Pwntools

A TCP service hands you the AES-CBC ciphertext of your own input and asks you to return a ciphertext that decrypts to contain admin credentials — solved with a single-byte XOR flip.

A password-manager heap challenge: free() without nulling the pointer gives a use-after-free, tcache hands the freed Login chunk back via set_password, and overwriting the struct’s leading function pointer redirects an indirect call to the leftover read_master_key win function.

A textbook ret2win: gets() into a 32-byte stack buffer with no canary and no PIE lets us overwrite the saved return address with jackpot(); the only twist is closing stdin to force the menu loop’s EOF break so the corrupted return fires.

An idle/clicker TCP game whose shop checks affordability against a stale cached balance but deducts from a fresh re-read; racing two sessions as the same user underflows an unsigned long to ~1.8e19 bits and buys the flag.

A food-ordering binary reads chef notes with gets() into a buffer sitting in front of an int price field, letting an overflow set a negative price that makes the order total negative and prints /flag.