$ cat writeup.md…
$ cat writeup.md…
pwn_spbctf
Task: C++ heap binary (PIE, no canary) with two adjacent Student objects and an unbounded scanf(\"%s\") overflowing the first object into the second's vptr. Solution: leak PIE base from printf, overflow s1 into s2.vptr, point it at vtable+0x18 so virtual dispatch calls the existing Shell() win method (system(\"sh\")).
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar