an interactive shell to cat flag.txt.