niktay: CTF writeups and tutorials

Overwriting a thread's master canary in its TCB via an unbounded gets, then ROP-ing to a shell after leaking a PIE address through scanf.

Mapping every three-character block to the number the provided encoder outputs, then reversing the lookup over the given numbers.

Forging an AES-CBC command block with the server's encryption oracle, encrypting the show command under the previous block as its IV.

Flipping bits in the IV that the server prepends to AES-CBC ciphertext, so the first block decrypts to show instead of test.

Decoding a Game Boy link-cable capture as SPI in Saleae Logic, then converting the bytes with a Pokémon character table to read the flag.

Extracting the GameMaker data.win from the game executable and opening it in UndertaleModTool to read the flag from its winner room.

A read without a NUL terminator leaks stack values; a later overflow restores the canary and selects a libc one-gadget return target.

A format-string leak defeats the canary and PIE, then a buffer overflow redirects execution to a built-in flag-printing function.

A scrambled GOT turns the binary's scanf into printf, and the resulting format-string write redirects a GOT entry to a one-gadget shell.

A gets overflow with no canary leaks puts to fingerprint libc, then ROPs through the eat and zzz helpers to reach a one-gadget shell.

A format-string bug leaks the stack canary and libc, then a buffer overflow in the edit handler drives a ROP chain to a one-gadget shell.

A 32-bit buffer overflow and a leaked system address drive a ret2libc call that runs /bin/sh via a string found in the provided libc.

A PIE binary that leaks main to beat ASLR, then leaks libc via printf's GOT entry before ROP-ing into a one-gadget shell.

Modeling the many constraints of a check_flag routine as an SMT problem and solving them with Z3 to recover the password.

Mapping garbled terminal symbols back to letters with a chosen-plaintext attack to recover the flag.

An SSH login that drops into a Prolog interpreter, where shell() spawns a shell to read the flag.

Using curl to read the page served before its redirect, then base64-decoding its contents to recover the flag.

Brute-forcing the keys of an affine cipher over all 256 byte values and keeping the decryption that produces a valid PNG of the flag.

How a function's prologue, return value, and epilogue look in disassembly, through a program that only returns 0.

How local variables and function calls look in disassembly, through a program that adds three integers from user input.

How conditionals look in disassembly, through a program that tells whether its input is more than, less than, or equal to 10.

How loops look in disassembly, through a program that prints the length of its input.

How structs look in disassembly, through a program that reads a name and age into a struct and prints them.

Reversing a 32-bit ELF that reverses its input, transforms it with bitwise operations, and NOTs it, then brute-forcing the flag one character at a time.

Reading a string of digits as twelve months of days and tracing them out on the 2017 calendar.

Decompiling an APK whose prime check also accepts squares of primes, which makes the flag π(10¹⁶) + π(10⁸).

Recovering a PDF sent over NFS from a packet capture, then converting it to HTML with pdftohtml to reveal the flag.