$ cat writeup.md…
$ cat writeup.md…
broncoctf2026
Task: remote-only pwn with no binary/source; a fixed-size stack buffer sits next to a zero-initialized 'gate' variable guarding the flag. Solution: black-box length fuzzing found the buffer is 76 bytes, so sending 77 'A's overflows into the adjacent gate variable, opening it and printing the flag.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar