Overflowing a bot browser cookie jar to evict an HttpOnly role cookie that JavaScript could not overwrite, then writing the privileged value in its place
Chaining an arbitrary file write, a Sage/PPL segfault, and cysignals unsafe gdb auto-load into a CAP_SYS_PTRACE read of a setgid-only flag
Writeup for the HashCashSlash challenge from 0xL4ugh CTF V5. A Medium Misc challenge involving restricted shell escape and local privilege escalation via hidden socat service.
