$ cat writeup.md…
$ cat writeup.md…
spbctf
Task: glibc 2.27 heap menu (add/remove) with double-free/UAF and a startup libc leak; remove() never nulls the pointer. Solution: double-free to poison the 0x20 tcache, overwrite __free_hook with system, free a chunk holding /bin/sh to get system(\"/bin/sh\") and a shell.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar