Calamity exploit ( stack pivot + setuid(0) + execv("/bin/sh",NULL)

Tutorials Writeups
, ,
4

Great job, didn’t think to do a full ROP chain, very clever solution! Nice use of pwntools too!

As for system I think c++11 - c++ system() raises ENOMEM - Stack Overflow may be to blame? I can’t say for sure though, I also ran into issues with it