CTF challenges & writeups

273 challenges in family ⊕ pwn:control-flow ✕ clear · browse all techniques

Challenge	CTF	Weight	Category	Has
start #rop	HITCON 2017 Quals	69.38	Misc	files wu 3
two #one-gadget	HITCON 2017 Quals	69.38	Misc	files wu 1
secure_keymanager #double-free #fastbin-dup #format-string #got-overwrite	SECCON 2017 Quals	30.00	Misc	files wu 3
runway1 #stack-overflow #ret2win	BuckeyeCTF 2024	50.91	Pwn	files wu 1
runway2 #stack-overflow #ret2win	BuckeyeCTF 2024	50.91	Pwn	files wu 1
runway3 #format-string-leak #canary-bypass #ret2win	BuckeyeCTF 2024	50.91	Pwn	files wu 1
Symmetry_3 #rop-chain	KalmarCTF 2024	24.21	Pwn	files wu 1
logbook #format-string #got-overwrite	CyberSecurityRumble 2023 Quals	24.80	Pwn	files wu 1
Sentence_To_Hell #format-string #write-what-where #got-overwrite	DanteCTF 2023	24.44	Pwn	files wu 1
Cooldown #ret2libc	Hayyim 2022	25.00	Pwn	files wu 2
Warmup #ret2libc	Hayyim 2022	25.00	Pwn	files wu 2
pcg #oob-index #stack-buffer-overflow #ret2libc #custom-image-parser	pingCTF 2022	24.29	Pwn	files wu 1
echo #srop #sigreturn-oriented-programming	0x41414141 2021	–	Pwn	files wu 3
external #syscall-rop #got-overwrite	0x41414141 2021	–	Pwn	files wu 3
moving-signals #srop #buffer-overflow	0x41414141 2021	–	Pwn	files wu 3
telnet #arm #sql-injection #rop-ret2libc	3kCTF 2021	24.14	Pwn	files wu 1
Ropme #rop	BSidesSF 2021	23.94	Pwn	files wu 1
orxw #rop #seccomp-orw #open-read-write	Balsn 2021	37.00	Pwn	files wu 1
ret4win #ret2win	BuckeyeCTF 2021	24.81	Pwn	files wu 2
getstat #stack-buffer-overflow #negative-size #float-encoded-address #ret2win	CyberSecurityRumble 2021	41.60	Pwn	files wu 1
Baby_bof #stack-buffer-overflow #ret2libc #got-leak	DCTF 2021	–	Pwn	files wu 3
Hotel_ROP #stack-buffer-overflow #ret2libc #pie	DCTF 2021	–	Pwn	files wu 3
Just_another_heap #heap #null-pointer-write #write-what-where #got-overwrite	DCTF 2021	–	Pwn	files wu 1
Magic_trick #write-what-where #got-overwrite	DCTF 2021	–	Pwn	files wu 3
Pwn_sanity_check #stack-buffer-overflow #ret2win	DCTF 2021	–	Pwn	files wu 3
Nim #got-overwrite	Dragon 2021	99.33	Pwn	files wu 1
easy_kernel #kernel-rop	K3RN3LCTF 2021	24.37	Pwn	files wu 1
Jump_King #ret2win	MetaRed 2021	–	Pwn	files wu 1
Numerology #stack-pivot	MetaRed 2021	–	Pwn	files wu 2
framed #uninitialized-stack-variable #partial-overwrite #ret2win	OMH 2021	–	Pwn	files wu 1
my_little_pwnie #format-string #return-address-overwrite #one-gadget	OMH 2021	–	Pwn	files wu 1
fmtstr #format-string #got-overwrite #libc-leak	PBjar 2021	23.18	Pwn	files wu 1
heapnot #stack-buffer-overflow #rop #mprotect #reverse-shell-shellcode	PBjar 2021	23.18	Pwn	files wu 1
imdeghost #srop #seccomp #sigreturn-chain	PBjar 2021	23.18	Pwn	files wu 2
ret2libc #ret2libc #rop #libc-leak	PBjar 2021	23.18	Pwn	files wu 1
wallstreet32 #blind-format-string #format-string #one-gadget	PBjar 2021	23.18	Pwn	files wu 1
Not_That_Simple #shellcode #getdents #stack-pivot	RaRCTF 2021	24.53	Pwn	files wu 2
The_Mound #custom-heap #double-free #arbitrary-write #got-overwrite	RaRCTF 2021	24.53	Pwn	files wu 1
boring-flag-runner #custom-vm #stack-overwrite #one-gadget	RaRCTF 2021	24.53	Pwn	files wu 1
ret2winRaRs #stack-buffer-overflow #ret2win	RaRCTF 2021	24.53	Pwn	files wu 3

Challenges