Writeups

Signed-length bug on glibc 2.39 turns into a heap primitive. Safe-linking leak, unsorted-bin libc leak, tcache poisoning through an XOR cipher, and a forged exit handler chain.

Stored XSS → localhost admin → heap underflow in a native canvas manager → libc leak → arbitrary R/W → libc ROP → flag. A full web-to-pwn chain.

7 (87% liked) 1 Go back in time maybe a decade or so, And play Geoguessr from a world you may or may not know.

category: reversing (with a light pwn twist)

Return oriented programming is one of the paradigms of all time. The garbled output is `94 7 d4 64 7 54 63 24 ad 98 45 72 35`

Binary: abnormaleak (ELF 64-bit, x86-64, dynamically linked, not stripped)

Binary: abnormaleak (ELF 64-bit, x86-64, dynamically linked, not stripped)

---

- **Category:** Pwn / Binary Exploitation - **Difficulty:** Medium - **Binary:** `imperial_archive` (ELF 32-bit, i386, dynamically linked, not stripped) - **Protections:** NX, Part

**Flag:** `HTB{Tim1ng_z@_h0ll0w_t3ll5}`

**Challenge:** A Micromachine — read-only device/OTP/flag combined challenge (web / queuer helper). **Target:** get `/app/public/playlist.txt` to contain `/flag/flag.txt` content.

Goal: recover the correct flag string.

**Name:** rev200-1.apk **Category:** Reverse Engineering **Platform:** Android (Kotlin / Java)

`Echo` is a small remote pwn challenge:

The exploit is the same core idea as `stack-bof`: the useful bug is not the final `gets()` alone, but the pair:

- Name: `Very Simple FSB` - Category: `pwn` - Remote: `35.194.108.145:13840`

The bug is not the final `gets()` by itself. The real primitive is:

I made a simple note app protected by a secure gateway.

* **Category:** Reverse Engineering / Cryptography * **Target Binary:** `listviewer` (Linux ELF, GTK GUI) * **Extra File:** `dump.pcapng` (Captured network traffic) * **Goal:** Rec

**Flag:** `bctf{Nev3r_underst00d_why_we_n33d_TSX_and_TXS_unt1l_n0w..:D}`

Source first:

The bug is a use-after-free in the Forth dictionary.

AES-256-CBC with the key produced by embedded shellcode. Break on EVP_EncryptInit_ex at runtime, read the key/IV out of registers, decrypt offline.

ret2win with a stack-alignment twist — hop through a single ret gadget before calling win() so system() sees a 16-byte-aligned stack.

32-bit ret2dlresolve — Partial RELRO, NX on, no libc leak, only read@plt. Force the linker to resolve system("/bin/sh").

Two-stage SROP without libc. pop rax; ret + syscall are enough. First frame does read + stack pivot, second frame executes execve("/bin/sh").

Stack overflow into ret2dlresolve — force the dynamic linker to resolve system at runtime and run system("sh").

Android APK that applies a position-dependent substitution over letters/digits/specials. Invert it in Python.

Stripped Nim binary that XORs input with a keystream derived from a hard seed. Extract the keystream at runtime with gdb and XOR out the flag.