Writeups for challenges I solve, grouped by technique.
A TCP chat service overflows in a loop; half-closing the socket forces a return into a ROP call to the binary's own win().
The Stack
profile
One read, one printf: a self-planted stack pointer lets a single %hhn write flip a loop-local integer to win()'s target value.
Format Strings
profile
The flag lands on the stack before the vulnerable printf(buf) runs, so a bare %s walks phantom arguments straight onto it.
Format Strings
profile
Same leak as Radio Los Santos, but deeper on the stack, so the exploit sweeps positional %p arguments instead of one offset.
Format Strings
profile
Full Clip's sibling: a smaller buffer and two printf calls split the same %n write to a loop counter across two payloads.
Format Strings
profile
A login gate hides an embedded-NUL password, then a %n write flips the logged-in account's role field to "CEO".
Format Strings
profile
Rootstar Games with its struct reordered: every offset shifts, and the fix is overwriting the comparison buffer, not the role.
Format Strings
profile
A length check and a self-overlapping sprintf hide a %hn write that loops exit into main and pivots puts into system.
Format Strings
profile
strlen(buf) picks the syscall, read()'s return value the fd; 3 bytes turns it into read(3,buf,511), replaying the flag fd through puts().
Signals & Syscalls
profile
A fixed-address RWX page is filled with shellcode via a format-string write, then a stack overflow jumps to it.
Shellcode
profile
read()'s return value is passed straight through as a raw syscall number; 322 bytes turns it into execveat("/bin/sh").
Signals & Syscalls
profile
With an executable stack and no canary, shellcode in buf is reached via a jmp rsi gadget with no leaked address needed.
The Stack
profile
A stack overflow pivots the frame into .bss, then plants a SigreturnFrame there and SROPs into execve("/bin/sh").
Signals & Syscalls
profile
An unbounded cin >> buf overflow on AArch64 is chained through a gadget that loads w0 to satisfy win(int)'s check.
The Stack
profile
An 8-byte overflow clobbers an adjacent sentinel variable, enough to trip win() without touching the return address.
The Stack
profile
A 3-use bit-flip primitive becomes unlimited by corrupting its own loop counter, then rebuilds "/bin/sh" one bit at a time.
Bit Flips
profile
A UAF from an unset pointer leaks the safe-linking key and a heap address, then poisons tcache onto the flag bytes.
The Heap
profile
A puts leak gives the libc base; one format string smashes the canary and points __stack_chk_fail at a one_gadget.
Format Strings
profile
The flag sits at a randomized address, so a stack overflow pivots into a fixed RWX page and shellcode scans /proc/self/maps.
Shellcode
profile