Confuse me!

spbctf

Task: menu-driven x86-64 action manager (create/remove/execute) over a global 32x256-byte slot array where byte[0] is a type tag; a string action's read loop writes exactly 256 bytes, so the 256th byte overflows the adjacent slot's type byte. Solution: place NUL on the next slot's type tag to flip it to the hidden type 0, whose execute path calls system(slot+1) — set the neighbor to \"/bin/sh\" first and get a shell.