July 2026
Format String Exploit — GOT Overwrite to win()
Remote pwn challenge with a format string vulnerability instead of a classic buffer overflow. Goal: get a shell via an uncalled win() function, despite modern binary protections (no canary, but NX and CET).
TryPwnMeOne - TheLibrarian (ret2libc)
Remote binary exploitation challenge. Target: thelibrarian, running on MACHINEIP:9008, with matching libc.so.6 and ld-linux-x86-64.so.2 provided alongside the binary.
TryPwnMeOne: Random Memories — Write-up
A PIE ret2win: the binary leaks its own vuln() address (breaking ASLR), a 512-byte read into a 256-byte buffer overflows the stack, and an extra ret gadget fixes alignment before system() — ending in a root shell.
Workflow: finding a binary exploit blind (from zero to shell)
Starting point: you have a binary (and/or an IP:port), no other context. This order takes you systematically from recon to shell.
Shellcode Injection — Executable Stack (port 9005)
Third challenge: instead of overwriting a specific value, the entire contents of a buffer are executed as machine code. By sending your own shellcode, you get a full shell on the target.
TryOverFlowMe2 — Buffer Overflow with Variable Overwrite (port 9004)
Harder variant of the first overflow challenge. Instead of a simple overflow, a specific local variable (admin) has to be overwritten with an exact value (0x59595959) to reach the flag function.
TryOverFlowMe1 — Simple Buffer Overflow (port 9003)
First challenge in the TryPwnMeOne room. A netcat-like service on port 9003 asks for a "comment". Just sending a long string overflows the buffer on the stack and hands you the flag directly.
Ret2Win with Stack-Alignment Fix (CET/SHSTK)
A classic ret2win where the room''s hint gets both the offset and the alignment wrong: char *buf[0x20] is a pointer array (264-byte offset), and a CET-compiled binary needs an extra ret gadget to fix stack alignment before system().