$ cat writeup.md…
$ cat writeup.md…
spbctf
Task: heap challenge with heap/libc leaks, a large attacker-controlled buffer, and an arbitrary free() primitive on glibc 2.31. Solution: forge a fake 0x50 tcache chunk inside the large buffer overlapping the adjacent freed chunk's fd pointer, tcache-poison fd to __free_hook, overwrite with system, trigger via free(\"/bin/sh\").
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar