The Emptiness Machine

CACTF2026

Task: 64-bit PIE ELF (glibc 2.39, Full RELRO + CET) whose scanf("%s") writes user bytes directly into the libc _IO_2_1_stdout_ and _IO_2_1_stderr_ FILE structs. Solution: leakless double-stage FSOP — a partial _IO_write_base overwrite makes a printf flush leak libc, then a House of Apple 2 forge on stderr drives _IO_wfile_overflow into system("0;sh;#") on exit.