Tagged
#ctf
3 posts
A Remote Pwn Target
Turning the toy kernel into a real remote CTF: a unique flag that lives only in one server's RAM, and the far harder half — building a blast chamber where strangers can detonate exploits at me without taking the house down. The bug was an afternoon; the isolation was the month.
ReadA CTF Against My Own Kernel
I proved my toy filesystem would leak a hidden flag if you handed it a forged disk image — then turned that private, one-shot proof into a browser CTF you can play. Here's the bug, and the delivery engineering it took to let anyone throw the switch.
ReadAttacking the Lies About Disk Layout
A flag hidden in the RAM disk with no name, a crafted directory entry that reads it right out, and the one-field fix that turns 'in the image' into 'in the data.' A bounds check is only as trustworthy as the bound it compares against.
Read