Hegzploit
Recent content on Hegzploit
Latest posts
0xL4ugh24 Hardware Challenges Official Writeups
Lately, I have been doing some hardware security research, specifically focusing on side channel stuff, this inspired me to write these challenges for the 0xL4ugh CTF. You will find all the challenge files on this repo , at the end of the blog I will list some notable writeups by players who have completed this challenge. Tempus Summary: Timing side channel attack allows us to bruteforce the pin…
Low Budget Router
In this blog post, we’ll explore three challenges from the “Not Vulnerability Research” category in CyCTF'23, held in Cairo ICT. I managed to solve the first challenge during the CTF, and solved the remaining two afterwards. Be sure to check out the official writeup by the author . As of writing this, I haven’t read the author’s writeup to avoid being influenced by…
Reactive Vault 1
I started by installing the APK on an android phone, once opened it will show a text field to enter a key and a login button, the APK will try to navigate to https://you-shall-not-pass when trying to type any key (maybe this was done to prevent bruteforcing the key?), finally, when you try to login with a random key It will show a dialog saying “BAAAD Key” I dropped the APK within jadx…
An Electrical Engineer's Adventure into the Deep Dark of AI
This is a blog post about my graduation project, where I went for a little dive within the scary realm of AI. I had zero practical experience with AI prior and had only a minimal theoretical understanding of some concepts. While this work may not seem like much, this was a rough ride for me, and I can confidently say that it was worth it. I couldn’t have had the opportunity to do this type…
Hacking the Hackathon: How We Optimized Our Way to Third Place
Are you ready to put your coding skills to the ultimate test? Hacktrick is the hackathon that combines AI, problem-solving, and cybersecurity to create a thrilling challenge. The landing page promises a rescue mission, but the real magic happens behind the scenes. As the competition heats up, we quickly realize that coding tricks alone won’t guarantee a win. The question is, will we figure…
Babiersteps
Checksec Canary : ✘ NX : ✓ PIE : ✘ Fortify : ✘ RelRO : Full We only care about the stack canary as we will be overflowing RIP to control execution flow, and thankfully It’s disabled. Exploitation 1. RIP Control We overflow the binary with a cyclic pattern, however, for this being a 64-bit binary we can’t overflow RIP with a non-canonical address. Canonical Address An address is said to…
Babysteps
Checksec It’s an aboslute mess, nothing is turned on fortunately :) Canary : ✘ NX : ✘ PIE : ✘ Fortify : ✘ RelRO : Partial Exploitation 1. EIP Control We obtain our offset very easily in GEF. 2. Exploitation We start by analyzing the stack at the overflown state. Looking at the registers, It appears that only two registers point to our stack. eax and esp . We search for gadgets jumping to any…
Detour
Checksec Canary : ✓ NX : ✓ PIE : ✘ Fortify : ✘ RelRO : ✘ RelRO is completely disabled unlike any other challenge we have encountered, this means that we have write permessions to all the relocations. Exploitation Running the binary will let us specify an address and a value and then It will assign that value to the adderss we provided. hegz@pop-os$ ./detour What: 1234 Where: 123123123213…
Dweeno
Serial Output 00110011 00111001 00110100 00110010 00101110 00110100 01100100 01100011 00110111 01101101 01100101 01100111 01100010 00110110 00110011 01100110 01100010 01100001 00110111 01100100 01100100 01100000 00110011 01100010 00110110 01100110 00110000 01100111 00110011 01100011 01100111 01100111 00110001 01101101 01100001 00110111 00110110 00101000 Wiring Diagram Arduino Code 1 2 3 4 5 6 7 8…
Fighting counterfeit USB Flash Drives
First Impressions I was really tempted to just plug that bad boy into my main PC, but I was worried It might do something funny , I didn’t rush and instead booted a trusy old HP Pavilion I had around and booted it up, and ran a quick lsblk to list the devices connected. We can clearly see that sdb1 with 1.9TBs of storage, but is that all? Digging Deeper Fight Flash Fraud, or rather f3 , is a…
Emotion and Logic
A lot of people are driven by emotions, logical thinking doesn’t always result in agreement, in fact, most people are more influenced by emotions than logic, does that make logical thinking uselss. It depends on a lot of factors, you shouldn’t boldly assume that logic works with everyone, a good strategy to get your message through might be analyzing the recipient, before deciding on…
Ways to return function values in C
I was having a chit-chat with a friend discussing some C language shenanigans when he sent me a code snippet, he wanted me fix the code and get it to work in 4 different ways. Here is the snippet: 1 2 3 4 5 6 7 8 9 10 11 12 13 #include <stdio.h> void calc ( int x , int y ); int main ( void ){ int x = 10 , y = 50 ; printf ( 'sum=%d ' , sum ); printf ( 'mult=%d' , mul ); } void calc ( int x , int y…
My new blogging workflow
I started blogging at 2020 and was using Hugo as my go-to Static Site Generator, It was pretty fast and did the job well (Jekyll yes, I’m looking you). The process went as follows: I had two repos, one for the blog config files and the markdown sources of my posts. I then build these files using hugo build into static HTML pages which I push to another repo that serves my blog through github…
Binary Exploitation Resources
These are by far the best resources I have found and have actually tried since I started learning binary exploitation. Don’t waste your time choosing which is the best resource, just pick one and start digging in. They are all awesome! Video Dr. Ali Hadi’s Offensive Software Exploitation | English - Arabic Nakerah Network’s BOF Playlist - Arabic (Windows) Hegzploit - Arabic…
A Journey into Mathematical Logic: Diophantus of Alexandria
In this series of blog posts, I will be discussing some of my favorite topics in math, It mostly falls under the domains of mathematical logic and computability theory. Diophantus of Alexandria Diophantus was a Greek mathematician that flourished around 250 AD, he is most famous for his book “Arithmetica” in which he had compiled 130 algebraic problems among thirteen books where most…
Leaky Pipe - 0xL4ugh CTF
In this challenge we recieved a binary in which we are asked to exploit and somehow retrieve the flag. you can find the binary for this challenge here Initial Analysis We start by running the binary and checking it behavior. ./leaky_pipe We have just fixed the plumbing systm, let's hope there's no leaks! >.> aaaaah shiiit wtf is dat address doin here... 0x7ffde7760410…
Trigger Happy - 0xL4ugh CTF
It was the first ever pwn challenge I solve in a CTF and I really liked it hence I wanted to bring it to this CTF (you can even check my poorly written writeup for that challenge which I refuse to remove as It’s pretty awesome to look back and see how much did we grow). You can check my video on format string vulnerabilies as a refresher for these types of attacks (It’s in arabic tho).
Buffer Overflows for Newbies
What is a Buffer anyway? We can think of buffers as containers to hold our data for later use, it’s not really something specific to computer science; In fact, we have buffers in electronics, mechanics, chemistry and even politics! We can say that the word buffer is just a fancy name for a placeholder (temporary storage)!
My Favorite Linux Distro
Now, that’s a bit misleading since i have been using windows for the past 12-13 years of my keyboard smashing journey but i don’t really feel any guilt doing this, in fact windows is nothing more of a bottleneck to me or so have i figured later . enough ranting, maybe this needs it’s own blog post after all or maybe not , it’s a highly controversial topic whatsoever. Just…
Optimizing Recursion
In this blog post i will try to explain the basic concept of recursion and then show why recursion can be so inefficient and how to optimize it using Call Tail Optimization! Normal Recursion, A Factorial Example Most of us tech nerds have already dealt with the good ‘ol recursion, let’s refresh our understanding using the iconic factorial program. $$0! = 1$$ $$n! = n (n-1)!$$ Python…
Not Really AI - RA CTF
Misusage of the libc printf() function can lead to serious information leakage and even code execution. when we pass one argument (for example printf(foo) ) we can: leak stack addresses using %x or %p format specifiers. overwrite any pointer’s value using %n specifier (note that we can’t overwrite plain stack addresses as the %n format specifier can only overwrite by reference and not…