Archive / CTF

CTF writeups

Pwn notes with local services and complete clients, from format strings to stack canaries and signed indexes.

Pwn · TCP · Complete exercise

Night Shift: two prompts, one return address

A complete client and a local service. Leak a code pointer through a format string, then use it to build a ret2win payload.

Pwn · Stack canary · Complete exercise

Leak the stack canary, preserve it in an overflow payload, and redirect the saved return address.

Pwn · Signed index · Complete exercise

Read and write metadata through a negative card index, then redirect a callback.

Pwn · Stack · Beginner

A service prints a function pointer, then reads too much data into a stack buffer. Work out the PIE base and replace the return address.

Pwn · Format string · Intermediate

A format string gives away a stack pointer. The second prompt accepts an oversized note, so the leaked pointer becomes a return target.

Pwn · Heap · Intermediate

A note handle survives deletion. Reuse the slot, overwrite a callback pointer, and trigger the preview action.