Ctf on bitfriends' blog

Reviving modprobe_path technique (again)

Fri, 03 Jul 2026 23:22:28 +0700

Overview Link to heading

The modprobe_path technique is a widely known Linux kernel exploitation primitive that can be used to turn an arbitrary write primitive into LPE.

TL;DR Link to heading

modprobe_path is a string that specifies the name of the modprobe executable in the Linux kernel. This program is responsible for adding and removing loadable kernel modules.

When CONFIG_STATIC_USERMODEHELPER is disabled modprobe_pathis R/W, this means that if we have an arbitrary write primitive and a KASLR leak, we can change it to a controlled executable file path. If we now find a way to make the kernel run modprobe for us, it will run our executable with root privileges, thus achieving LPE.

snalloc - Lake CTF 2025

Sun, 01 Mar 2026 23:49:32 +0700

Overview Link to heading

This was an heap challenge with a custom allocator implementation. The main program basically let you allocate, edit and free chunks using either the custom allocator or the malloc allocator.

Vulnerability Link to heading

Snalloc Internals Link to heading

In the snallloc implementation, glibc malloc is still used as the “buddy” allocator. It is exclusively used to request blocks of memory that are multiple of PAGESIZE in size.

cherry - Mimic Defense CTF

Fri, 12 Dec 2025 23:31:15 +0700

Cherry - Mimic CTF Finals 2025 Link to heading

Two weeks ago I went to Nanjing, China to take part in the 2025 Qiangwang Challenge on Cyber Mimic Defense Finals with the ARESx team. Me and @leo_something) full cleared pwn during the CTF and in this writeup we are going to talk about a really nice browser challenge we encountered.

Overview Link to heading

The challenge consisted in a patched version of jerryscript, a “lightweight JavaScript engine intended to run on a very constrained devices such as microcontrollers”.

htaas - UofT CTF 2025

Wed, 15 Jan 2025 19:58:53 +0100

While playing UofTCTF I solved hash table as a service (htaas). We were given a simple heap menu, which lets us create, get and set hash table entries:

1. New Hash Table
2. Set
3. Get
4. Exit
>

Upon inspecting the source, we spot some interesting things. There is an array that contains hashTables, i.e. it contains the number of entries in the hash table and its start address:

0x5c1e1caad040 <hashTables>:	0x0000000000000010	0x00005c1e4f4072a0
0x5c1e1caad050 <hashTables+16>:	0x0000000000000000	0x0000000000000000
...

Each hashTable consits of n entries, which look like this:

heap_master - n1ctf 2024

Thu, 09 Jan 2025 15:59:10 +0100

Heap_master was a kernel pwn challenge from n1ctf. I didn’t play the ctf, allthough the challenge seemed nice to upsolve. Let’s get started

For the environment, we were given a Linux 6.1.110 image as well as a config file. Before looking at the config file, the fact that we have an nsjail environment. In our case, this means a bunch of disabled syscalls, no setuid binaries, and only few useful files in /dev and /proc directories. The goal is hereby not only to get root, but also escape the nsjail to read flag.txt. We need to take this into account when creating our exploit.

TOY/2 - SECCON CTF 13

Sun, 24 Nov 2024 14:53:47 +0100

TOY/2: Link to heading

This weekend we played as P1G SEKAI and managed to qualify to the finals. TOY/2 was a challenge I solved.

In this challenge we’re given a C++ binary that emulates some 16-bit architecture.

It had several instructions, one of them included an OOB bug:

case 13: /* STT */
 mem_write(_regs.a & (size() - 1), _regs.t);
 break;

This is bad code, since we write two bytes but the AND let’s us place those one byte before the emulator memory ends → one-byte OOB write.

Java? - Securinets CTF Quals 2024

Mon, 21 Oct 2024 10:02:00 +0200

Last week we qualified for securinets finals. Java? was a pwn challenge I blooded. We were given a java program, which reads input three times and passes it to a library:

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;

public class Main {

 private String first = "";
 private String second = "";
 private String last = "";

 static {
 System.loadLibrary("Lib");
 }

 public native void Kabom();
 public native void Setup();

 public static void main(String[] args) throws IOException{
 BufferedReader reader = new BufferedReader(new InputStreamReader(System.in));
 Main me = new Main();

 me.Setup();

 //System.out.println("If I give you a gift, will you give me the right input? ");
 //me.Gift();

 System.out.println("And I'll give you 3 bullets");

 System.out.println("First shot: ");
 me.first = reader.readLine();

 System.out.println("Second shot: ");
 me.second = reader.readLine();

 System.out.println("Last shot: ");
 me.last = reader.readLine();

 me.Kabom();
 }
}

The library provided prints the three inputs with printf, resulting in a format string vuln.

physler - BRICS CTF 2024

Sun, 20 Oct 2024 12:18:45 +0200

Physler was another challenge from BRICS CTF that I solved. We basically got a kernel module that has two ioctl requests defined:

case IOCTL_MAP_PHYS_ADDR: {
 if (copy_from_user(&_map, (void*)arg, sizeof(_map))) {
 return -EFAULT;
 }

 if (mem)
 iounmap(mem);

 mem = ioremap(_map.phys_addr, _map.size);

 if (!mem) {
 return -EFAULT;
 }
 break;
}
case IOCTL_WRITE_PHYS_MEM: {
 if (!mem)
 return -EFAULT;

 if (copy_from_user(&_write, (void*)arg, sizeof(_write))) {
 return -EFAULT;
 }

 size = _write.size;

 if (size > sizeof(kernel_buffer))
 size = sizeof(kernel_buffer);

 if (copy_from_user(kernel_buffer, (char *)_write.in_data, size))
 return -EFAULT;

 memcpy_toio(mem, kernel_buffer, size);
 break;
}

This essentially lets us map any physical address and write arbitrary data to it - all as normal user since this also bypasses all virtual access protections for pages/memory regions, we can overwrite kernel code. To get the physical kernel base, we can read /proc/iomem:

chains - BRICS CTF 2024

Fri, 18 Oct 2024 18:50:53 +0200

Two weeks ago, I played BRICS CTF with r3kapig, and we ranked 1st! Chains was one of the challanges I solved.

We were given a program to add/remove proxies and chains. Upon executing we’re presented with:

1. Add Proxy
2. Delete Proxy
3. Add Chain
4. View Chain
5. Delete Chain
6. Exit

That resembles a typical heap challenge. It turns out to be one, since the following structures are getting allocated dynamically:

TLN - snakeCTF 2024

Mon, 09 Sep 2024 08:46:34 +0200

This weekend I played snakeCTF for fun and managed to solve a few pwns. One of them was TLN. The challenge code was pretty simple, introducing a classical OOB index vulnerability:

case OPT_SET:
 print("Index: ");
 index = get_int();

 print("Content: ");
 read_exact(&(notes[index].content), sizeof(item_t) - 1);
 notes[index].content[sizeof(item_t) - 1] = 0;
 break;

As you can see, no bounds checks at all. The notes array consists of elements of item_t, which is defined like the following:

typedef struct {
 char content[8];
} item_t;

To sum it up: we can write 7 bytes at a time relative to the starting address of notes. The declaration of the array is what’s particulary interesting. The keyword thread_local is used here:

the ring - BlackHat MEA CTF 2024

Mon, 02 Sep 2024 20:24:09 +0200

I had a fun time playing BlackHat MEA CTF. This pwn challenge was particulary nice.

In “the ring” you were given a FLAC audio file parser, written in C++. You can provide such a custom audio file and get presented the output of the program. Notice that there is a Python wrapper handling the file and outputs readable text only.

Now the general functionality of the program: The program checks the magic bytes first (#define FLAC_MAGIC 0x664c6143U) and then immedeately starts looking for the initial TYPE_STREAMINFO block, which may be followed by more blocks.

valorn't - PlaidCTF 2024

Tue, 23 Apr 2024 20:00:41 +0200

I solved the easy pwn chall “valorn’t” during PlaidCTF while playing with Friendly Maltese Citizens.

As usual, the goal was to win the game and read the flag

Link to heading

 int ret = play_pew_pew_game();

	if (ret == 0) {
		read_flage();
	}

Link to heading

In order to win, is_cheater had to be set and the enemy team win-counter has to be 0