Adventures In Security
This is a write-up for rugdoctor, which is a JIT compiler with a 16-bit integer overflow. The integer overflow allows you to jump to the middle of other instructions, to run small bits of code in between other instructions. As always, you can find copies of the binaries, containers, and full solution in our GitHub repo!
This is a write-up for three “pwn” challenges - readwritecallme, readwriteme, readme. They’re all pretty straight forward, and designed to teach a specific exploit type: how to exploit an arbitrary memory write. All three challenges let you read arbitrary memory, and the first two additionally let you write to arbitrary memory. The final one (readme) only lets you read memory, but it has a buffer…
This is a challenge I’ve been considering making forever. It’s possible I’ve already made it, even, it’s one of those things that appeals to my brain! As always, you can find copies of the binaries, containers, and full solution in our GitHub repo!
This will be a write-up for the three shorter / more miscellaneous challenges I wrote: if-it-leads gitfab jengacrypt As always, you can find copies of the binaries, containers, and full solution in our GitHub repo!
In this post, I’m going to do write-ups for a few challenges that don’t really meaningfully categorize. As usual, you can find the code and complete solutions on our GitHub repo!
I wrote a wholllle pile of 101 web challenges this year, which are ultimately going to be adapted for a workshop I’m giving at NorthSec in Montreal next month. I’m not going to spend a ton of time on them, I’ll just give the solutions quickly. As usual, you can find the code and complete solutions on our GitHub repo! And, if these are particularly interesting to you, come see me in Montreal!
If you read my bug-me write-up or my Linux process injection blog, you may be under the impression that I’ve been obsessed with the ability of Linux processes to write to their own memory. These challenges are no exception! You can download source and the challenge (including solutions) here (acaan) and here (drago-daction).
Every year, I make a list of ideas and it contains the same thing: “process that debugs itself”. It’s from a half-remembered Windows challenge I solved when I was very new to CTFs. I’m obsessed with that concept, having messed with writing debuggers a few times (including Mandrake), and blogging about process injection. You’ll find a few challenges influenced by that those concepts thie yar, but…
Hey all! My husband’s company recently did an internal (commercial) CTF, and as a CTF nerd I got suckered into helping him. I thought one of the challenges had a pretty interesting solution - at least, something I hadn’t done before - and I thought I’d do a little write-up! Because it’s a commercial CTF, I wrote my own vulnerability binary, which you can grab here. It’s much, much simpler, but has…
This is a write-up for turing-complete, turing-incomplete, and turing-incomplete64 from the BSides San Francisco 2024 CTF! turing-complete is a 101-level reversing challenge, and turing-incomplete is a much more difficult exploitation challenge with a very similar structure. turing-incomplete64 is a 64-bit version of turing-incomplete, which isn’t necessarily harder, but is different. Let’s look…