UAF Fun House

spbctf

Task: C++ menu-driven data manager with Array/Flag classes using virtual functions; remove_element() frees object but leaves dangling pointer in global array (UAF). Solution: free Array, reallocate same-size double[] buffer over freed chunk, overwrite vptr with Flag vtable pointer encoded as IEEE-754 double, trigger virtual dispatch to Flag::Display which calls system(\"cat flag.txt\").