tag

Format-String

4 posts
pwn

Questionnaire

BOF+3

Questionnaire: use the format-string bug for a leak or write, then redirect execution to the flag path.

pwn

RaceCar

FormatString+1

RaceCar: use the format-string bug for a leak or write, then redirect execution to the flag path.

pwn

DearQA

TryHackMe+5

DearQA: shape the heap state, gain the needed write or leak, and pivot to flag access.