Binary exploitation & CTF — stack smashing, DEP/NX & ASLR bypasses, ret2libc, stack canaries, shellcode and more. Browse by category →
A detailed lab note on turning Prototype Pollution into code execution through Pug's AST/code-generation path: vulnerable merge, prototype chain behavior, debugger observations, exploit shape, trigger conditions and defenses.
2026-05-17A deep dive into CVE-2026-35616 — the FortiClient EMS authentication bypass. The Django CertChainAuth middleware blindly trusts the X-SSL-CLIENT-VERIFY HTTP header, so any unauthenticated client can spoof a verified-client-certificate state and walk straight past the auth gate. Full root-cause analysis, a 401→500 detection oracle, an unauthenticated 225 KB data-disclosure endpoint, a read-only enumeration PoC, and remediation.
2026-05-13A full breakdown of CVE-2025-54309 — the CrushFTP zero-day exploited in the wild in July 2025. A logic flaw in loginCheckHeaderAuth() lets a crafted AS2-To header skip authentication entirely, after which an attacker creates an admin account, remaps the Virtual File System to the OS root, drops a malicious Java plugin and reaches remote command execution. Root cause, the bypass-to-RCE kill chain, detection IOCs and remediation.
2025-08-02When you can't leak an address, you can still win by guessing it. Defeating 32-bit ASLR by hammering a fixed ret2libc payload in a loop until the libc base lines up.
2022-03-14
Exploiting a SUID binary by overflowing into EIP and redirecting execution to a hidden getshell() function — no shellcode required.
2022-03-14
Buffer overflow fundamentals on Linux: overriding EIP, generating shellcode with msfvenom, finding the buffer address and landing a shell.
2022-03-14
Shellcode injection through an argv overflow on a SUID binary: offset calculation, buffer address discovery and a NOP sled for reliability.
2022-03-14
Defeating the NX bit by returning into libc: chaining system() + exit() + /bin/sh instead of executing injected shellcode.
2022-03-14
The classic pwnable.kr bof level: overflow a stack buffer through gets() to overwrite a function argument and pass the 0xcafebabe check.
2022-03-14
Combining NX and ASLR bypass: leak puts@GOT to recover the libc base, recompute offsets at runtime, then ret2system for a shell.
2022-03-14A practical reference: assembling x86/x64 Linux shellcode with NASM, extracting opcodes with objdump and testing them with a C harness.
2022-03-14
Leaking the stack canary through a format-string information disclosure, then overwriting the return address while keeping the canary intact.
2022-03-14
Classic Windows stack overflow in ASXtoMP3Converter via a malicious .m3u file: cyclic offset, EIP control and a reverse shell through a NOP sled.
2022-03-14