<- HTB CHALLENGES

Pwn - Total: 58

Ancient Interface
CTF

Ancient Interface

64-bit binary. Buffer Overflow. ret2libc
Fake Snake
CTF

Fake Snake

Python internals. Fake object primitive
Dead or Alive
CTF

Dead or Alive

64-bit binary. Heap exploitation. House of Spirit. Heap feng-shui. Overlapping chunks. Tcache poisoning. TLS-storage dtor_list
Sick ROP
CTF

Sick ROP

64-bit static binary. Buffer Overflow. SROP and sys_mprotect
Picture Magic
CTF

Picture Magic

64-bit binary. Heap exploitation. Heap feng shui. House of Einherjar. Format String vulnerability
Regularity
CTF

Regularity

64-bit binary. Buffer Overflow. ret2reg. Shellcode
Hunting
CTF

Hunting

32-bit binary. Egg Hunter
Pixel Audio
CTF

Pixel Audio

64-bit binary. Format String vulnerability. Local variable modification
Oxidized ROP
CTF

Oxidized ROP

64-bit binary. Rust. Buffer Overflow. Unicode characters. Local variable modification
Nowhere to go
CTF

Nowhere to go

64-bit binary. Buffer Overflow. vDSO ROP. sys_execve. seccomp rules
Lesson
CTF

Lesson

Questions about binary exploitation
Kernel Adventures: Part 1
CTF

Kernel Adventures: Part 1

Kernel exploitation. Password hash cracking. Race condition. Double Fetch
Maze of Mist
CTF

Maze of Mist

32-bit binary. Buffer Overflow. vDSO ROP. sys_execve
Sound of Silence
CTF

Sound of Silence

64-bit binary. Glibc 2.35. Buffer Overflow. ROP
Dragon Army
CTF

Dragon Army

64-bit binary. Heap exploitation. Fast Bin dup. Messing with main_arena
Antidote
CTF

Antidote

ARM 32-bit binary. Buffer Overflow. ret2csu. ret2libc
Zombiedote
CTF

Zombiedote

64-bit binary. Heap exploitation. OOB read and write. Integer Overflow. Floating point numbers. TLS-storage dtor_list
Zombienator
CTF

Zombienator

64-bit binary. Heap exploitation. Buffer Overflow. Floating point numbers. Canary bypass. ret2libc. Oracle
Great Old Talisman
CTF

Great Old Talisman

64-bit binary. Partial GOT overwrite. OOB write
Auth-or-out
CTF

Auth-or-out

64-bit binary. Heap exploitation. Integer overflow. Heap overflow. ret2libc
knote
CTF

knote

Kernel exploitation. Heap exploitation. seq_operations. ret2user
echoland
CTF

echoland

64-bit binary. Blind Format String. Buffer Overflow. ret2libc
Robot Factory
CTF

Robot Factory

64-bit binary. Buffer Overflow. Threads. Canary bypass. ret2libc
Bon-nie-appetit
CTF

Bon-nie-appetit

64-bit binary. Heap exploitation. Off-by-one. Overlapping chunks. Tcache poisoning
Dream Diary: Chapter 3
CTF

Dream Diary: Chapter 3

64-bit binary. Heap exploitation. Null-byte poison. Overlapping chunks. Tcache poisoning. ROP chain. seccomp rules
Getting Started
CTF

Getting Started

Buffer Overflow
Questionnaire
CTF

Questionnaire

Questions about binary exploitation
FileStorage
CTF

FileStorage

64-bit binary. Buffer Overflow. Format String vulnerability. FILE structure attack. GOT overwrite
Math Door
CTF

Math Door

64-bit binary. Heap exploitation. Heap feng shui. Tcache poisoning. FILE structure attack
Control Room
CTF

Control Room

64-bit binary. OOB. GOT overwrite
Void
CTF

Void

64-bit binary. Buffer Overflow. ret2dlresolve
Hellhound
CTF

Hellhound

64-bit binary. Heap exploitation. House of Spirit
Old Bridge
CTF

Old Bridge

64-bit binary. Buffer Overflow. Brute force. Stack Pivot. ret2libc
Trick or Deal
CTF

Trick or Deal

64-bit binary. Heap exploitation. Use After Free
Space
CTF

Space

32-bit binary. Buffer Overflow. Custom shellcode
Spellbook
CTF

Spellbook

64-bit binary. Heap exploitation. Use After Free. Fast Bin attack
Sacred Scrolls: Revenge
CTF

Sacred Scrolls: Revenge

64-bit binary. Buffer Overflow. ret2libc
Optimistic
CTF

Optimistic

64-bit binary. Buffer Overflow. Integer Overflow. Alphanumeric shellcode
PwnShop
CTF

PwnShop

64-bit binary. Buffer Overflow. PIE and ASLR bypass. Special ROP chain. ret2libc
Shooting star
CTF

Shooting star

64-bit binary. Buffer Overflow. ret2libc
CRSid
CTF

CRSid

64-bit binary. Heap exploitation. Safe-linking. Out-of-bounds write. Tcache poisoning. Exit handlers
Finale
CTF

Finale

64-bit binary. Buffer Overflow. open-read-write ROP chain
Spooky Time
CTF

Spooky Time

64-bit binary. Format String vulnerability. GOT overwrite
Entity
CTF

Entity

64-bit binary. union structure. Type confusion
Nightmare
CTF

Nightmare

64-bit binary. Format String vulnerability. GOT overwrite
Space pirate: Retribution
CTF

Space pirate: Retribution

64-bit binary. Buffer Overflow. ret2libc. Bypass PIE and ASLR
No Return
CTF

No Return

64-bit static binary. JOP. sys_rt_sigreturn and sys_execve
Bat Computer
CTF

Bat Computer

64-bit binary. Buffer Overflow. Shellcode
Format
CTF

Format

64-bit binary. Format String vulnerability
Leet Test
CTF

Leet Test

64-bit binary. Format String vulnerability
HTB Console
CTF

HTB Console

64-bit binary. Buffer Overflow. ret2libc
Blacksmith
CTF

Blacksmith

64-bit binary. seccomp rules. open-read-write shellcode
Fleet Management
CTF

Fleet Management

64-bit binary. seccomp rules. Custom shellcode
Jeeves
CTF

Jeeves

64-bit binary. Buffer Overflow. Local variable modification
Reg
CTF

Reg

64-bit binary. Buffer Overflow. Redirecting program execution
Vault-breaker
CTF

Vault-breaker

64-bit binary. Bug abuse. XOR cipher
Space pirate: Going Deeper
CTF

Space pirate: Going Deeper

64-bit binary. Buffer Overflow. Redirecting program execution
Space pirate: Entrypoint
CTF

Space pirate: Entrypoint

64-bit binary. Format String vulnerability. Local variable modification