pwn6xkcd

pwn_spbctf

Task: statically-linked x86-64 NX/no-PIE binary simulating the xkcd#1354 Heartbleed bug — a strtok request grammar lets you write a WORD into a reply buffer and echo `len` bytes of it. Solution: fill the reply buffer with 304 'A's right up to the adjacent flag global, then request 342 LETTERS so puts() over-reads past the written data into the flag memory and echoes it.