CTF writeups on binary exploitation, reverse engineering, and cryptography, and a tutorial series on reverse engineering x86 ELF binaries.https://blog.niktay.dev/enhttps://blog.niktay.dev/writing/ctfsg-ctf-2022-chonk-shortage/https://blog.niktay.dev/writing/ctfsg-ctf-2022-chonk-shortage/Leaking libc through an oversized mmap chunk, then a format-string bug redirects a writable libc GOT entry to system to get a shell.Sun, 13 Mar 2022 00:00:00 GMTPwnx86-64glibcheaphttps://blog.niktay.dev/writing/hsctf-8-2021-house-of-sice/https://blog.niktay.dev/writing/hsctf-8-2021-house-of-sice/A double free, a leaked system(), and a detour through fastbins to reach __free_hook.Sun, 20 Jun 2021 00:00:00 GMTPwnx86-64glibcheaphttps://blog.niktay.dev/writing/zh3r0-ctf-2021-babyre/https://blog.niktay.dev/writing/zh3r0-ctf-2021-babyre/Recognizing the per-8-byte bit shuffle as a matrix transpose and inverting it in Python to turn the comparison constant back into the flag.Mon, 07 Jun 2021 00:00:00 GMTReversingx86-64https://blog.niktay.dev/writing/zh3r0-ctf-2021-the-vault/https://blog.niktay.dev/writing/zh3r0-ctf-2021-the-vault/Extracting PICO-8 code hidden in a cartridge PNG's color-channel LSBs, then reimplementing its Lua check in Python to recover the password.Mon, 07 Jun 2021 00:00:00 GMTMiscgamessteganographyhttps://blog.niktay.dev/writing/ichsa-ctf-2021-epic-game/https://blog.niktay.dev/writing/ichsa-ctf-2021-epic-game/Abusing an snprintf return-value bug to wrap a write into the GOT and point memset at system, using the game's leaked luck stat as a libc address.Thu, 03 Jun 2021 00:00:00 GMTPwnx86-64gameshttps://blog.niktay.dev/writing/seccon-beginners-2021-freeless/https://blog.niktay.dev/writing/seccon-beginners-2021-freeless/With no free available, a top-chunk overflow forces sysmalloc to free memory, enabling a libc leak and tcache poisoning of __free_hook.Mon, 24 May 2021 00:00:00 GMTPwnx86-64heaphttps://blog.niktay.dev/writing/3kctf21-masterc/https://blog.niktay.dev/writing/3kctf21-masterc/Overwriting a thread's master canary in its TCB via an unbounded gets, then ROP-ing to a shell after leaking a PIE address through scanf.Thu, 20 May 2021 00:00:00 GMTPwnx86-64https://blog.niktay.dev/writing/3kctf21-crypto-warmup/https://blog.niktay.dev/writing/3kctf21-crypto-warmup/Mapping every three-character block to the number the provided encoder outputs, then reversing the lookup over the given numbers.Mon, 17 May 2021 00:00:00 GMTCryptopythonhttps://blog.niktay.dev/writing/linectf21-babycrypto1/https://blog.niktay.dev/writing/linectf21-babycrypto1/Forging an AES-CBC command block with the server's encryption oracle, encrypting the show command under the previous block as its IV.Sun, 21 Mar 2021 00:00:00 GMTCryptoAESpythonhttps://blog.niktay.dev/writing/linectf21-babycrypto2/https://blog.niktay.dev/writing/linectf21-babycrypto2/Flipping bits in the IV that the server prepends to AES-CBC ciphertext, so the first block decrypts to show instead of test.Sun, 21 Mar 2021 00:00:00 GMTCryptoAESpythonhttps://blog.niktay.dev/writing/allesctf20-pwnkemon/https://blog.niktay.dev/writing/allesctf20-pwnkemon/Decoding a Game Boy link-cable capture as SPI in Saleae Logic, then converting the bytes with a Pokémon character table to read the flag.Mon, 07 Sep 2020 00:00:00 GMTOtherhardwaregameshttps://blog.niktay.dev/writing/redpwnctf20-i-wanna-find-the-flag/https://blog.niktay.dev/writing/redpwnctf20-i-wanna-find-the-flag/Extracting the GameMaker data.win from the game executable and opening it in UndertaleModTool to read the flag from its winner room.Fri, 26 Jun 2020 00:00:00 GMTReversingwindowsgameshttps://blog.niktay.dev/writing/redpwnctf20-skywriting/https://blog.niktay.dev/writing/redpwnctf20-skywriting/A read without a NUL terminator leaks stack values; a later overflow restores the canary and selects a libc one-gadget return target.Fri, 26 Jun 2020 00:00:00 GMTPwnx86-64https://blog.niktay.dev/writing/ractf-finches-in-a-pie/https://blog.niktay.dev/writing/ractf-finches-in-a-pie/A format-string leak defeats the canary and PIE, then a buffer overflow redirects execution to a built-in flag-printing function.Thu, 11 Jun 2020 00:00:00 GMTPwnx86https://blog.niktay.dev/writing/hsctf-got-it/https://blog.niktay.dev/writing/hsctf-got-it/A scrambled GOT turns the binary's scanf into printf, and the resulting format-string write redirects a GOT entry to a one-gadget shell.Sun, 07 Jun 2020 00:00:00 GMTPwnx86-64https://blog.niktay.dev/writing/hsctf-pwnagotchi/https://blog.niktay.dev/writing/hsctf-pwnagotchi/A gets overflow with no canary leaks puts to fingerprint libc, then ROPs through the eat and zzz helpers to reach a one-gadget shell.Sat, 06 Jun 2020 00:00:00 GMTPwnx86-64glibchttps://blog.niktay.dev/writing/sharky-ctf-captain-hook/https://blog.niktay.dev/writing/sharky-ctf-captain-hook/A format-string bug leaks the stack canary and libc, then a buffer overflow in the edit handler drives a ROP chain to a one-gadget shell.Tue, 12 May 2020 00:00:00 GMTPwnx86-64glibchttps://blog.niktay.dev/writing/sharky-ctf-give-away-one/https://blog.niktay.dev/writing/sharky-ctf-give-away-one/A 32-bit buffer overflow and a leaked system address drive a ret2libc call that runs /bin/sh via a string found in the provided libc.Tue, 12 May 2020 00:00:00 GMTPwnx86glibchttps://blog.niktay.dev/writing/sharky-ctf-give-away-two/https://blog.niktay.dev/writing/sharky-ctf-give-away-two/A PIE binary that leaks main to beat ASLR, then leaks libc via printf's GOT entry before ROP-ing into a one-gadget shell.Tue, 12 May 2020 00:00:00 GMTPwnx86-64glibchttps://blog.niktay.dev/writing/sharky-ctf-z3robotwaves/https://blog.niktay.dev/writing/sharky-ctf-z3robotwaves/Modeling the many constraints of a check_flag routine as an SMT problem and solving them with Z3 to recover the password.Tue, 12 May 2020 00:00:00 GMTReversingx86-64Z3https://blog.niktay.dev/writing/cybrics-2019-honey-help-misc/https://blog.niktay.dev/writing/cybrics-2019-honey-help-misc/Mapping garbled terminal symbols back to letters with a chosen-plaintext attack to recover the flag.Mon, 22 Jul 2019 00:00:00 GMTMiscsteganographyhttps://blog.niktay.dev/writing/cybrics-2019-proctf-ctb/https://blog.niktay.dev/writing/cybrics-2019-proctf-ctb/An SSH login that drops into a Prolog interpreter, where shell() spawns a shell to read the flag.Mon, 22 Jul 2019 00:00:00 GMTMiscprologhttps://blog.niktay.dev/writing/cybrics-2019-warmup-web/https://blog.niktay.dev/writing/cybrics-2019-warmup-web/Using curl to read the page served before its redirect, then base64-decoding its contents to recover the flag.Mon, 22 Jul 2019 00:00:00 GMTOtherwebhttps://blog.niktay.dev/writing/cybrics-2019-zakukozh-cyber/https://blog.niktay.dev/writing/cybrics-2019-zakukozh-cyber/Brute-forcing the keys of an affine cipher over all 256 byte values and keeping the decryption that produces a valid PNG of the flag.Mon, 22 Jul 2019 00:00:00 GMTCryptoaffine cipherhttps://blog.niktay.dev/writing/pop-rev-x86elf-1/https://blog.niktay.dev/writing/pop-rev-x86elf-1/How a function's prologue, return value, and epilogue look in disassembly, through a program that only returns 0.Sun, 25 Feb 2018 00:00:00 GMTReversingx86assemblyhttps://blog.niktay.dev/writing/pop-rev-x86elf-2/https://blog.niktay.dev/writing/pop-rev-x86elf-2/How local variables and function calls look in disassembly, through a program that adds three integers from user input.Sun, 25 Feb 2018 00:00:00 GMTReversingx86assemblyhttps://blog.niktay.dev/writing/pop-rev-x86elf-3/https://blog.niktay.dev/writing/pop-rev-x86elf-3/How conditionals look in disassembly, through a program that tells whether its input is more than, less than, or equal to 10.Sun, 25 Feb 2018 00:00:00 GMTReversingx86assemblyhttps://blog.niktay.dev/writing/pop-rev-x86elf-4/https://blog.niktay.dev/writing/pop-rev-x86elf-4/How loops look in disassembly, through a program that prints the length of its input.Sun, 25 Feb 2018 00:00:00 GMTReversingx86assemblyhttps://blog.niktay.dev/writing/pop-rev-x86elf-5/https://blog.niktay.dev/writing/pop-rev-x86elf-5/How structs look in disassembly, through a program that reads a name and age into a struct and prints them.Sun, 25 Feb 2018 00:00:00 GMTReversingx86assemblyhttps://blog.niktay.dev/writing/tokyowesterns-2017-rev-rev-rev-reverse/https://blog.niktay.dev/writing/tokyowesterns-2017-rev-rev-rev-reverse/Reversing a 32-bit ELF that reverses its input, transforms it with bitwise operations, and NOTs it, then brute-forcing the flag one character at a time.Mon, 04 Sep 2017 00:00:00 GMTReversingx86https://blog.niktay.dev/writing/hitb-gsec-2017-2017-dating-in-singapore-misc/https://blog.niktay.dev/writing/hitb-gsec-2017-2017-dating-in-singapore-misc/Reading a string of digits as twelve months of days and tracing them out on the 2017 calendar.Mon, 28 Aug 2017 00:00:00 GMTMiscpuzzleshttps://blog.niktay.dev/writing/hitb-gsec-2017-prime/https://blog.niktay.dev/writing/hitb-gsec-2017-prime/Decompiling an APK whose prime check also accepts squares of primes, which makes the flag π(10¹⁶) + π(10⁸).Mon, 28 Aug 2017 00:00:00 GMTOtherandroidhttps://blog.niktay.dev/writing/hitb-gsec-2017-simple-transfer-misc/https://blog.niktay.dev/writing/hitb-gsec-2017-simple-transfer-misc/Recovering a PDF sent over NFS from a packet capture, then converting it to HTML with pdftohtml to reveal the flag.Sun, 27 Aug 2017 00:00:00 GMTMiscforensics