https://algoatson.github.io/series/ctf-writeups/ A stripped, statically-linked binary with a stack overflow and almost nothing else — no PLT, no libc to leak, barely any gadgets. The way out is to write "/bin/sh" with a read, then chain two forged sigreturn frames into an execve. A clean SROP from recon to shell. en Tue, 16 Jun 2026 02:47:52 +0000 https://algoatson.github.io/p/writeup-notekeeper-uaf/ https://algoatson.github.io/p/writeup-notekeeper-uaf/ Mon, 18 May 2026 00:00:00 +0000 pwnheapctf A textbook menu-driven heap challenge, start to finish. A dangling pointer after delete gives a read and a write on freed memory; the unsorted bin leaks libc, tcache poisoning aims a freed chunk at __free_hook, and the program frees its way into a shell. https://algoatson.github.io/p/writeup-static-srop/ https://algoatson.github.io/p/writeup-static-srop/ Tue, 26 May 2026 00:00:00 +0000 pwnropctf A stripped, statically-linked binary with a stack overflow and almost nothing else — no PLT, no libc to leak, barely any gadgets. The way out is to write "/bin/sh" with a read, then chain two forged sigreturn frames into an execve. A clean SROP from recon to shell.