All Posts

Overwriting Master Canary in the TLS by overflowing a buffer stored in the Thread Stack in a threaded function.

Using printf to first leak libc/pie, then overwriting a global variable which gives us a write primitive which is suspecitble to buffer overflow, then simple rop.

Utilizing SROP to write to a buffer and then using read syscall to write 0xF into rax to call rt_sigreturn

Utilizing an Off-by-One error to overwrite the null-byte of string and keep printing the stack content until a nullbyte.

Extracting a Word Macro, extracting an embedded hta/js code and finally extracting another powershell code that contains the flag.