| Function | Purpose | |----------|---------| | leak_libc | Uses the format‑string to leak a libc address and compute the base. | | write_free_hook | Crafts a two‑write %hn payload that stores system at __free_hook . | | get_shell | Uploads a chunk containing /bin/sh and then frees it, invoking system . | | main | Orchestrates the steps and drops
The final crafted string (Python example): SONE-127 2021
target = free_hook low = target & 0xffff high = (target >> 16) & 0xffff | Function | Purpose | |----------|---------| | leak_libc