pwn6 tw17_justdoit (just_do_it)

pwn_spbctf

Task: NON-PIE x86-64 pwn (TokyoWesterns 2017 just_do_it) that fgets 63 bytes into a 0x30 stack buffer (overflow) and reads /flag into a fixed global at 0x4040c1 but never prints it. Solution: overflow only reaches the message-pointer at [rbp-0x8] (offset 0x28); overwrite it with the flag-global address so the trailing puts([rbp-0x8]) prints the flag — no ROP needed.