<- HTB CHALLENGES

Pwn - Total: 58

Ancient Interface
CTF

Ancient Interface

64-bit binary. Buffer Overflow. ret2libc
Fake Snake
CTF

Fake Snake

Python internals. Fake object primitive
Dead or Alive
CTF

Dead or Alive

64-bit binary. Heap exploitation. House of Spirit. Heap feng-shui. Overlapping chunks. Tcache poisoning. TLS-storage dtor_list
Sick ROP
CTF

Sick ROP

64-bit static binary. Buffer Overflow. SROP and sys_mprotect
Picture Magic
CTF

Picture Magic

64-bit binary. Heap exploitation. Heap feng shui. House of Einherjar. Format String vulnerability
Regularity
CTF

Regularity

64-bit binary. Buffer Overflow. ret2reg. Shellcode
Hunting
CTF

Hunting

32-bit binary. Egg Hunter
Pixel Audio
CTF

Pixel Audio

64-bit binary. Format String vulnerability. Local variable modification
Oxidized ROP
CTF

Oxidized ROP

64-bit binary. Rust. Buffer Overflow. Unicode characters. Local variable modification
Nowhere to go
CTF

Nowhere to go

64-bit binary. Buffer Overflow. vDSO ROP. sys_execve. seccomp rules
Lesson
CTF

Lesson

Questions about binary exploitation
Kernel Adventures: Part 1
CTF

Kernel Adventures: Part 1

Kernel exploitation. Password hash cracking. Race condition. Double Fetch
Maze of Mist
CTF

Maze of Mist

32-bit binary. Buffer Overflow. vDSO ROP. sys_execve
Sound of Silence
CTF

Sound of Silence

64-bit binary. Glibc 2.35. Buffer Overflow. ROP
Dragon Army
CTF

Dragon Army

64-bit binary. Heap exploitation. Fast Bin dup. Messing with main_arena
Antidote
CTF

Antidote

ARM 32-bit binary. Buffer Overflow. ret2csu. ret2libc
Zombiedote
CTF

Zombiedote

64-bit binary. Heap exploitation. OOB read and write. Integer Overflow. Floating point numbers. TLS-storage dtor_list
Zombienator
CTF

Zombienator

64-bit binary. Heap exploitation. Buffer Overflow. Floating point numbers. Canary bypass. ret2libc. Oracle
Great Old Talisman
CTF

Great Old Talisman

64-bit binary. Partial GOT overwrite. OOB write
Auth-or-out
CTF

Auth-or-out

64-bit binary. Heap exploitation. Integer overflow. Heap overflow. ret2libc
knote
CTF

knote

Kernel exploitation. Heap exploitation. seq_operations. ret2user
echoland
CTF

echoland

64-bit binary. Blind Format String. Buffer Overflow. ret2libc
Robot Factory
CTF

Robot Factory

64-bit binary. Buffer Overflow. Threads. Canary bypass. ret2libc
Bon-nie-appetit
CTF

Bon-nie-appetit

64-bit binary. Heap exploitation. Off-by-one. Overlapping chunks. Tcache poisoning
Dream Diary: Chapter 3
CTF

Dream Diary: Chapter 3

64-bit binary. Heap exploitation. House of Einherjar. Overlapping chunks. Tcache poisoning. ROP chain. seccomp rules
Getting Started
CTF

Getting Started

Buffer Overflow
Questionnaire
CTF

Questionnaire

Questions about binary exploitation
FileStorage
CTF

FileStorage

64-bit binary. Buffer Overflow. Format String vulnerability. FILE structure attack. GOT overwrite
Math Door
CTF

Math Door

64-bit binary. Heap exploitation. Heap feng shui. Tcache poisoning. FILE structure attack
Control Room
CTF

Control Room

64-bit binary. OOB. GOT overwrite
Void
CTF

Void

64-bit binary. Buffer Overflow. ret2dlresolve
Hellhound
CTF

Hellhound

64-bit binary. Heap exploitation. House of Spirit
Old Bridge
CTF

Old Bridge

64-bit binary. Buffer Overflow. Brute force. Stack Pivot. ret2libc
Trick or Deal
CTF

Trick or Deal

64-bit binary. Heap exploitation. Use After Free
Space
CTF

Space

32-bit binary. Buffer Overflow. Custom shellcode
Spellbook
CTF

Spellbook

64-bit binary. Heap exploitation. Use After Free. Fast Bin attack
Sacred Scrolls: Revenge
CTF

Sacred Scrolls: Revenge

64-bit binary. Buffer Overflow. ret2libc
Optimistic
CTF

Optimistic

64-bit binary. Buffer Overflow. Integer Overflow. Alphanumeric shellcode
PwnShop
CTF

PwnShop

64-bit binary. Buffer Overflow. PIE and ASLR bypass. Special ROP chain. ret2libc
Shooting star
CTF

Shooting star

64-bit binary. Buffer Overflow. ret2libc
CRSid
CTF

CRSid

64-bit binary. Heap exploitation. Safe-linking. Out-of-bounds write. Tcache poisoning. Exit handlers
Finale
CTF

Finale

64-bit binary. Buffer Overflow. open-read-write ROP chain
Spooky Time
CTF

Spooky Time

64-bit binary. Format String vulnerability. GOT overwrite
Entity
CTF

Entity

64-bit binary. union structure. Type confusion
Nightmare
CTF

Nightmare

64-bit binary. Format String vulnerability. GOT overwrite
Space pirate: Retribution
CTF

Space pirate: Retribution

64-bit binary. Buffer Overflow. ret2libc. Bypass PIE and ASLR
No Return
CTF

No Return

64-bit static binary. JOP. sys_rt_sigreturn and sys_execve
Bat Computer
CTF

Bat Computer

64-bit binary. Buffer Overflow. Shellcode
Format
CTF

Format

64-bit binary. Format String vulnerability
Leet Test
CTF

Leet Test

64-bit binary. Format String vulnerability
HTB Console
CTF

HTB Console

64-bit binary. Buffer Overflow. ret2libc
Blacksmith
CTF

Blacksmith

64-bit binary. seccomp rules. open-read-write shellcode
Fleet Management
CTF

Fleet Management

64-bit binary. seccomp rules. Custom shellcode
Jeeves
CTF

Jeeves

64-bit binary. Buffer Overflow. Local variable modification
Reg
CTF

Reg

64-bit binary. Buffer Overflow. Redirecting program execution
Vault-breaker
CTF

Vault-breaker

64-bit binary. Bug abuse. XOR cipher
Space pirate: Going Deeper
CTF

Space pirate: Going Deeper

64-bit binary. Buffer Overflow. Redirecting program execution
Space pirate: Entrypoint
CTF

Space pirate: Entrypoint

64-bit binary. Format String vulnerability. Local variable modification