Wishlist

spbctf

Task: Menu-driven wish list app with user registration, login, and GDPR account removal; flagholder user stores flag as a wish; Use-After-Free in GDPR remove (frees user struct but never NULLs LOGGED_IN_USER). Solution: Free user via GDPR, then add_wish reuses the freed 0x60 tcache chunk via strcpy, overwriting the level field to 0x13371337 (mega admin) to dump all users' wishes including the flag.