VolgaCTF Quals 2025 – pwn/babuin2

Full chain challenge which has two parts: get userland code execution and then exploit a vulnerability within the custom piccall syscall handler!

Blackhat MEA CTF Final 2025 – pwn/stack-prelude

Forcing recv() to return early by sending urg tcp packet!

Blackhat MEA CTF Final 2025 – pwn/verifmt

Leaking stack via partial format strings %*N$

Buckeye 2025 – pwn/bashtille

Abused the server misconfiguration in the user-namespace mapping which gave us effective root inside the container to escape chroot by using a exploit that chroots inside the chroot to escape the jail.

Introduction to file struct exploitation: openECSC 2025 – pwn/exitnction

Exploiting file structs to execution using "_IO_wfile_seekoff" vtable

CTF@AC 2025 – pwn/babybof

Classic buffer overflow

CTF@AC 2025 – pwn/fini

Hijacking .fini_array for a shell

FortiD CTF 2025 – pwn/protect-the-environment

Abusing getenv() with repeated ROT13

WatCTF F25 – pwn/Hex Editor Xtended v2

Bypassing Path Checks by editing /proc/self/mem

WatCTF 2025 – pwn/intro2pwn

Classic Buffer Overflow

WatCTF 2025 – pwn/person-tracker

One Byte to Rule Them All