cknote

Author

ryhtbsh

Yeah… I know the source looks cursed.

nc chal3.fwectf.com 8012
Unlock Hint for 0 points

Calling setuid() a large number of times will allocate a large number of creds with little noise and they will be automatically freed. If you then call fork() a lot immediately afterwards, some of the child process's creds will be placed in pages allocated from the buddy allocator.
Place the note's page and the cred's page next to each other and overwrite the cred.

497

2