pwn7_heap0

pwn_spbctf

Task: intro heap challenge — two adjacent malloc chunks where the second holds a function pointer that is later called; an unbounded gets() into the first chunk overflows into the second chunk's fnptr. Solution: parse the leaked buf1/buf2/main addresses, compute exact pad = buf2 - buf1 (0x50) and PIE base = main_leak - 0x11bb, overwrite the fnptr with winner (system(\"cat flag.txt\")) and trigger the call.