d4ytox
binary exploitation · vulnerability research · penetration testing
Recent
aptitude-testBrunnerCTF 2026
Reversing the score file cipher, working out the plaintext layout and spawn generation, then using the submission server itself as an oracle to land a score over 9000 without tripping the anti-cheat.
brunner-stocksBrunnerCTF 2026
The stack is executable and a gadget has been left in place, so the overflow in askf turns straight into shellcode execution rather than needing a ROP chain.
guessing-gameBrunnerCTF 2026
An unbounded OOB read leaks through a popcount side channel, and a saved RBP overwrite gives a stack pivot. Combining them the obvious way dead-ends - the way out is to aim the pivot back into the program's own loop rather than at a one_gadget.
locked-outBrunnerCTF 2026
A format string at %9$p leaks the stack canary, and a limited attempt budget forces a single-byte partial overwrite rather than a full return address rewrite.
mindbreakerBrunnerCTF 2026
Pwning LEGO MINDSTORMS EV3 firmware under qemu-arm in a chroot. opSYSTEM is compiled into the lms2012 VM, the flag is mode 000, and the output channel is a 178x128 screen.