https://th3b0ywh0l1v3d.github.io/tags/pwntools/ Recent content in Pwntools on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Tue, 09 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/flip-dat-bit/ Tue, 09 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/flip-dat-bit/ A TCP service hands you the AES-CBC ciphertext of your own input and asks you to return a ciphertext that decrypts to contain admin credentials — solved with a single-byte XOR flip. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/password-vault/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/password-vault/ A password-manager heap challenge: free() without nulling the pointer gives a use-after-free, tcache hands the freed Login chunk back via set_password, and overwriting the struct’s leading function pointer redirects an indirect call to the leftover read_master_key win function. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/slot-machine/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/pwning/slot-machine/ A textbook ret2win: gets() into a 32-byte stack buffer with no canary and no PIE lets us overwrite the saved return address with jackpot(); the only twist is closing stdin to force the menu loop’s EOF break so the corrupted return fires. https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/reversing/bit-miner/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/reversing/bit-miner/ An idle/clicker TCP game whose shop checks affordability against a stale cached balance but deducts from a fresh re-read; racing two sessions as the same user underflows an unsigned long to ~1.8e19 bits and buys the flag. https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/pwning/recipe-for-disaster/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/pwning/recipe-for-disaster/ A food-ordering binary reads chef notes with gets() into a buffer sitting in front of an int price field, letting an overflow set a negative price that makes the order total negative and prints /flag.