pwn6www / storage

pwn_spbctf

Task: NON-PIE x86-64 binary with a menu exposing an arbitrary read (printf %s at an attacker address) and an arbitrary 8-byte write-what-where, plus a controlled puts(buf) call. Solution: leak libc from an already-resolved GOT entry, overwrite puts@GOT with system, then trigger puts(\"/bin/sh\") = system(\"/bin/sh\") for a shell. Key pitfall: leaking an UNRESOLVED GOT slot (lazy binding) gives a wrong base.