Written by shakuganz

NahamCon CTF 2022 – Personnel Write-up (Web)

Hi everyone! NahamCon CTF 2022 was held from 29/4-30/4. This Personnel challenge is on REGEX injection to leak the flag. Let’s get started! Files provided app.py Outlook of the website We can see there is a search bar for us to input stuff. Looking at the HTML source code, we can see the form will […]

Advertisement

Written by shakuganz

NahamCon CTF 2022 – babyrev (Reverse Engineering)

Hi everyone! NahamCon CTF 2022 was held from 29/4-30/4. This babyrev challenge is on reversing the encoded flag to decode it. Let’s get started! Files provided babyrev You can download by reversed engineered IDA Freeware 7.7 database file for babyrev here. Overview We can see in the main(), it will prompt us for a username […]

Written by shakuganz

b01lers CTF 2022 Write-up (Reverse Engineering)

Hi everyone! This post is on b01lers CTF 2022’s reverse challenges which was held on 23/4 – 24/4. The two write-ups on this post are on challenges that requires us to write x64 assembly code based on the given questions on each level. Let’s get started! 1. extreme_64 Can you program in x86_64 assembly? Pass […]

Written by shakuganz

b01lers CTF 2022 Write-up (Pwn)

Hi everyone! This post is on b01lers CTF 2022’s pwn challenges which was held on 23/4 – 24/4. The pwn challenges are on using gets() and overflow to bypass strcmp() as well as string format attack to leak the flag located in heap memory. Let’s get started! 1. gambler_overflow Feeling luuuuuuuucky? You must create a flag.txt […]

Written by shakuganz

HackTheBox – Backdoor Write-up

Hi everyone! This write-up is on Backdoor, an easy Linux machine. I wouldn’t say this machine is actually easy. This machine requires us to manually enumerate WordPress’s plugin directory, and exploit the directory traversal vulnerability to leak process. Exploit the gdbserver process to obtain a reverse shell before attaching to the root’s screen session for […]

Written by shakuganz

Use DockerFile for debugging with Pwntools

Hi everyone! This article will be on setting up DockerFile for debugging with Pwntools. This may be useful for you during CTF challenges. In the example below, I will be using an example from DCTF 2022 Codechainz. The “app” binary I am using can be downloaded from here. Let’s get started! Setup image from DockerFile […]

Written by shakuganz

DCTF 2022 – Codechainz Write-up

Hi everyone! This post is on DCTF 2022’s Codechainz which is a fairly easy pwn challenge. This challenge has a buffer overflow (BoF) vulnerability and requires us to jump to a space created by mmap() which is executable. However, there is a shellcode size limit due to the space available. Let’s get started! Files provided […]

Written by shakuganz

BKSEC 2022 CTF Write-up (Pwn)

Hi everyone! This post is on BKSEC 2022 CTF which was held in early April this year. I only attempted the pwn category as I was feeling lazy to try out the others. The pwn challenges tested on arbitrary write via array out of bound (OOB), stack alignment on x64 programs, and bypassing integer inputs […]

Written by shakuganz

picoCTF 2022 Write-up (Web Exploitation)

Hi everyone! This post is on picoCTF 2022 write-up for web exploitation that was held from 16th March 2022 to 30th Mar 2022. It covers the basics of analyzing the client source codes, path traversal, robots.txt, modifying cookies, directory fuzzing, and SQL injection. Let’s get started! 1. Includes Below shows the main page of the […]

Written by shakuganz

picoCTF 2022 Write-up (Binary Exploitation)

Hi everyone! This post is on picoCTF 2022 write-up for binary exploitation that was held from 16th March 2022 to 30th Mar 2022. In this CTF, there are buffer overflow, on stack shellcode execution, format string attack, function overwrite, C programming array out of bound (OOB) arbilitary write, stack cache, and vulnerable string check. Let’s […]