#pwntools

category: reversing (with a light pwn twist)

---

**Flag:** `HTB{Tim1ng_z@_h0ll0w_t3ll5}`

`Echo` is a small remote pwn challenge:

32-bit ret2dlresolve — Partial RELRO, NX on, no libc leak, only read@plt. Force the linker to resolve system("/bin/sh").

Two-stage SROP without libc. pop rax; ret + syscall are enough. First frame does read + stack pivot, second frame executes execve("/bin/sh").

Stack overflow into ret2dlresolve — force the dynamic linker to resolve system at runtime and run system("sh").