Feb 22 Β· 11 min read Β· Challenge Description Welcome to the Storybook Workshop! In this post, we are going to break down Cider Vault, an incredibly well-designed CTF challenge that serves as a masterclass in modern Linux he
Join discussion
Dec 22, 2025 Β· 5 min read Β· Challenge Overview Category: Pwn / Jail Escape The challenge provides a remote FreeBSD environment where we interact with a specialized shell called env_manager running inside a Jail. The goal is to read the flag located at /flag on the host system. ...
Join discussion
Dec 13, 2025 Β· 5 min read Β· Challenge Description Category: Pwn / Binary Exploitation Author: M0H1.T3L We lost Something, Can you Find it! Solution Walkthrough Initial Reconnaissance and Protection Analysis We begin by analyzing the binary's file type and security protections ...
Join discussion
Jul 28, 2025 Β· 3 min read Β· λ°°κ²½ λ°μ΄λ리 λΆμ λ°©λ²μλ ν¬κ² 2κ°μ§κ° μλ€. μλ: gdb κ°μ λλ²κ±°λ‘ μ΄μ μ½λλ₯Ό νμ€μ© μ€ννλ©΄μ λ μ§μ€ν°μ λ©λͺ¨λ¦¬μ λ³νλ₯Ό μΆμ νλ λΆμ μλ: angrμ κ°μ μλνλ λΆμ νλ μμν¬λ₯Ό μ¬μ© μ΄ 2κ°μ§λ μνΈλ³΄μμ μ΄λ€. μ΄ κΈμμλ μλ λ°μ΄λ리 λΆμ νλ μμν¬ angrμ λν΄μ μμλ³΄κ² λ€. μκ° angrλ λ°μ΄λ리 λΆμμ μν λ€μ¬λ€λ₯ν νμ΄μ¬ κΈ°λ° νλ μμν¬μ΄λ€. μ€μν μ² νμ λ°μ΄λ리 λΆμ μμ μ νλ‘κ·Έλλ° λ°©μμΌλ‘ ...
Join discussionJun 30, 2025 Β· 2 min read Β· Desc: Daddy told me about cool MD5 hash collision today. I wanna do something like that too! Source Code: #include <stdio.h> #include <string.h> unsigned long hashcode = 0x21DD09EC; unsigned long check_password(const char* p){ int* ip = (int*)p; ...
Join discussionDec 30, 2024 Β· 1 min read Β· λ¬Έμ λΆμ // Name: rop.c // Compile: gcc -o rop rop.c -fno-PIE -no-pie #include <stdio.h> #include <unistd.h> int main() { char buf[0x30]; setvbuf(stdin, 0, _IONBF, 0); setvbuf(stdout, 0, _IONBF, 0); // Leak canary puts("[1] Leak ...
Join discussionDec 30, 2024 Β· 5 min read Β· // Name: ow_rtld.c // Compile: gcc -o ow_rtld ow_rtld.c #include <stdio.h> #include <stdlib.h> void init() { setvbuf(stdin, 0, 2, 0); setvbuf(stdout, 0, 2, 0); } int main() { long addr; long data; int idx; init(); pri...
Join discussionDec 30, 2024 Β· 5 min read Β· μ½λ λΆμ int __fastcall __noreturn main(int argc, const char ** argv, const char ** envp) { char * v3; // rsi char * v4; // rdi __int64 v5; // rdx __int64 v6; // rcx __int64 v7; // r8 __int64 v8; // r9 const char * v9; // rsi...
Join discussionDec 30, 2024 Β· 7 min read Β· λμ ν λΉμ΄ ν΄μ λλ κ³Όμ & binsμ λν΄μ μ 리 Free (glibc2.23) cμΈμ΄λ₯Ό κΈ°λ°μΌλ‘ νλ‘κ·Έλλ°μ ν λ λμ ν λΉμ μν΄μ malloc, free λ₯Ό μμ£Ό μ¬μ©ν©λλ€. μ€μ λ©λͺ¨λ¦¬ μμμ freeκ° μ΄λ€μμΌλ‘ μ§νλλμ§λ₯Ό μμλ³Όκ²μ λλ€. μ°μ binsμ΄ λ¬΄μμΈμ§ μμλ³΄κ² μ΅λλ€. binsλ μ½κ² λ§ν΄μ, free μ²ν¬λ€μ κ΄λ¦¬νλ κ΄λ¦¬μλΌκ³ μκ°νλ©΄ λ©λλ€. λν κ΄λ¦¬μλ λ€ κ°μ κ΄λ¦¬μκ° μλ, 1λ²μ§Έ μμμ κ΄λ¦¬νλ κ΄λ¦¬μ, ...
Join discussion