Ctf pwn

CTF Binary Exploitation (Pwn)

Quick reference for binary exploitation (pwn) CTF challenges. Each technique has a one-liner here; see supporting files for full details.

Additional Resources

• overflow-basics.md — stack/global overflow, canary bypass, ret2win
• rop-and-shellcode.md — ret2libc, ret2csu, syscall ROP, exotic gadgets
• rop-advanced.md — SROP, RETF arch-switch, .fini_array, ret2vdso, stack pivot
• format-string.md — fmt leaks, GOT/hook overwrite, blind fmt, argv[0] tricks
• advanced.md — heap/UAF classics (House of Orange/Spirit/Lore), ret2dlresolve, JIT
• advanced-2.md — 2024-26: House of Apple 2 (glibc 2.34+), House of Einherjar, musl meta-pointer
• advanced-exploits.md — 2024 era: GC UAF, VM bugs, FSOP+seccomp, custom sandboxes
• advanced-exploits-2.md — 2024-early-2025: io_uring SQE inj, TLS dtor, MOP, corphone
• advanced-exploits-3.md — 2025-2026: vkfs FS, MIPS $gp, alloca, ObjC, ARM64 PAC, cmp timing
• sandbox-escape.md — custom VM, FUSE/CUSE, busybox/restricted shell
• heap-leakless.md — glibc 2.32-2.39+ leakless (Rust/Water/Tangerine/Corrosion)
• kernel.md — Linux kernel fundamentals, QEMU debug, spray structures
• kernel-techniques.md — tty_struct kROP, SLUB internals, userfaultfd, DiceCTF 2026
• kernel-bypass.md — KASLR/FGKASLR, KPTI, SMEP/SMAP, exploit delivery
• kernel-advanced.md — EntryBleed, SLUBStick, DirtyCred, folly page-aliasing
• brop.md — Blind ROP full chain without binary access
• browser-jit.md — V8/SpiderMonkey/JSC JIT type-confusion, sandbox bypass, OSR-exit
• rust-pwn.md — Rust unwind drop, transmute, set_len uninit, async state confusion

---

Pattern Recognition Index

Map observable signals (not challenge names) to the right technique. Scan this first when you're handed a binary and a remote.

Signal observed in binary / source	Technique → file
checksec: NX but no canary, stack buffer + read/gets	Plain stack overflow → overflow-basics.md
Canary + forking server (pre-fork accept loop)	Byte-by-byte canary brute-force → overflow-basics.md
int/ssize_t length → read(fd, buf, len) with only len > MAX check	Signed→size_t confusion → advanced-exploits-2.md
printf(user_ptr) with no format string	Format-string leak + GOT overwrite → format-string.md
glibc 2.32+ tcache with Safe-Linking; no leaks possible	House of Rust / Water → heap-leakless.md
glibc 2.39+, no free() primitive exposed	House of Tangerine (malloc-only AAW) → heap-leakless.md
mmap(MAP_FIXED) exposed with controllable addr, prot	MOP — libc code-page zeroing → advanced-exploits-3.md
Fork/clone + tiny shared-mem handshake validating input char-by-char	strace byte-count side-channel → advanced-exploits-2.md
Kernel chall, unpriv userns, splice()/vmsplice() + large kmalloc free	Pipe-backed folio_put page-UAF → advanced-exploits-3.md
Container with custom bind-mounts on /dev, /proc under runc ≤ 1.1.x	runc 2025 symlink-race escape → advanced-exploits-3.md
Unicorn/QEMU sandbox with host-side helper reads	Host/guest hook divergence → advanced-exploits-3.md
Kernel io_uring SQE reachable via UAF / type confusion	io_uring worker abuse → kernel-advanced.md, advanced-exploits-2.md
KASLR + Linux ≥ 5.8 + prefetch available	EntryBleed → kernel-advanced.md
Windows driver IOCTL + NT kernel	PreviousMode / token stealing → kernel-advanced.md, advanced-exploits-2.md
No binary given, remote only, forking server with long timeout	Blind ROP (BROP) → brop.md
seccomp filter blocking execve, open/read/write allowed	ORW ROP → rop-and-shellcode.md, rop-advanced.md
MIPS ELF + overflow reachable + $gp loadable from writable region	$gp-pivot fake-GOT → advanced-exploits-3.md
Custom FS with (mip,x,y)-style path tuples + SHA256 hashing	Coord-indexed FS overflow → advanced-exploits-3.md
Format-string read + later FILE* UAF in same binary	FILE UAF + fstr bridge → advanced-exploits-3.md
pthread + user-controlled alloca(n) + shutdown(fd, SHUT_WR)	Cross-thread alloca smash + partial-close leak → advanced-exploits-3.md
libobjc linked + tcache-sized free followed by objc_msgSend	Isa-pointer UAF dispatch hijack → advanced-exploits-3.md
aarch64 kernel mod + paciza/autiza + IOCTL sizeof bound	ARM64 PAC-key exfil via bounds-mismatch AAR → advanced-exploits-3.md
seccomp kills write/socket + /usr/bin/cmp reachable + /flag readable	cmp timing oracle → advanced-exploits-3.md
C++ pwn with vtable dispatch + 0x110/0x480 chunk sizes	House of Spirit via C++ vtable → advanced-exploits.md
SPLICE_F_GIFT / MSG_ZEROCOPY / TCP_ZEROCOPY_RECEIVE in proxy	Zero-copy page aliasing TOCTOU → kernel-advanced.md
seccomp allows io_uring_* only, kernel ≥ 6.1	IORING_SETUP_NO_MMAP escape → sandbox-escape.md
Sandboxed proc can recv from helper via AF_UNIX	SCM_RIGHTS fd smuggling → sandbox-escape.md
setuid binary scrubs secret after read, coredumps reachable	Coredump race → sandbox-escape.md
Non-standard eBPF prog on kprobe, flag gated by global state	eBPF FSM syscall-sequence → sandbox-escape.md
Traefik ≤ 2.11.13 front + Flask/Node admin routes	X-Forwarded-* reach → polyglot chain → advanced-exploits-3.md
d8 / js / jsc binary + *.patch modifying JIT compiler sources	JIT type confusion → browser-jit.md
V8 build with v8_enable_sandbox=true; primitive only inside cage	ExternalPointerTable bypass → browser-jit.md
Turbofan typer patch touching Type::Range / Type::OtherNumber	Range-analysis type confusion → browser-jit.md
IonMonkey RangeAnalysis.cpp diff or JSC DFGSpeculativeJIT.cpp diff	OSR-exit / range bug → browser-jit.md
Rust panic caught + recovered with unsafe state between	Unwind-path Drop corruption → rust-pwn.md
mem::transmute / slice::from_raw_parts_mut on user-controlled len	Sliced-length OOB → rust-pwn.md
Vec::reserve(n) + set_len(n) without n writes	Uninitialised-drop vtable hijack → rust-pwn.md
as u32 / as usize on subtraction result in release build	Truncation overflow → rust-pwn.md
async fn with Pin<&mut Self> across .await + raw-ptr aliasing	Future state-machine confusion → rust-pwn.md
unprivileged_bpf_disabled=0 + kernel 5.13-6.5 + bpf_prog_load reachable	eBPF verifier pointer-arith bypass → kernel-advanced.md
BPF_MAP_TYPE_RINGBUF + kernel < 5.15	Ringbuf stale-byte KASLR leak → kernel-advanced.md

Recognize the mechanic first. The challenge title is never the signal.

---

For inline code/cheatsheet quick references (grep patterns, one-liners, common payloads), see quickref.md. The Pattern Recognition Index above is the dispatch table — always consult it first; load quickref.md only if you need a concrete snippet after dispatch.