https://th3b0ywh0l1v3d.github.io/categories/pwning/ Recent content in Pwning on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/chicken-dinner/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/chicken-dinner/ Brute-force stack canary byte-by-byte via fork’s PID oracle, leak libc with puts, then ORW ROP chain. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/coming-together/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/coming-together/ Two’s complement INT_MIN negation overflow bypasses an absolute-value check to trigger the win condition. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/mania/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/mania/ Use-after-free on a tcache chunk to overwrite a function pointer and call win(). https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/new-to-the-format/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/new-to-the-format/ Blind format-string exploit with ASLR off: leak stack address then use %n + call rax to redirect execution. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/bandaids-help-me-heal/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/bandaids-help-me-heal/ A ‘pwn’ binary with no input is really a static-reversing puzzle: a fake usleep loop would take days and a fake integrity check always passes, so reading the constants and undoing a single-byte XOR yields the flag without ever waiting. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/password-vault/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/password-vault/ A password-manager heap challenge: free() without nulling the pointer gives a use-after-free, tcache hands the freed Login chunk back via set_password, and overwriting the struct’s leading function pointer redirects an indirect call to the leftover read_master_key win function. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/slot-machine/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/slot-machine/ A textbook ret2win: gets() into a 32-byte stack buffer with no canary and no PIE lets us overwrite the saved return address with jackpot(); the only twist is closing stdin to force the menu loop’s EOF break so the corrupted return fires. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/pwning/recipe-for-disaster/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/pwning/recipe-for-disaster/ A food-ordering binary reads chef notes with gets() into a buffer sitting in front of an int price field, letting an overflow set a negative price that makes the order total negative and prints /flag.