1 min read
Kongju National University Gifted Center pwnable2 Writeup
Kongju National University Gifted Center pwnable2 challenge — patching a Sleep NOP to print the flag instantly.
Read full articleTags
pwn
1 min read
CSAW 2013 Exploitation 2 — Point 200
Solving CSAW 2013 Exploitation 2 (200 points) by sending a buffer and a secret, then overwriting RET with a buffer overflow.
Read full article5 min read
Offensive Security Toolkit: Binary Exploitation & Firmware Analysis Reference
A practical reference for binary exploitation and firmware analysis work: extracting shellcode, finding libc /bin/sh addresses, pwn compilation flags, BinDiff installation, fixing binwalk/sasquatch errors, and AFL crash triage.
Read full article15 min read
ARM Exploitation Series: From Hand-Ray to ret2zp
A step-by-step walkthrough of ARM binary exploitation: reading ARM assembly by hand (hand-ray), stack buffer overflows, ROP gadget chaining, and the ret2zp (return-to-zero-page) technique
Read full article10 min read
Doing ROP on AArch64: CTF Style
A hands-on look at the AArch64 calling convention, Link Register control, and ROP chain construction for CTF-style exploitation
Read full article12 min read
AArch64 Binary Exploitation: easy_linux_pwn
A hands-on ARM64 exploitation walkthrough covering the AArch64 calling convention, stack layout differences from x86-64, and ROP chain construction
Read full article3 min read
SUA CTF 2019 Writeup
Writeups for SUA CTF 2019 challenges in the pwn and reversing categories.
Read full article11 min read
HackCTF Pwn Challenges Writeup
Writeups for HackCTF's pwn category: basic BOF, format string bugs, heap exploitation (tcache), RTL chaining, and x64 buffer overflow.
Read full article7 min read
Lord of Buffer Overflow (LOB) Wargame: Gate -> Iron_golem -> Dark_eyes
Progressing through the LOB (Lord of Buffer Overflow) wargame: Gate (basic BOF), Iron_golem (partial RELRO bypass), Dark_eyes (NX + ASLR) — tracing the evolution of Linux exploitation techniques.
Read full article14 min read
Pwnable.kr — leg, passcode, horcruxes Writeup
Solving pwnable.kr challenges: ARM PC computation quirks (leg), a GOT overwrite via scanf (passcode), and building a ROP chain (horcruxes).
Read full article4 min read
ROP Emporium: ret2win and callme
Writeups for the ROP Emporium ret2win (basic ROP control-flow hijacking) and callme (chained function calls with specific arguments) challenges.
Read full article3 min read
Pwnable.tw: Start
A shellcode injection writeup for Pwnable.tw's Start challenge, exploiting a stack-based buffer overflow in a minimal 32-bit Linux binary with no NX protection.
Read full article9 min read
Protostar Wargame Writeup
Solving the Protostar wargame: stack buffer overflows, format string bugs, heap exploitation, and a network challenge.
Read full article4 min read
exploit.me: Vulnerable Service Exploitation
Solving exploit.me's vulnerable service: stack buffer overflows, return address overwrites, shellcode injection, and ROP techniques on x86 Linux.
Read full article5 min read
picoCTF 2018: Pwn and Assembly Challenges
Solutions to picoCTF 2018 pwn and assembly challenges: a buffer overflow series, x86 assembly puzzles, and shellcode execution.
Read full article5 min read
DEF CON 23 CTF Qualifier: babycmd
Solving DEF CON 23's babycmd: command injection via blacklist bypass on a 64-bit Linux binary, with a shell-escape technique.
Read full article5 min read
DEF CON 22 CTF Qualifier: r0pbaby
Solving DEF CON 22 CTF Qualifier's r0pbaby: leaking the shared library base, finding gadgets via PLT/GOT, and building a 64-bit ROP chain to call system().
Read full article7 min read
Plaid CTF 2013 — ropasaurusrex Writeup
A classic Plaid CTF 2013 challenge: a ret2libc / ROP chain exploit against a 32-bit Linux binary.
Read full article