Spidersaurus Rex

pwn x86/x64 browser FCSC 2026 solved on

star star

Description

Despite a memory access problem (see the Spidersaurus challenge), our developer insists on using this ancient version of SpiderMonkey.

He keeps assuring us there are no exploitable security flaws. However, an anonymous hacker sent us this mysterious message: “what happens if a function contains 65536 variables?”. Show our developer wrong by reading the contents of flag.txt.

  1. After sending your JavaScript code, use shutdown(socket, SHUT_WR) to trigger its execution, and then read the potential response.
  2. A JavaScript string can contain arbitrary binary content, for instance \u9090\u9090.
  3. The memory allocation pattern will differ if the JavaScript code is provided as a file with the first argument, instead of using stdin.

Files

Author

cde

Challenge Instructions

  1. First, download docker-compose.yml:
    curl https://hackropole.fr/challenges/fcsc2026-pwn-spidersaurus-rex/docker-compose.public.yml -o docker-compose.yml
  2. Launch the challenge by executing in the same folder:
    docker compose up
  3. Then, in another console, access the challenge with Netcat:
    nc localhost 4000
⚠️ Important: You must solve the challenge by interacting with the Docker container through the exposed network port. Any other way is not considered valid.

In case you encounter problems, please consult the FAQ.

Flag

Share my success on Fediverse, Twitter, Linkedin, Facebook, or via email.

Submit your solution

You can submit your writeup for this challenge. Read the FAQ to learn how to proceed.

You need to be logged in to submit a writeup.

Writeups

There are no public solutions for this challenge yet, but you can submit yours after getting the flag.