Challenge Overview The challenge was presented as a game to be played over the internet. Players could access the game and play a command line version of minesweeper by connecting to a port on the game server. The ultimate object however was the retrieval of a flag placed in the
Note: This is all written for Python 2.7.3. These details might be different in other versions of Python - especially 3+! Attempting to escape a sandbox is always a fun challenge. Python sandboxes are no exception. In a static language, this is usually done by analyzing the code
This time around, I'd written a challenge for CSAW CTF. There were 32 challenges, in all sorts of topics such as Web, Reversing, Exploitation, etc. The challenge I wrote was the 300 point Web challenge, HorseForce. Walkthrough From the start, you're given an account to this
So word spread pretty quickly about the wireshark bugs being thrown around Defcon 20 CTF. After I got my hands on acme pharms packet capture I quickly set out to recover the evil packets and weaponize them :) After unpacking the tarball I found a pcap file that crashed my Wireshark(
As a University research lab, we often have students who are not familiar with concepts that the professional security community finds second nature. Something that I have to explain to new students very often is the concept of Endianness. A concept that reverse engineers and low-level programmers deal with on
On Febuary 22nd, the Stripe company ran a straightforward 6 level CTF. The first level provides a single setuid binary and corresponding source and the task of obtaining the flag (a password to another user's account) from a text file (/home/level02/.password) owned and only viewable by
Being provided a txt file titled "long.txt" with the challenge title of "Count them all", and the description "One important aspect of an inventory is to count all the swords you've got. Count them all." was the premise for a challenge
If you’ve attempt to write an SEH Record exploit, you know that it could be a little time consuming to find a pop pop ret instruction sequence inside a module that has SafeSEH off. This is because first you’d need to find which modules, if any, has SafeSEH
Not all applications on the Android market can be installed by all Android devices. More specifically, each Android device only allows the user to choose from the subset of applications that are considered suitable to be installed on that device. For example, if you visit the Android Market with your
The Key Is superline. (Image taken down; http://blackbox.sibears.ru/uploads/6/school-ctf-2011-files/deadlamps.gif) Hey guys here is a quick writeup on the Deadlamps challenge from SchoolCTF The gif above is a simple leftbound scrolling text across a figurative set of lamps No real context is give for
In this challenge we are tasked to solve a simple sudoku like puzzle and derive the key from the given information By noticing a few key squares such as the 16, 3's and 5, we can put together a solution to the puzzle rather quickly . r1=6 r2=
The challenge "You just love this thing, right?" gives you a GNU/Linux EFL binary called "mazzze" (that's contained within a gzip file called "mazzze.gz"). 'mazzze' is an ASCII game in which you must go through a 'maze&
