$ cat writeup.md…
$ cat writeup.md…
compfest2026
Task: a BE-MIPS PIE menu service exposed a 4-byte read oracle and a 60-byte canary-protected stack overflow. Solution: derive the PIE base from a leaked handler return, resolve libc system through MIPS linker metadata, and use a two-stage fake-GP ret2libc chain to spawn a shell.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar