$ cat writeup.md…
$ cat writeup.md…
Hack.lu2026
Task: root service gives a one-bit XOR write to two arbitrary files at attacker-chosen offsets, then execve's socat system:echo. Solution: flip the 'c' of glibc do_system's "-c" to 's' to force sh -s (stdin shell over the socket), then flip pam_rootok je->jne so su authenticates non-root, and read /flag.txt as root.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar