https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/ Recent content in Miscellaneous on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/double-fried/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/double-fried/ A pcap leaks a flag one character per syslog packet in scrambled order, and sorting by each packet’s Message ID field reassembles the flag. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/paradise-nut/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/paradise-nut/ Abusing pnut-sh’s C-to-shell codegen, where a C local named REPLY aliases the tainted shell $REPLY from gets() and detonates command execution via bash arithmetic to run the setuid nl on /flag. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/volatile-component/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/volatile-component/ Exploiting a GitHub Actions workflow that interpolates an untrusted issue body into a run block, gaining RCE to dump the FLAG secret from the Runner.Worker process memory and exfiltrating it as hex to bypass log masking.