thj8 / pwn

learn pwn

Goal

learn pwn for fun, and pwn easy challenge only

Challenge

Event	Challenge	Status	WP	Remark
pragyan	execution	Solved	Click	ret2ROP
pragyan	story	Solved	Click	rand
VNCTF2022	clear_got	Solved	Click	write got, syscall
VNCTF2023	Traveler	Solved	Click	twice stack pivot, read more
VNCTF2023	store in tongxunlu	Solved	Click	syscall, strtol
Lactf	rut-roh-relro	Solved	Click	stack pivot, fmt
Lactf	rickroll	Solved	Click	A:ret2csu/B:fini_array, fmtstr
Lactf	bot	Solved	Click	ret2fun
Lactf	gatekeep	Solved	Click	Check in
MHSCtf-2023	Rescue Mission	Solved	Click	Integer Overflow
BBCtf	medium_pwn	Solved	Click	hex string bytes change
DiceCtf-2023	bop	Solved	Click	seccomp allow orw syscall
idek	Typop	Solved	Click	canary, pie, libc, system stack pivot
nu1l_junior	gotclear	Solved	Click	gottable, run put.plt, execve
nu1l_junior	ShellcodeMaster	Solved	Click	17 bytes shellcode, orw
nu1l_junior	StudentManager	Solved	Click	Integer Overflow, onegadget
西湖论剑	Message_Board	Solved	Click	stack pivot, orw rop
西湖论剑	babycalc	Solved	Click	ovrewrite one byte, stack pivot
BUUCTF	EasyHeap_zjctf_2019	Solved	Click	fastbin fake chunk
BUUCTF	children_tcache	Solved	Click	off-by-null, double free libc2.27
BUUCTF	babyheap_0ctf_2017	Solved	Click	chunk overlapping, malloc_hook-0x23
HGAME-week-3	note_context	Solved	Click	large_note + context, orw shellcode
HGAME-week-3	large_note	Solved	Click	libc2.32 largebin, bk_nextsize, p+0x20
HGAME-week-3	safe_note	Solved	Click	libc2.32 safe-linking
HGAME-week-1	choose_the_seat	Solved	Click	run binary again, leak libc, onegadget
HGAME-week-1	overflow	Solved	Click	overflow to backdoor
HGAME-week-1	orw	Solved	Click	prctl forbiden execve
HGAME-week-1	simple shellcode	Solved	Click	Read a shellcode and run it