speedrun4 (rop_top)

spbctf

Task: static no-PIE x86-64 pwn (DEF CON Quals 2019 speedrun004) with a 1-byte overflow that only overwrites the LSB of the saved RBP. Solution: partial saved-RBP overwrite drives a double leave;ret stack pivot into a ret-sled + open/read/write ret2syscall ROP chain, brute-forcing the pivot LSB across reconnects and reading /flag from remote fd 5.