$ cat writeup.md…
$ cat writeup.md…
spbctf
Task: menu-driven pwn with a custom circular doubly-linked list that implements its own unsafe unlink (no glibc free) plus a heap overflow in edit. Solution: overflow node A's data into node B's fd/bk pointers, then delete B so the classic unlink write-what-where sets the global is_admin flag, unlocking system(\"cat flag.txt\").
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar