write-ups - Write-ups for various CTF - 剑庭安 - 网站开发定制 SEO 优化蜘蛛池代做在线看手相算命

项目说明

Dans une tentative un peu vaine d'organiser le chaos, de donner une forme toute temporaire à tout ça,
voici un index...
(-----

Write-ups INDEX

Write-ups from CTFs..

as a Pwner for team (Blue Water, Water Paddler, RootMeUpBeforeYouGoGo, etc...)

or alone to practice..(Team --> Armitage)

*this index is not exhaustive, it's mostly challenges that have a write-up (there are more challenges in write-ups/ directory)*

<details>
<summary>Heap Challenges</summary>

libc 2.35

- 0CTF TCTF 2022 --> babyheap
* write-up
> *seccomp in place, heap o due to type confusion, do chunk o for leak, then two tcache poisonning attacks* 
> *code execution dtor_list table in tls-storage, and erasing the random value at fs:0x30*

- DiceCTF HOPE 2022 --> catastrophe
* write-up
> *double free in fastbin, then o libc strlen got entry with system() address* 
> *code execution when calling puts() function (that calls strlen...)*

- BSides.Algiers.2023 --> just pwnme
* sol
> *double free in fastbin, then get allocation on environ, leak environ, get allocation on stack, write ROP on stack*

libc 2.34

- MetaCTF 2021 --> hookless
* write-up
> *double free in delete function,uaf in edit function (usable once),uaf in display() function too* 
> *House of Botcake attack, we o IO_2_1_stdout with environ address to leak stack address* 
> *we write a ROP directly on stack to achieve code execution*

libc 2.32

- vsCTF 2022 --> EZorange
* write-up
> *oob read/write in edit function, no free a, use same method than house of orange to free chunks* 
> *we free two chunks, then do tcache poisonning with the oob, and o __malloc_hook*

libc 2.31

- justCTF 2022 --> notes
* write-up
> *fastbin dup attack, then write to __free_hook*

- idek CTF 2021 --> stacknotes
* write-up
> *malloca alloc chunk on stack depending on size,we forge a fake chunk on stack, do a house of spirit attack on it* 
> *then alloc a chunk on stack with our ROP that o return address*

- Tamil CTF 2021 --> Uni
* write-up
> *o in edit because of strlen on a non-zero terminated string, will give us a read/write primitive* 
> *we set tcache.count in tcache_perthread_struct to 7 , to make a chunk goes to unsorted, to have a libc address leak* 
> *we edit tcache_entry of bloc of size 0x20 to __free_hook*

- HSCTF 8 CTF 2021 --> House of sice
* write-up
> *double free , using fastbin dup attack, then allocation on __free_hook*

- DownUnder CTF 2021 --> DUCTF Note
* write-up
> *int8 o in edit function, then write in tcache metadata, then allocation on __free_hook*

- DigitalO CTF 2021 --> flavor
* write-up
> *double free and uaf, then allocation on __free_hook*

- justCTF 2023 --> Nucleus
* write-up
> * o __free_hook poisonning attack *

libc 2.29

- GDG Algiers CTF 2022 --> Notes Keeper
* write-up
> *use null byte o to make 0x118 chunk goes to tcache 0x20 size when freed* 
> *the do fastbin dup attack, to finally o __free_hook*

libc 2.27

- RaR CTF 2021 --> unintended
* write-up
> *heap o because of strlen usage, then make o chunk & tcache poisonning* 
> *finally o __free_hook*

- IJCTF 2021 --> ezpez 
* write-up
> *double free on tcache_head to ha in unsorted, leak libc, double free on stdin to modify filedescriptor and leak flag*

- HSCTF 8 CTF 2021 --> Use after freedom
* write-up
> *unsorted bin attack, o global_max_fast, then o __free_hook*

- justCTF 2023 --> Welcome in my house
* write-up
> * classic house of force challenge, o another chunk on heap by "turning around" the memory address space *

libc 2.25

- Tamil CTF 2021* --> Vuln Storage
* write-up

</details>

<details>
<summary>Code execution after exit</summary>

- Imaginary CTF 2022 --> rope
* write-up
> *code execution * _rtld_global+3848 *, that is* __rtld_lock_lock_recursive (GL(dl_load_lock)) 
> *and pi in *_rtld_global* , via *gets()* and setcontext gadget*

- DanteCTF 2023 --> Sentence To Hell
* write-up
> *code execution * l->l_info[DT_FINI_ARRAY] *, to make it point to a forge _fini_array entry pointing to a onegadget* 
> *challenge on libc 2.35 from Ubuntu 22.04*

- LakeCTF Quals 2023 --> Not Malloc
* write-up
> *code execution by creating a fake dtor_list in tls-storage, then pi in tls-storage & execute a ROP there*

</details>

<details>
<summary>Kernel exploitation challenges</summary>

- UTCTF 2022 --> bloat
* write-up
> *use write primitive in kernel module, to o modprobe_path*

- FCSC 2023 --> ktruc
* write-up
> *kernel exploitation on recent ubuntu 5.19 kernel, use write primitive in kernel module, to o modprobe_path*

- OffensiveCon 2023 --> Blue Frost Security , bfsmatrix challenge
* write-up
> *kernel exploitation on 6.0.15, an UAF on linked list matrix*

</details>

<details>
<summary>SIGROP challenges</summary>

- Tamil CTF 2021 --> Insecure system
* write-up
> *ROP & sigrop*

- Tamil CTF 2021 --> Stress Rope
* write-up
> *small echo server in assembly, very few gadgets --> ROP & sigrop*

- PBjar CTF 2021 --> Imdeghost
* write-up
> *restricted shellcode, resolved back flag exfiltration done in sigrop*

</details>

<details>
<summary>FSOP challenges</summary>

- SECCON CTF 2022 Quals --> Baby file
* write-up
> *libc-2.31 based fsop exploitation, _wide_data is NULL and non reachable, we populate pointers first* 
> *then leak libc & random value at fs:0x30, we forge onegagdet mangled address and have code execution *

- Hack.lu CTF 2022 --> byor
* write-up
> *libc-2.35 based fsop exploitation, _wide_data points on NULL chunk, we can o stdout* 
> *code execution , we execute system('/bin/sh'), new standard for FSOP*

- FCSC 2022 --> RPG
* write-up
> *heap o in FILE structure, then we use FSOP read/write to o __free_hook*

- Blackhat MEA CTF finals --> devpro
* write-up
> *OOB read/write in FILE structure, then we use FSOP write to o stdout, and we do a FSOP for code execution*

- GlacierCTF 2023 --> Write Byte Where
* write-up
> *one byte pwn challenge, solved with a write in stdin to expand buffer, and write o for FSOP*

</details>

<details>
<summary>restricted shellcode challenges</summary>

- Redpwn CTF 2021 --> gelcode-2
* write-up
> *shellcode with only opcodes from 0 to 5, and a seccomp that force open/read/write shellcode*

- MetaCTF 2021 --> sequential shellcode
* write-up
> *shellcode where every byte must be bigger then the preceding one*

- Maple CTF 2022 --> EBCSIC
* write-up
> *shellcode alphanumeric but restricted to cp037 charset*

- FCSC 2022 --> palindrome
* write-up
> *need to write a palindrome shellcode, that can be read and executed in two direction*

- Aero CTF 2021 --> Shell Master 2
* write-up
> *run and execute 16byte alphanumeric shellcodes*

- idek CTF 2021 --> Guardians of the Galaxy
* write-up
> *shellcode that finds an pre left opened filedescriptor to escape chroot*

- KITCTFCTF 2022 --> movsh
* write-up
> *shellcode composed only of mov and 2 syscalls only, with seccomp that only allow open,read,write,exit syscalls*

- FCSC 2023 --> keskidi
* write-up
> *shellcode where a child leak parent accessible only flag.txt via a random temporary file modified by parent*

- Blackhat MEA CTF finals --> babysbx
* write-up
> *escaping from a seccomp very restricted shellcode, and remapping a read-only zone for changing only allowed binary*

- 0CTF/TCTF 2023 --> Nothing is true
* write-up
> *escaping from a seccomp very restricted with a 64 bit elf file, switching to 32bit and using sysenter *

</details>

<details>
<summary>Format string challenges</summary>

- PBjar CTF 2021 --> wallstreet32
* write-up
> *restricted format string with many format chars forbidden, use trick '%*\n' to get a leak (libc-2.31 based)*

- MetaCTF 2021 --> Simple Format Returned
* write-up
> *well classical format string, need bruteforce*

- Maple CTF 2022 --> printf
* write-up
> *well classical format string, need bruteforce*

- Imaginary CTF 2021 --> inkaphobia
* write-up
> *well classical format string, need bruteforce*

- IJCTF 2021 --> baby sum
* write-up
> *simple format string*

- FCSC 2022 --> Formatage
* write-up
> *well classical format string, need bruteforce*

- DigitalO CTF 2021 --> uncurved
* write-up
> *format string on heap with seccond that forbid execve, and bit a of bruteforce*

- Asis CTF Quals 2022* --> Baby Scan II
* write-up
> *abuse format string in snprintf to have a write anywhere primitive* 
> *then o exit got entry with _start, then o atoi with printf for leaks* 
> *then o atoi() with system() for code execution*

- idekCTF 2022 --> relativity
* write-up
> *format string on heap with only two %n allowed, need bruteforce...only sol *

</details>

<details>
<summary> ROP challenges (or Buffer o style)</summary>

- MetaCTF 2021 --> An Attempt Was Made
* write-up
> *restricted rop, exec, few gadgets (no libcsu_init gadget), use only add_gadget to forge gadgets*

- Hayyim CTF 2021 --> warmup
* write-up
> *simple rop challenge*

- Hayyim CTF 2021 --> cooldown
* write-up
> *more restricted rop challenge*

- Fword CTF 2021 --> blacklist revenge
* write-up
> *seccomp in place to forbid execve, no stdout/stderr output, so a mix of ROP+connect back shellc<brode*

- DefCamp CTF 2022 --> blindsight
* write-up
> *blind remote ROP with no binaries given*

- TamuCTF 2022 --> Rop Golf
* write-up
> *restricted ROP with few gadgets*

- SunshineCTF 2022 --> [RII] Magic the GatheRIIng
* write-up
> *oob write on stack, leak, then onegadget..*

- 404 CTF 2023 --> Calculatrice
* write-up
> *o in recursi of multiplication in a calculator application* 
> *little ROP, that transform stderr libc address on .bss in a onegadget *

- Balsn CTF 2023 --> BabyPwn2023
* write-up
> *restricted ROP with few gadgets a* 
> *first ROP on .bss, then execute .puts to leave libc addresses on .bss, then reeuse stdout address to leak a libc address on .bss (stdout) *

</details>

<details>
<summary>other architecture based challenges (arm,mips,riscv,etc...)</summary>

- LINE CTF 2022 --> simbox (arm)
* write-up
> *ARM challenge based on gnu simulator 11.2 (with custom patch), we rop it, and dump flag*

- JustCTF 2022 --> arm (aarch64)
* write-up
> *simple aarch64 exploitation challenge*

- HackIM CTF 2022 --> Typical ROP (riscv)
* write-up
> *simple riscv gets buffer o exploitation challenge*

- UTCTF 2023 --> Bing Chilling (loongarch64)
* write-up
> *simple loongarch64 gets buffer o exploitation challenge*

- Hack-A-Sat 4 Qualifiers 2023 --> Smash Babdy & Drop baby (riscv32)
* write-up
> *smash baby is a buffer o, and drop baby an o needed to be ROP, on riscv32*

</details>

<details>
<summary>Automatic exploit generation challenges</summary>

- Imaginary CTF 2021 --> speedrun
* write-up
> *automatic generated exploit, gets buffer o type*

- TamuCTF 2022 --> Quick Mafs
* write-up
> *5 automatic generated exploits to exploit *

</details>

<details>
<summary> challenges</summary>

- Fword CTF 2021 --> Peaky and the brain
* write-up
> *funny challenge, web application written in python, convert an image to brainfuck language, then execute brainfuck code* 
> *oob write on stack in brainfuck interpreter, seccomp in place forbid execve, so open/read/write shellcode translated in brainfuck*

- CyberSecurityRumble CTF 2022 --> riscv-jit
* write-up
> *escape from a riscv bson parser inside a riscv jit interpreter to a risc,* 
> *then escape from a riscv just in time interpreter via a oob write in rwx zone, and execute x86 shellcode*

- CyberSecurityRumble CTF 2020 --> bflol
* write-up
> *oob read/write in a brainfuck interpreter , we dump our leaks on stack* 
> *then o return address with a onegadget*

- 404 CTF 2022 --> Changement d'architecture II
* write-up
> *a sort of arm lite vm, oob read/write in registers access, that permit o FILE structure* 
> *then we get code execution via FSOP*

- 0CTF TCTF 2022 --> ezvm
* write-up
> *escape a stack machine type of vm, via an oob write, we leak an address on heap logic trick* 
> *then we get execution on exit, by forging a dtors_table in tls-storage and erasing random val at fs:0x30*

- RCTF 2022 --> bfc
* write-up
> *escape a brainfuck recompiler, via an oob read/write underflow on heap, then do heap exploitation (crazy)* 
> *then we get code execution by o libc GOT entries of strlen and memcpy, and causing a malloc error* 
> *the malloc error will launch __libc_message() function that will call strlen and memcpy*

- UTCTF 2023 --> UTCTF Sandbox
* write-up
> *escape a unicorn sandbox, in syscall emulation* 
> *we exploit first program running in guest, to get code execution via ROP* 
> *then we exploit syscall emulation in host loader, to leak host addresses, and execute an exec*

- zer0pts CTF 2023 --> Brainjit
* write-up
> *escape from a JIT brainfuck x86 compiler* 
> *by exploiting code x86 generation error, then executing a shellcode*

- Hitcon Quals 2023 --> Wall Maria
* write-up
> *a basic qemu escape challenge, via an oob read/write in a pci qemu driver*

- m0lecon CTF Finals 2023 --> Ptmoon
* write-up
> *an ad qemu escape challenge, on qemu 8.1.1 running ubuntu 23.10* 
> *an oob read/write introduced in the s, and a code execution a ROP in another thread stack*

- bi0s CTF 2024 -->
* write-up
> *an qemu escape challenge, on qemu 8.2.0* 
> *an oob read/write in a backend driver, and a code execution a shellcode in qemu RWX zone*

- cor CTF 2025 --> tua-cugina-systems
* write-up
> *well, more nsjail escape in fact* 
> * tricks to get code execution, privesc, then a nsjail escape, worth to remember*

</details>

<details>
<summary>PTRACE related challenges</summary>

- Balsn CTF 2022 --> Asian Parents
* write-up
> *interesting challenge where a parent process trace a child process to filter his syscalls via ptrace*

- NahamCon EU CTF 2022 --> Limited resources
* write-up
> *challenge where a parent process trace a child process to modify his code via PTRACE_POKEDATA* 
> *and like this, escape of the restricted seccomp to dump the flag *

</details>

<details>
<summary>Windows challenges</summary>

- INTENT CTF 2022 --> PwnMe
* write-up
> *simple buffer o, we do a little ROP that makes stack executable via a call to ()* 
> *then we jump to a simple windows shellcode that calls cmd.exe*

</details>

<details>
<summary>Uncategorized challenges (but worth reading)</summary>

- Google CTF Quals 2022 --> FixedASLR
* write-up
> *great challenge, attack on LFSR based with a known output, to calculate canary (generated by the LFSR)* 
> *use a ROP and a SIGROP for shell execution*

- Google CTF Quals 2023 --> write-flag-where 1,2 and 3
* write-up
> *a series of 3 challenges, each one more restricted, where you are give a write primitive to write flag anywhere*

- FCSC 2022 --> httpd
* write-up
> *interesting challenge, exploitation of syslog() format string vuln by child process, that exploit the parent process* 
> *child process http authentification has a buffer o in base64 decoding to a fixed buffer on stack*

- FCSC 2022 --> deflation
* write-up
> *buffer o when decompressing zlib compressed data, then restricted ROP*

- Balsn CTF 2021 --> orxw
* write-up
> *interesting challenge where a parent can only write, and a child process can only open and read* 
> *stdin,stdout,stderr are closed, so we use time to extract flag content by testing each char, and blocking when right guess*

- RealWorld CTF 2022 --> Shellfind
* quick write-up
> *exploiting a 0 day in a DLINK DCS-960L camera, via a buffer o in an udp service*

- justCTF 2023 --> Tic Tac PWN!
* write-up
> * interesting challenge, where we can call libc functions via a rpc server, that can call a dynamic library imported functions (tic tac toe game) * 
> * but we can pass only 32bits to functions, and cannot map memory zone in the low 32bits of address space, nor use returned functions results * 
> * we mmap a shellcode written in a temp file as rwx, and we finally use on_exit() libc function to have code execution at exits (very trikcy one..) *

- Codegate CTF 2023 --> sea
* write-up
> * interesting challenge, we can aes encrypt and decrypt data, we can o aes sboxes to zero them and leak the random key * 
> * some signed and unsigned trick in padding to leak data on stack, and an o in encrypt function.. *

</details>

---

you find my work usefull? well you can tip me here to support it.. I will drink to you ! (probably not coffee)

!bender1

项目信息

开发语言：Python

Star 数：216

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Write-ups for various CTF展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	write-ups - Write-ups for various CTF
所属分类	CTF思路
发布作者	admin
发布时间	2026-10-05 23:46:28
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	532
讨论数量	0
主题状态	正常讨论中

write-ups - Write-ups for various CTF

项目说明

Write-ups INDEX

libc 2.35

libc 2.34

libc 2.32

libc 2.31

libc 2.29

libc 2.27

libc 2.25

项目信息

技术要点

使用与学习建议

免责声明

怎么获取这个资源？

下载链接失效了怎么办？

可以转载或二次发布吗？

下载链接

同分类推荐