Writeup

• You can see at here: Writeup

Summary

PTIT CTF 2024

• pwn1: ret2win
• pwn2: ret2shellcode
• pwn3: format string
• pwn5: tcache poisoning

Approval CTF 2025

• first_visit: ret2win
• secret_blend: format string

BitsCTF 2025

• baby pwn: ret2shellcode
• biscuits: bypass rand()

EHAX CTF 2025

• cash: tcache poisoning
• fantastic doom: bypass rand() + ret2libc

nullcon HackIM CTF Goa 2025

• hateful: ret2libc
• hateful2: tcache poisoning + stack pivot
• Mr Unlucky: bypass rand()

PatriotCTF 2024

• Not So Shrimple Is It: Off-by-one

PearlCTF 2025

• mrropot: ret2libc
• treasurehunt: ret2win

PwnME CTF 2025

• got: Out-of-bound

UofTCTF 2025

• baby-pwn: ret2win
• baby-pwn-2: ret2shellcode

Tex SAW 2025

• ez printf: format string
• ez ROP: ROPchain + ret2libc

scriptCTF 2025

• vault3: Unlink Attack

HolaCTF 2025

• babyheap: House of Kiwi
• login: ret2libc (hard)

Full Week Engineering CTF 2025

• guide_to_heap: Tcache Poisoning
• iconv_service: ret2libc

Nullcon HackIM CTF Berlin 2025

• Fotispy 1: Stack Overflow
• Fotispy 4: Unlink Attack
• Fotispy 5: Heap Overflow & Use-After-Free
• Fotispy 6: Attack __free_hook
• Fotispy 7:
  • solve.py: ret2libc
  • solve1.py: FSOP (Attack ___printf_chk)

ImaginaryCTF 2025

• cascade: Stack Pivot + ret2libc
• fiumicino: Format String (using fmtstr_payload() pwntools)

FortID CTF 2025

• Reverse Polish Pwn: ret2libc

Quals Securinet CTF 2025

• zip++: ret2win
• spell manager: Heap Exploitaion + ret2libc

Quals CSCV CTF 2025

• RacehorseS: Format String
• HeapnoteS: Heap Overflow
• SudokuS: Buffer Overflow + ret2shellcode
• Hanoi Convention: Buffer Overflow + Format String

V1t CTF 2025

• Buffer Overflow + Format String
• No Heap Exploitation Challenge