sec_shell

spbctf

Task: 209-byte raw x86-64 Linux bind-shell shellcode with an 8-byte password gate before execve(/bin/sh). Solution: disassemble with capstone, reverse the ror-based per-byte XOR check into a position-independent constraint (K[j]^f(b[j])==T[j]), recover the password *7&d21k$, connect to the live backdoor on TCP 11538 and read the flag.