ryhtbsh
Yeah… I know the source looks cursed.
nc chal3.fwectf.com 8012
Unlock Hint for 0 points
-
Calling setuid() a large number of times will allocate a large number of creds with little noise and they will be automatically freed. If you then call fork() a lot immediately afterwards, some of the child process's creds will be placed in pages allocated from the buddy allocator.
-
Place the note's page and the cred's page next to each other and overwrite the cred.
cknote.zip
497
2
- See
writeup/