Confusion Hell

spbctf

Task: pwn with an integer/pointer type-confusion heap allocator (No PIE, Partial RELRO, libc-2.31); number and str boxes share an 8-byte slot with no runtime type check, giving arbitrary read/write. Solution: leak libc via printf(%s) on a GOT entry, bump COUNT to make a BSS-zero OBJECTS slot indexable, forge it into strdup@got, overwrite strdup with system using an arithmetic write (bypassing the scanf 0x20/NUL wall), then trigger strdup(\"/bin/sh\")=system(\"/bin/sh\").