Tags: pwnable 

Rating:

Bug in bubble_sort gives control of saved ebp. Stack pivot to bss, send ROP chain.

Original writeup (https://amritabi0s.wordpress.com/2017/12/18/inctf-2017-sort-writeup/).