0xmrerror — writeups https://0xmrerror.me/ Reverse engineer, malware analyst and SOC automation engineer. ICT student at ENIT, top 1% on TryHackMe, 77th at HTB University CTF 2025. Open to internships. en Easy as GDB — Scripted Character-by-Character Brute Force https://0xmrerror.me/writeups/easy-as-gdb/ https://0xmrerror.me/writeups/easy-as-gdb/ The flag is validated one character at a time, so automate it: script GDB to brute-force the key space inside a single session. Reverse engineering Keygenme — MD5 Hex Spliced Into a License Key https://0xmrerror.me/writeups/keygenme/ https://0xmrerror.me/writeups/keygenme/ The binary assembles the full 36-character key on the stack out of two MD5 digests — so the lazy solve is to break in and read it out. Reverse engineering JITFP — Reading a Flag That Only Exists in Live Memory https://0xmrerror.me/writeups/jitfp/ https://0xmrerror.me/writeups/jitfp/ The function-pointer table is empty on disk and filled at runtime by a ptrace service, so read RDX at the call instead of the table. Reverse engineering Mr Robot CTF — WordPress to Root https://0xmrerror.me/writeups/mr-robot/ https://0xmrerror.me/writeups/mr-robot/ A WordPress blog with a leaked wordlist, weak credentials and a hidden base64 login — a four-stage chain from recon to root. Web WWBuddy — SQLi to Env-Var Privesc https://0xmrerror.me/writeups/ww-buddy/ https://0xmrerror.me/writeups/ww-buddy/ A half-built 'make friends' site with SQLi in the signup flow, and an environment-variable leak that turns a web foothold into sudo. Web Broker — MQTT Eavesdrop to Webshell https://0xmrerror.me/writeups/broker/ https://0xmrerror.me/writeups/broker/ An exposed ActiveMQ/MQTT broker lets anyone subscribe to every sensor on the network — then a webshell upgrade path to root. Web Watcher — LFI to Root in 7 Flags https://0xmrerror.me/writeups/watcher/ https://0xmrerror.me/writeups/watcher/ A boot2root with a long linear chain: LFI becomes a webshell, a writable service binary becomes root. Seven flags along the way. Web Fortress — SHA-1 Collision to Root https://0xmrerror.me/writeups/fortress/ https://0xmrerror.me/writeups/fortress/ Story-driven decompilation: Python bytecode leaks credentials, a telnet service hands over a client binary, a hash chain ends at root. Web Umbrella — Registry Loot to SUID Bash https://0xmrerror.me/writeups/umbrella/ https://0xmrerror.me/writeups/umbrella/ An open Docker registry leaks database secrets, MySQL credentials unlock the source, and a writable PATH entry hands over SUID bash. Web Super Secret Tip — Jinja SSTI to curl -K Root https://0xmrerror.me/writeups/super-secret-tip/ https://0xmrerror.me/writeups/super-secret-tip/ Jinja SSTI in a password-protected Werkzeug debugger chains into a planted curl config file — and curl -K becomes root. Web Smol — WP Plugin SSRF to sudo Bash https://0xmrerror.me/writeups/smol/ https://0xmrerror.me/writeups/smol/ A legacy WordPress plugin with a pile of CVEs, a poisoned Hello-Dolly backdoor, and an SSRF that reaches straight into the sudoers file. Web WinAntiDbg0x200 — Three Anti-Debug Checks https://0xmrerror.me/writeups/winantidbg0x200/ https://0xmrerror.me/writeups/winantidbg0x200/ Three stacked anti-debug checks — PEB flag, timing and NtQueryInformationProcess — reversed live in GDB to recover the flag. Reverse engineering WinAntiDbg0x300 — UPX, a Watchdog, and an Infinite Loop https://0xmrerror.me/writeups/winantidbg0x300/ https://0xmrerror.me/writeups/winantidbg0x300/ UPX unpacking, a child-process watchdog and an infinite loop that never actually exits. A full GDB walkthrough. Reverse engineering Binary Instrumentation 2 — Intercepting File Writes With Frida https://0xmrerror.me/writeups/binary-instrumentation-2/ https://0xmrerror.me/writeups/binary-instrumentation-2/ picoCTF 2025 · 300 pts. Hook the file-write API with Frida and rewrite the payload before it ever touches disk. Reverse engineering