Introduction to file struct exploitation: openECSC 2025 – pwn/exitnction

Exploiting file structs to execution using "_IO_wfile_seekoff" vtable