pwnhard

Zagjail

tamuctf

Task: Zag language jail with regex-based static analyzer banning extern and pointer arithmetic. Solution: Bypass \b word boundary with parentheses (q)+N, bypass dereference check with *(expr), OOB stack read/write for ret2libc ROP chain.

$ ls tags/ techniques/
ret2libcropjail_escaperegex_bypasszagcustom_languagelibcstatic_analyzerword_boundary
regex_word_boundary_bypassparenthesized_expression_bypassoob_stack_read_writelibc_base_leakret2libc_rop_chain
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]