一位失败人士的blog
Recently, I have submitted my academic paper to NDSS 2025. Now it’s time to take a break. Following the deadline is the HITCON CTF 2024, so as the break, why not take a look? I really haven’t played CTF for quite a long time. :) During the two days, I spent my efforts on the V8 Sandbox challenge. Actually I haven’t worked on V8 for a while. It seems that the sandbox feature now has already been…
Taking a break from my academic research, I played Codegate CTF 2023 this weekend with r3kapig. I solved two challenges: pcpu and sea, and both of them are quite interesting so here is the write-up for them. Thanks to the successful resolution of challenge sea in the last 20 minutes, our team manages to qualify for the finals. :) pcpu 0x00 Overview The program implements an virtual machine for a…
This weekend I have played Google CTF with r3kapig . On the first day I tried the OCR challenge but failed to solve it, and on the second day I spent the whole day working on the d8 that I am more familiar with. Finally I managed to solve it at midnight as the second blood. This challenge is quite interesting so it is worth to do a write-up. 0x00 Overview In this challenge, we need to exploit a…
0x00 Introduction In this challenge, we need to exploit V8 JavaScript engine with heap sandbox enabled. The bug is very simple: an array OOB. We bypass the sandbox by rewriting code field of function object, so that we can control the low 32 bits of rip register. We write the shellcode as double floating point immediate numbers in function and compile this function using JIT, and set rip to…
0x00 Introduction AFLGO is a modification of AFL that perform directed fuzzing , for more information, please read the paper . In this article, I will analyze source code of AFLGO that constructs call graph and control flow graphs of given program to be fuzzed and uses these graphs to calculate distance from each block to target locations. Most of these works are implemented in afl-llvm-pass.so.cc…
Last weekend we played Hack.lu CTF and got 5th place. I am quite busy recently so I only solved one challenge: Stonks Socket, and I think it is quite interesting and worthy to do a writeup. 0x00 Overview In this challenge we need to exploit Linux kernel. In the kernel module, tcp_prot.ioctl of TCP socket is written to self-defined function stonks_ioctl , and sk_prot->recvmsg of TCP socket is…
Last weekend we have participated TCTF 2021 Final and got 2nd place! Congratulation! I solved 3 challenges: Secure JIT 2 , Promise and krop . Among these, I think Promise is quite worthy to do a full writeup. 0x00 Overview In this challenge, we need to exploit quickjs engine, which is a lightweight JavaScript engine, and this is actually my first time to exploit this engine. The vulnerability we…
Last weekend we played Google CTF and I have solved 2 challenges: first 2 parts of fullchain and eBPF . The fullchain challenge is actually very easy: v8 bug and mojo bug are just basic OOB access bugs. However, eBPF is quite interesting for me, since it is my first time to learn and exploit eBPF module in Linux kernel, so it is worthy to do a write-up for it. 0x00 Overview In this challenge,…
0x00 Overview Last weekend I played TCTF Qualifier online and spent all of my time on this challenge, but still failed to solve it in time. After the contest, I finally solved this challenge. This is a crazy nested challenge: we firstly need to use side channel attack to leak admin_key.txt ; then we need to exploit ss_agent to get the ability to open and operate on /dev/ss ; then we need to…
0x00 Overview Last weekend I have played hxp 2020 as r3kapig. The challenges are very good. I have solved 3 challenges: Secure Program Config , still-printf and pfoten . Among these challenges, I think pfoten is quite worthy to do a full write-up. The challenge creates a file as swap space , so that some of the memory will be putted into this file when physical memory is not enough and will be…
