Mic Check (Datas) — pwn7_mc5

pwn_spbctf

Task: NON-PIE C++ heap pwn where String::Modify performs an unbounded std::string operator[] single-byte write (arbitrary relative OOB write). Solution: overwrite an adjacent Number object's vptr with the unused Flag class's vtable+0x10 (fixed address, no leak), then trigger the virtual call so Flag::Display() runs system(\"cat flag.txt\").