$ cat writeup.md…
$ cat writeup.md…
pwn_spbctf
Task: NON-PIE C++ heap pwn where String::Modify performs an unbounded std::string operator[] single-byte write (arbitrary relative OOB write). Solution: overwrite an adjacent Number object's vptr with the unused Flag class's vtable+0x10 (fixed address, no leak), then trigger the virtual call so Flag::Display() runs system(\"cat flag.txt\").
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar