4 min read
Suninatas Wargame Writeup
A collection of Suninatas wargame writeups covering Forensics 14, 15, 18, and Simple Login.
Read full articleTags
writeup
1 min read
Kongju National University Gifted Center pwnable2 Writeup
Kongju National University Gifted Center pwnable2 challenge — patching a Sleep NOP to print the flag instantly.
Read full article1 min read
CSAW 2013 Exploitation 2 — Point 200
Solving CSAW 2013 Exploitation 2 (200 points) by sending a buffer and a secret, then overwriting RET with a buffer overflow.
Read full article1 min read
alert(1) to win
Walkthrough of the "alert(1) to win" XSS challenge.
Read full article5 min read
RITSEC 2021: baby WASM
A writeup for RITSEC CTF 2021's baby WASM challenge, covering WebAssembly bytecode reversing, the WASM memory model, and flag extraction.
Read full article3 min read
SUA CTF 2019 Writeup
Writeups for SUA CTF 2019 challenges in the pwn and reversing categories.
Read full article11 min read
HackCTF Pwn Challenges Writeup
Writeups for HackCTF's pwn category: basic BOF, format string bugs, heap exploitation (tcache), RTL chaining, and x64 buffer overflow.
Read full article5 min read
Reversing.kr: Easy Series Writeups
Writeups for Reversing.kr's Easy series -- Easy CrackMe, Easy ELF, Easy Keygen, Easy Unpack, and Replace -- solved through static and dynamic analysis.
Read full article7 min read
Lord of Buffer Overflow (LOB) Wargame: Gate -> Iron_golem -> Dark_eyes
Progressing through the LOB (Lord of Buffer Overflow) wargame: Gate (basic BOF), Iron_golem (partial RELRO bypass), Dark_eyes (NX + ASLR) — tracing the evolution of Linux exploitation techniques.
Read full article14 min read
Pwnable.kr — leg, passcode, horcruxes Writeup
Solving pwnable.kr challenges: ARM PC computation quirks (leg), a GOT overwrite via scanf (passcode), and building a ROP chain (horcruxes).
Read full article4 min read
ROP Emporium: ret2win and callme
Writeups for the ROP Emporium ret2win (basic ROP control-flow hijacking) and callme (chained function calls with specific arguments) challenges.
Read full article3 min read
Pwnable.tw: Start
A shellcode injection writeup for Pwnable.tw's Start challenge, exploiting a stack-based buffer overflow in a minimal 32-bit Linux binary with no NX protection.
Read full article9 min read
Protostar Wargame Writeup
Solving the Protostar wargame: stack buffer overflows, format string bugs, heap exploitation, and a network challenge.
Read full article4 min read
exploit.me: Vulnerable Service Exploitation
Solving exploit.me's vulnerable service: stack buffer overflows, return address overwrites, shellcode injection, and ROP techniques on x86 Linux.
Read full article5 min read
picoCTF 2018: Pwn and Assembly Challenges
Solutions to picoCTF 2018 pwn and assembly challenges: a buffer overflow series, x86 assembly puzzles, and shellcode execution.
Read full article5 min read
DEF CON 23 CTF Qualifier: babycmd
Solving DEF CON 23's babycmd: command injection via blacklist bypass on a 64-bit Linux binary, with a shell-escape technique.
Read full article5 min read
DEF CON 22 CTF Qualifier: r0pbaby
Solving DEF CON 22 CTF Qualifier's r0pbaby: leaking the shared library base, finding gadgets via PLT/GOT, and building a 64-bit ROP chain to call system().
Read full article7 min read
Plaid CTF 2013 — ropasaurusrex Writeup
A classic Plaid CTF 2013 challenge: a ret2libc / ROP chain exploit against a 32-bit Linux binary.
Read full article