0xmrerror@terminal:~$ls -lt ./writeups 14 entries
Writeups — writeups
Every box I solved, written the way I actually solved it — the dead ends included. Ordered hardest first; filter by type, difficulty or platform.
01.
Easy as GDB — Scripted Character-by-Character Brute Force
The flag is validated one character at a time, so automate it: script GDB to brute-force the key space inside a single session.
02.
Keygenme — MD5 Hex Spliced Into a License Key
The binary assembles the full 36-character key on the stack out of two MD5 digests — so the lazy solve is to break in and read it out.
03.
JITFP — Reading a Flag That Only Exists in Live Memory
The function-pointer table is empty on disk and filled at runtime by a ptrace service, so read RDX at the call instead of the table.
04.
Mr Robot CTF — WordPress to Root
A WordPress blog with a leaked wordlist, weak credentials and a hidden base64 login — a four-stage chain from recon to root.
05.
WWBuddy — SQLi to Env-Var Privesc
A half-built 'make friends' site with SQLi in the signup flow, and an environment-variable leak that turns a web foothold into sudo.
06.
Broker — MQTT Eavesdrop to Webshell
An exposed ActiveMQ/MQTT broker lets anyone subscribe to every sensor on the network — then a webshell upgrade path to root.
07.
Watcher — LFI to Root in 7 Flags
A boot2root with a long linear chain: LFI becomes a webshell, a writable service binary becomes root. Seven flags along the way.
08.
Fortress — SHA-1 Collision to Root
Story-driven decompilation: Python bytecode leaks credentials, a telnet service hands over a client binary, a hash chain ends at root.
09.
Umbrella — Registry Loot to SUID Bash
An open Docker registry leaks database secrets, MySQL credentials unlock the source, and a writable PATH entry hands over SUID bash.
10.
Super Secret Tip — Jinja SSTI to curl -K Root
Jinja SSTI in a password-protected Werkzeug debugger chains into a planted curl config file — and curl -K becomes root.
11.
Smol — WP Plugin SSRF to sudo Bash
A legacy WordPress plugin with a pile of CVEs, a poisoned Hello-Dolly backdoor, and an SSRF that reaches straight into the sudoers file.
12.
WinAntiDbg0x200 — Three Anti-Debug Checks
Three stacked anti-debug checks — PEB flag, timing and NtQueryInformationProcess — reversed live in GDB to recover the flag.
13.
WinAntiDbg0x300 — UPX, a Watchdog, and an Infinite Loop
UPX unpacking, a child-process watchdog and an infinite loop that never actually exits. A full GDB walkthrough.
14.
Binary Instrumentation 2 — Intercepting File Writes With Frida
picoCTF 2025 · 300 pts. Hook the file-write API with Frida and rewrite the payload before it ever touches disk.
05.
WWBuddy — SQLi to Env-Var Privesc
A half-built 'make friends' site with SQLi in the signup flow, and an environment-variable leak that turns a web foothold into sudo.
06.
Broker — MQTT Eavesdrop to Webshell
An exposed ActiveMQ/MQTT broker lets anyone subscribe to every sensor on the network — then a webshell upgrade path to root.
07.
Watcher — LFI to Root in 7 Flags
A boot2root with a long linear chain: LFI becomes a webshell, a writable service binary becomes root. Seven flags along the way.
08.
Fortress — SHA-1 Collision to Root
Story-driven decompilation: Python bytecode leaks credentials, a telnet service hands over a client binary, a hash chain ends at root.
09.
Umbrella — Registry Loot to SUID Bash
An open Docker registry leaks database secrets, MySQL credentials unlock the source, and a writable PATH entry hands over SUID bash.
10.
Super Secret Tip — Jinja SSTI to curl -K Root
Jinja SSTI in a password-protected Werkzeug debugger chains into a planted curl config file — and curl -K becomes root.
11.
Smol — WP Plugin SSRF to sudo Bash
A legacy WordPress plugin with a pile of CVEs, a poisoned Hello-Dolly backdoor, and an SSRF that reaches straight into the sudoers file.
12.
WinAntiDbg0x200 — Three Anti-Debug Checks
Three stacked anti-debug checks — PEB flag, timing and NtQueryInformationProcess — reversed live in GDB to recover the flag.
13.
WinAntiDbg0x300 — UPX, a Watchdog, and an Infinite Loop
UPX unpacking, a child-process watchdog and an infinite loop that never actually exits. A full GDB walkthrough.
14.
Binary Instrumentation 2 — Intercepting File Writes With Frida
picoCTF 2025 · 300 pts. Hook the file-write API with Frida and rewrite the payload before it ever touches disk.