Binary exploitation, vulnerability research and CTF writeups.https://d4ytox.com/enSun, 23 Aug 2026 00:00:00 GMThttps://d4ytox.com/writeups/ctf/brunnerctf-2026/aptitude-test/https://d4ytox.com/writeups/ctf/brunnerctf-2026/aptitude-test/Reversing the score file cipher, working out the plaintext layout and spawn generation, then using the submission server itself as an oracle to land a score over 9000 without tripping the anti-cheat.Sun, 23 Aug 2026 00:00:00 GMTcipheroracleanti-cheatwindowshttps://d4ytox.com/writeups/ctf/brunnerctf-2026/brunner-stocks/https://d4ytox.com/writeups/ctf/brunnerctf-2026/brunner-stocks/The stack is executable and a gadget has been left in place, so the overflow in askf turns straight into shellcode execution rather than needing a ROP chain.Sun, 23 Aug 2026 00:00:00 GMTshellcodestack-executionbuffer-overflowhttps://d4ytox.com/writeups/ctf/brunnerctf-2026/guessing-game/https://d4ytox.com/writeups/ctf/brunnerctf-2026/guessing-game/An unbounded OOB read leaks through a popcount side channel, and a saved-RBP overwrite gives a stack pivot. Combining them the obvious way dead-ends; the way out is to aim the pivot back into the program's own loop rather than at a one_gadget.Sun, 23 Aug 2026 00:00:00 GMTstack-pivotoob-readside-channelgot-overwriteglibchttps://d4ytox.com/writeups/ctf/brunnerctf-2026/locked-out/https://d4ytox.com/writeups/ctf/brunnerctf-2026/locked-out/A format string at %9$p leaks the stack canary, and a limited attempt budget forces a single-byte partial overwrite rather than a full return address rewrite.Sun, 23 Aug 2026 00:00:00 GMTformat-stringcanary-leakpartial-overwritehttps://d4ytox.com/writeups/ctf/brunnerctf-2026/mindbreaker/https://d4ytox.com/writeups/ctf/brunnerctf-2026/mindbreaker/Pwning LEGO MINDSTORMS EV3 firmware under qemu-arm in a chroot. opSYSTEM is compiled into the lms2012 VM, the flag is mode 000, and the output channel is a 178x128 screen.Sun, 23 Aug 2026 00:00:00 GMTembeddedarmlego-ev3sandbox-escapefirmwarehttps://d4ytox.com/writeups/ctf/brunnerctf-2026/pure-notes/https://d4ytox.com/writeups/ctf/brunnerctf-2026/pure-notes/A Haskell notes program with a use-after-free: delete frees the buffer but keeps the record. Defeating tcache safe-linking and the double-free check turns that into a read of the flag pointer left on the banner.Sun, 23 Aug 2026 00:00:00 GMTheaptcachesafe-linkinguse-after-freehaskellhttps://d4ytox.com/writeups/ctf/brunnerctf-2026/three-ways/https://d4ytox.com/writeups/ctf/brunnerctf-2026/three-ways/A three-stage supply chain compromise. A fork PR reaches Drone's exec runner, CI secrets fall out of the build log past a redaction filter, and the last flag sits in a superseded package version that the registry still serves.Sun, 23 Aug 2026 00:00:00 GMTsupply-chainci-cdgiteadronesecretshttps://d4ytox.com/writeups/ctf/brunnerctf-2026/wordpressed-to-root/https://d4ytox.com/writeups/ctf/brunnerctf-2026/wordpressed-to-root/Two CVEs, one root. An unauthenticated chain gets www-data, then CVE-2025-32463 (\"chwoot\") takes it to uid=0. Neither bug is in the custom theme, which is where the challenge wants you to look.Sun, 23 Aug 2026 00:00:00 GMTwordpresscverceprivescsudo