#pwntools
7 writeups
Overview
K17 CTF · 2025
category: reversing (with a light pwn twist)
#pwn #ghidra #pwntools
Midnight Relay - BITSCTF Pwn Writeup
BITS CTF · 2025
---
#pwn #rop #heap #crypto
SilentOracle (rev/pwn) — Timing Side-Channel (fail-slow) Attack
Neurogrid CTF · 2025
**Flag:** `HTB{Tim1ng_z@_h0ll0w_t3ll5}`
#rev #heap #pwntools
Echo
Srdnlenctf · 2025
`Echo` is a small remote pwn challenge:
#pwn #format-string #rop #pwntools
Feather Maker
V1T CTF · 2025 · Aug 10, 2025
32-bit ret2dlresolve — Partial RELRO, NX on, no libc leak, only read@plt. Force the linker to resolve system("/bin/sh").
#32-bit #ret2dlresolve #rop #pwntools
medium wakecall
V1T CTF · 2025 · Aug 10, 2025
Two-stage SROP without libc. pop rax; ret + syscall are enough. First frame does read + stack pivot, second frame executes execve("/bin/sh").
#srop #sigreturn #rop #pwntools
medium cascade
ImaginaryCTF 2025 · 2025 · Jul 5, 2025
Stack overflow into ret2dlresolve — force the dynamic linker to resolve system at runtime and run system("sh").
#stack-overflow #ret2dlresolve #rop #pwntools
medium