rabbit_1 (rabbit in forest)

pwn_spbctf

Task: x86-64 PIE C++ shellcoding challenge that reads your shellcode into an mmap'd RW page, makes it RX and jumps to it; the flag is pre-loaded by a getFlag helper into one of 100 mmap'd singly-linked-list nodes. Solution: recover the list head from the parent frame ([rbp-8], unchanged because `call rax` does not touch rbp), walk node[0]=prev pointers, and write(1, node+8, 0x20) for the node whose 32-byte data starts with \"SPBCTF\". 88-byte newline-free shellcode assembled with keystone.