$ cat writeup.md…
$ cat writeup.md…
spbctf
Task: Custom HTTP server (PIE, Full RELRO, glibc 2.27) with JSON parser has double-free in parse_json_kv — closing brace handler calls free() but doesn't break the loop. Solution: tcache double-free to alias request struct with content buffer, partial overwrite of function pointer to print_flag (no leak needed).
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar