learn pwn for fun, and pwn easy challenge only
Event | Challenge | Status | WP | Remark |
---|---|---|---|---|
pragyan | execution | Solved | Click | ret2ROP |
pragyan | story | Solved | Click | rand |
VNCTF2022 | clear_got | Solved | Click | write got, syscall |
VNCTF2023 | Traveler | Solved | Click | twice stack pivot, read more |
VNCTF2023 | store in tongxunlu | Solved | Click | syscall, strtol |
Lactf | rut-roh-relro | Solved | Click | stack pivot, fmt |
Lactf | rickroll | Solved | Click | A:ret2csu/B:fini_array, fmtstr |
Lactf | bot | Solved | Click | ret2fun |
Lactf | gatekeep | Solved | Click | Check in |
MHSCtf-2023 | Rescue Mission | Solved | Click | Integer Overflow |
BBCtf | medium_pwn | Solved | Click | hex string bytes change |
DiceCtf-2023 | bop | Solved | Click | seccomp allow orw syscall |
idek | Typop | Solved | Click | canary, pie, libc, system stack pivot |
nu1l_junior | gotclear | Solved | Click | gottable, run put.plt, execve |
nu1l_junior | ShellcodeMaster | Solved | Click | 17 bytes shellcode, orw |
nu1l_junior | StudentManager | Solved | Click | Integer Overflow, onegadget |
西湖论剑 | Message_Board | Solved | Click | stack pivot, orw rop |
西湖论剑 | babycalc | Solved | Click | ovrewrite one byte, stack pivot |
BUUCTF | EasyHeap_zjctf_2019 | Solved | Click | fastbin fake chunk |
BUUCTF | children_tcache | Solved | Click | off-by-null, double free libc2.27 |
BUUCTF | babyheap_0ctf_2017 | Solved | Click | chunk overlapping, malloc_hook-0x23 |
HGAME-week-3 | note_context | Solved | Click | large_note + context, orw shellcode |
HGAME-week-3 | large_note | Solved | Click | libc2.32 largebin, bk_nextsize, p+0x20 |
HGAME-week-3 | safe_note | Solved | Click | libc2.32 safe-linking |
HGAME-week-1 | choose_the_seat | Solved | Click | run binary again, leak libc, onegadget |
HGAME-week-1 | overflow | Solved | Click | overflow to backdoor |
HGAME-week-1 | orw | Solved | Click | prctl forbiden execve |
HGAME-week-1 | simple shellcode | Solved | Click | Read a shellcode and run it |