Introduction “Tcache Tear” is a pwn challenge hosted by pwnable.tw. In particular, it is a heap challenge. First Considerations The challenge provided both the binary of the program to exploit and the library used remotely. First I patched the binary (using pwninit) to force the executable to also load the correct library locally. …

Introduction “Sick Rop” is a pwn challenge hosted by HackTheBox. First Considerations The first thing I did (as always), once I have downloaded the challenge, was to gather some general information about the binary: It is possible to notice that the program is a 64-bit executable, statically linked and not stripped. Moreover, no…

Introduction “Cache” is a pwn challenge deployed during the DefCamp CTF in 2022. First Considerations and Patch of the Binary The challenge provided both a binary file and the libc to use in order to exploit the challenge. …

Introduction “Guessing Game 1” is a pwn challenge of PicoCTF. First Considerations The first thing I did, in order to tackle the challenge, was to gather some general information about the binary provided by the challenge itself. Interestingly, the 64-bit executable is statically linked, this can only mean two things: The program does…

Introduction “Filtered Shellcode” is a pwn challenge of PicoCTF. First Considerations The first thing I did in order to tackle the challenge was to gather some general information about the binary provided by PicoCTF. It is possible to notice that the program is a 32-bit ELF executable that does not employ any relevant…

Introduction “Here’s a Libc” is a pwn challenge of PicoCTF. The challenge provides a binary file (the program to exploit), and the Libc used by the program remotely. Reverse Engineering The first thing I did was to get some general information about the binary file and the security measures employed by the program…

Cookies is an easy web challenge of PicoCTF. The main page of the web app consists in a simple search form. The first thing I tried was to submit the suggested word, and to submit another random word. The responses I received was pretty different:

Stocks is a very easy pwn challenge of PicoCTF. Instead of provide a binary file, like most of pwn challenges, Stocks provide directly the source code of the program to exploit remotely. #include <stdlib.h> #include <stdio.h> #include <string.h> #include <time.h> #define FLAG_BUFFER 128 #define MAX_SYM_LEN 4 typedef struct Stonks {…

Baby Nginxatsu is a web challenge of Hack The Box. When connecting to the given <IP address, Port> couple, a simple login form is presented: The first things I tried was to supply default credentials and to test the web application for SQL injection vulnerabilities, but nothing worked. Then, I…