Capture the Flag

Recovering blurred text in Bishop Fox's Unredacter challenge Byte

3rd Annual Binary Golf Grand Prix (BGGP3) Byte

SANS Holiday Hack Challenge 2017 Solution 25 min read

Letters to Santa app contains a reference to a development system in a HTML comment section. <!-- Development version --> <a href="http://dev.northpolechristmastown.com" …

Vulnhub - Breach 3 boot2root CTF walkthrough 10 min read

The third boot2root system in the Breach series is an intermediate challenge. This time the VM will automatically acquire an IP address via DHCP. First, let’s identify the target system. With …

Vulnhub - Breach 2.1 boot2root CTF walkthrough 8 min read

Breach 2.1 is meant to be beginner to intermediate boot2root/CTF challenge. The VM is configured with a static IP address (192.168.110.151) so you will need to configure your host-only adaptor to this …

Vulnhub - Breach 1 boot2root CTF walkthrough 10 min read

Breach 1.0 is meant to be beginner to intermediate boot2root/CTF challenge. The VM is configured with a static IP address (192.168.110.140) so you will need to configure your host-only adaptor to this …

The 2015 SANS Holiday Hack Challenge - Solution 15 min read

Which commands are sent across the Gnome’s command-and-control channel? EXEC:iwconfig in packet 363 EXEC:cat /tmp/iwlistscan.txt in packet 573 What image appears in the photo the Gnome sent across …

Exploit Exercises - Protostar - Final levels 21 min read

Exploit-Exercises: Protostar For this level we have got a binary listening on port 2995. Let’s find out what this binary is up to. 0x08049833 <main+0>: push %ebp 0x08049834 …

Exploit Exercises - Protostar - Heap levels 15 min read

Exploit-Exercises: Protostar For this scenario we need to run the winner() function. To get a better idea about the binary a look at the assembly helps. 0x08048492 <main+6>: sub $0x20,%esp …

Exploit Exercises - Protostar - Network levels 10 min read

Exploit-Exercises: Protostar For this exercise we have got a service listening on port 2999. Let’s connect and see what it does. user@protostar:/opt/protostar/bin$ telnet 127.0.0.1 2999 …

Exploit Exercises - Protostar - Format String levels 7 min read

Exploit-Exercises: Protostar First of all, we take a look at the disassembly. ... 0x08048431 <main+6>: sub $0x10,%esp 0x08048434 <main+9>: mov 0xc(%ebp),%eax ; load pointer to the address …

Exploit Exercises - Protostar - Stack levels 12 min read

Exploit-Exercises: Protostar For this scenario we need to overwrite the stack variable $modified. To get a better idea about the binary a look at the assembly helps. 0x080483f4 <main+0>: push …