Lost My Flag Printer — DalCTF 2026

A setuid helper pins an eBPF flag-printer into a world-accessible PROG_ARRAY then chmod 000s the program pin; loading an unprivileged socket-filter that bpf_tail_calls index 0 runs the root-loaded printer and fills the readable flag map.

June 7, 2026 · 10 min · 2061 words · Th3B0yWh0L1v3d