Night Shift: two prompts, one return address
A complete client and a local service. Leak a code pointer through a format string, then use it to build a ret2win payload.
Read the writeup →Notes on Linux, programming, and CTFs.
Pwn notes with local services and complete clients, from format strings to stack canaries and signed indexes.
A complete client and a local service. Leak a code pointer through a format string, then use it to build a ret2win payload.
Read the writeup →Leak the stack canary, preserve it in an overflow payload, and redirect the saved return address.
Read the writeup →Read and write metadata through a negative card index, then redirect a callback.
Read the writeup →A service prints a function pointer, then reads too much data into a stack buffer. Work out the PIE base and replace the return address.
Read the writeup →A format string gives away a stack pointer. The second prompt accepts an oversized note, so the leaked pointer becomes a return target.
Read the writeup →A note handle survives deletion. Reuse the slot, overwrite a callback pointer, and trigger the preview action.
Read the writeup →