$ cat writeup.md…
$ cat writeup.md…
spbctf
Task: PIE binary with UAF read on unsorted bin chunk and free() on a stack address with user-controlled fake chunk header. Solution: leak libc via unsorted bin fd pointer, forge fake tcache chunk on stack, malloc returns stack pointer, overflow saved RIP via fgets for ret2libc ROP.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar