Pwn

Utilizing an out-of-bound write to leak Libc and gain rbp/rip control and get shell using one_gadget

Utilizing Out-of-bounds write to overwrite an adjacent memory chunk to bypass login and using Format String Vulnerability to overwrite a check and overwrite return address on the stack to perform ROP.

Creating pwn challenges for different OS/arch from scratch, and deploying it remotely using Docker.

Overflowing a buffer in a pointer which overwrites the pointer, giving us an arbitrary read, then utilizing pointer dereferencing to leak libc value from GOT and performing a simple ret2libc.

Given a libc leak, perform a ret2libc on ARM64.

Bypassing Seccomp rules and instructions check to read the flag file. No mov, no syscall/int 0x80, sysenter allowed.

Overwriting Master Canary in the TLS by overflowing a buffer stored in the Thread Stack in a threaded function.

Using printf to first leak libc/pie, then overwriting a global variable which gives us a write primitive which is suspecitble to buffer overflow, then simple rop.

Utilizing SROP to write to a buffer and then using read syscall to write 0xF into rax to call rt_sigreturn

Utilizing an Off-by-One error to overwrite the null-byte of string and keep printing the stack content until a nullbyte.

Utilizing unsorted bin to get a libc arena leak and calling system with user-controlled heap-chunk's data.

A detailed guide on how printf's can be used for arbitrary read and arbitrary write.

Utilizing Heap Use-After-Free to load the flag into user-controlled chunk and read it.

Utilizing Format String Vulnerability to leak the address of PIE and then a simple Ret2Win with args.

Exploiting an integer overflow to overwrite got entries, get leaks with printf and then overwriting the GOT entry of `free` with `system` to get a shell.

Sending a shebang to let fexecve execute a command for us and get the flag.

Crafting a custom ELF binary in assembly to execute /bin/sh and inject that inside the file descriptor using memfd_create and fexecve.

Exploiting srand(time(NULL)) to match the generated canary and then overflowing a buffer by generating another random number.

A classic x64 stack overflow.

Given the leaked address of main function, calculating offset and then overwriting the return address to the win function.

A simple x64 ret2win challenge.

Overwriting variable to get the flag.