pwnProhard

Bottoms Up

miptctf

Custom stack-based VM with 32-bit stack pointer. POP has no underflow check, allowing 2^32 wraparound to write past stack bounds. Exploit leaks PIE/libc, bypasses canary by skipping check, builds ROP chain for system("/bin/sh").

$ ls tags/ techniques/
integer_overflowret2libcpie_bypassropcustom_vmcanary_bypasslibc_identificationstack_underflow32bit_wraparound
pie_leakvm_stack_underflow32bit_integer_wraparoundrop_chain_constructionlibc_leakcanary_bypass_via_return_skip
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups

  • [pwn][free]Regularity— hackthebox
  • [pwn][Pro]login— volgactf
  • [pwn][free]Portaloo— hackthebox
  • [pwn][free]Void— hackthebox
  • [pwn][free]Evil Corp— hackthebox