Sharing is Caring: Arbitrary Code Execution for Breakfast

This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.

Breakfast is a CTF challenge I designed for CrewCTF 2025. With deserialization attacks being in vogue, I wanted to explore the topic in C++ and as a result, found an interesting niche bug in the cereal library . In this writeup, we'll revisit C++ internals and explore binary exploitation techniques beyond ROP . We’ll learn how even a properly written C++ program could be vulnerable to remote code…

Read on trebledj.me ↗