pwn7 heap_indexes

pwn_spbctf

Task: NON-PIE pwn where an unbounded scanf index drives storage[idx], an OOB pointer read, before memcmp(chosen, secret, 0x32) gates a /flag.txt print. Solution: point the OOB index at the heap chunk that stashes the secret pointer so chosen == secret_ptr, making memcmp(secret, secret) trivially equal — no knowledge of the random secret needed (idx = 52).