Rivit's blog
Live Last read · last published · next check
I open-sourced a set of community CTF challenges I created for CTFlearn . The collection is intentionally pragmatic: small, self-contained puzzles you can run locally (Docker is provided), iterate on, and learn from. What is in the repository The repository contains 20+ challenges across four categories: pwn: the largest category — small networked binaries and local pwn problems covering memory…
I spent some time fuzzing libfyaml , a feature-rich YAML parser/emitter written in C. I ended up finding and reporting 68 bugs, all of which have been fixed by the maintainer. Here’s how it went. Target libfyaml is a YAML library that supports YAML 1.2. It provides a pretty extensive API - parsing, emitting, path expressions, document manipulation, a reflection/type system, and more.…
Recently, I participated in RealWorld CTF 6 playing with justcatthefish , successfully teaming up with a team member - embedded - to solve the pgsum challenge, centered around exploiting PostgreSQL . This experience provided valuable insights into navigating real-world cybersecurity tasks and highlighted the intricacies of exploiting PostgreSQL . Description intro intro "> intro We have added sum…
Last week, I participated in hxp 2022 , an esteemed CTF event, where I successfully tackled the pwn challenge “browser_insanity.” This captivating exploit required reading arbitrary files from the KolibriOS OS filesystem, pushing me to dive deep into KalibriOS browser vulnerabilities and hone my reverse engineering skills. Description Ever wanted to hack a tiny OS written in x86-32…
This week was an exhilarating one as I had the opportunity to take part in the renowned Real World CTF 5th event. Among the various mind-bending challenges I encountered, one particularly intriguing puzzle called tinyvm caught my attention. This challenge involved delving into the realm of VM pwn, as we set out on a quest to successfully spawn a shell on a remote target. Here is my writeup for it.
