Hey there, I'm Sean and I enjoy doing CTF problems in my spare time. My current position has me doing a lot of binary exploitation and software reverse engineering so I tend to focus on those categories. Most writeups that I see online suck and I hope these do a better job explaining some of the fundamental concepts.
In all of my solutions I try my best to include a reproducible solution written with pwntools. It's not about the flags, but about the journey that got us the flag.
Hopefully this doesn't age like milk, but I've also tried to do some video walkthroughs of some of these CTF problems. You can view them on YouTube.
The following is a list of common Unix Access topics and the CTF challenges that relate to them.
- Write working shellcode from scratch and show all steps to write the shellcode:
- Stack buffer overflow with and without the following mitigations: address space layout randomization (ASLR), Non-eXecutable memory (NX), and stack canaries:
- Heap buffer overflow using heap grooming and objects with function pointers:
- Heap buffer overflow by corrupting heap data structures:
- UAF with objects containing function pointers:
- UAF with objects that allow an arbitrary read/write primitive:
- Data type confusion vulnerabilities
- Format string vulnerabilities for arbitrary read/write primitive:
- How uninitialized variables can be used for exploitation:
- Arbitrary write primitive:
- Relative write primitive:
- Arbitrary read primitive:
- How primitives can be chained to build an exploit
- How a write primitive can be used to escalate privileges/execute arbitrary code:
Describe the purpose and structure of the following ELF linking structures and how they can be abused in binary exploitation
Describe the following dynamic relocation modes in terms of PLT/GOT data structure interaction, and how exploitation primitives differ between them
- Find ROP/JOP gadgets:
- Call libc functions and system calls:
- Chain gadgets to execute code:
- Execute arbitrary shellcode
- ASLR
- Data Execution Prevention (DEP)/NX:
- Position Independent Executables (PIEs)
- How PIEs affect exploitation
- Stack canaries:
- Safe list unlinking
- Static reverse engineering:
- Dynamic reverse engineering:
Demonstrate familiarity in using the following types of tools to perform static and dynamic reverse engineering
- Static disassemblers
- Debuggers
- Automation techniques using above tools
- Dumb fuzzing techniques
- Code-coverage based fuzzing
- Symbolic execution
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent