HouseofHusk

ImaginaryCTF Argv Pwn Writeup

• zerofrost
• Pwn

This post covers a pwn challenge from the ImaginaryCTF discord where a buffer overflow in gets is converted into a format string vulnerability by overwriting the argv[0] pointer on the stack. We walk through leaking libc and stack addresses, then explore two methods to get a shell.