Lab 5: Remote Multi-Stage Exploitation

• Target: a remote service on the isolated Badger CTF platform, running a vulnerable binary with NX and ASLR enabled.
• You are given the binary and the target's libc. Goal: retrieve flag.txt from the server.
• Required workflow:
• Find the bug and build a leak (Stage 1): call puts(GOT[...]) and read the address.
• Recompute libc_base from the leak using the provided libc.
• Return to a vulnerable point and send Stage 2: system("/bin/sh") or a GOT overwrite.
• cat flag.txt, submit the flag.
• Use pwninit to match the libc locally, then flip your script to remote().