Userland on kiperZ

Editeur de configuration - FCSC 2025

Fri, 27 Feb 2026 00:00:00 +0000

TL;DR

An off-by-null (House of Einherjar) lets us consolidate heap chunks. From there, tcache poisoning gives control over pthread_tcache_struct, which redirects an allocation onto the stack for a ROP chain and a shell.

Overview

The challenge provides an x86-64 ELF binary: a player configuration editor. The program allows importing a configuration in a simplified INI format, then editing it through an interactive menu.

The binary runs on Ubuntu 22.04 with glibc 2.35 (no __malloc_hook / __free_hook, removed since 2.34).

Solaris - 404CTF 2025

Tue, 28 Oct 2025 00:00:00 +0000

TL;DR

Null off-by-one bug in heap management → LSB pointer corruption → leak heap (safe linking) → tcache poisoning to unsorted bin → leak libc → tcache poisoning to stdout → leak stack → tcache poisoning to stack → ROP chain with stack pivot → open/read/write flag with seccomp bypass

Challenge Files: chall (ELF binary), libc.so.6, chall.c

Note: This is one of my early CTF writeups! If you spot improvements, feel free to share!

22 Bytes Pour Sauver L'univers - 404CTF 2025

Mon, 27 Oct 2025 00:00:00 +0000

TL;DR

Buffer overflow + limited gadgets = SROP time! Leak addresses → chain two Sigreturn-Oriented Programming attacks → first SROP calls read(), second calls execve("/bin/sh") → shell!

Challenge Files: chall (ELF binary)

Note: There might be simpler approaches, but this SROP method worked great. If you spot improvements, feel free to share.

Challenge Overview

We’re given a 64-bit ELF binary that implements custom syscall wrappers and has a juicy buffer overflow vulnerability.

Book Writer - FCSC 2024

Sun, 26 Oct 2025 00:00:00 +0000

TL;DR

Integer overflow (n * 128 wraps to 0) → get 0x20 chunk → leak PIE from adjacent heap → overflow into next Book struct → overwrite function pointer to printf → format string leak libc → ROP chain to system("/bin/sh")

Note: This is one of my first CTF writeups! Went through several failed attempts before finding the right path.

Challenge Overview

Book management application with create/read/write/page turning functions. Heap-based exploitation.

Kerberint Space Program - 404CTF 2025

Sun, 01 Jun 2025 00:00:00 +0000

TL;DR

Off-by-two bug lets us corrupt a pointer byte-by-byte → leak libc addresses → overwrite GOT entries → redirect free() to system() → profit with system("/bin/sh")

Challenge Files: chall (ELF binary), libc.so.6, ld-linux-x86-64.so.2, main.c

Note: This is my first CTF writeup! At the time I solved this challenge, I was just starting out with heap exploitation. There are probably cleaner/simpler ways to solve this, but this approach worked for me. If you spot improvements, feel free to share!

Spaaaaaaace - 404CTF 2025

Sun, 01 Jun 2025 00:00:00 +0000

TL;DR

RWX memory + 13-byte size limit = staged shellcode time! Upload a tiny loader (13 bytes) that reads a bigger shellcode (24 bytes), then execute it to get shell.

Challenge Files: chall (ELF binary)

Note: This is one of my first CTF writeups! At the time I solved this challenge, I was just starting out with pwn. There are probably cleaner/simpler ways to solve this, but this approach worked for me. If you spot improvements, feel free to share!

Long Prime Shellcode - FCSC 2025

Tue, 29 Apr 2025 00:00:00 +0000

TL;DR

Program reads a decimal number, checks if it’s a 1024+ bit prime, converts it to binary, and executes it as code. The trick? Craft a prime number that’s actually valid x86-64 shellcode! →

Challenge Files: long-prime-shellcode (ELF binary)

Note: This is one of my first CTF writeups! If you spot improvements, feel free to share!

Challenge Overview

We’re given a binary that asks for a decimal number and does something… unusual with it: