https://th3b0ywh0l1v3d.github.io/tags/misc/ Recent content in Misc on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/card-trick/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/card-trick/ A trivia/OSINT puzzle: identify Valve’s unreleased game Deadlock and the hero Wraith, then read the shipped ability data (Card Trick) from the community API to get the suit order, max-level stat modifiers, and card-charge count for the flag. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/lost-my-flag-printer/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/lost-my-flag-printer/ A setuid helper pins an eBPF flag-printer into a world-accessible PROG_ARRAY then chmod 000s the program pin; loading an unprivileged socket-filter that bpf_tail_calls index 0 runs the root-loaded printer and fills the readable flag map. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/someone-said-steg/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/someone-said-steg/ A 16-frame APNG hides one flag character per frame in the top-left pixel of each frame’s decompressed scanline data; every standard stego avenue is a dead end, so decompressing all 16 fdAT/IDAT streams and reading byte 4 of each yields the flag. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/double-fried/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/double-fried/ A pcap leaks a flag one character per syslog packet in scrambled order, and sorting by each packet’s Message ID field reassembles the flag. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/paradise-nut/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/paradise-nut/ Abusing pnut-sh’s C-to-shell codegen, where a C local named REPLY aliases the tainted shell $REPLY from gets() and detonates command execution via bash arithmetic to run the setuid nl on /flag. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/volatile-component/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/volatile-component/ Exploiting a GitHub Actions workflow that interpolates an untrusted issue body into a run block, gaining RCE to dump the FLAG secret from the Runner.Worker process memory and exfiltrating it as hex to bypass log masking.