https://d3bo.eu/en/ctf/pico/Recent content in PicoCTF on d3boHugo -- gohugo.ioenCopyright (c) 2025 HyasMon, 08 Jan 2024 12:16:22 +0100https://d3bo.eu/en/ctf/pico/binary-gauntlet-1/Sat, 14 Feb 2026 00:00:00 +0000https://d3bo.eu/en/ctf/pico/binary-gauntlet-1/#!/usr/bin/env python3 from pwn import * exe = ELF("./gauntlet_patched") context.binary = exe def conn(): if args.LOCAL: r = process([exe.path]) if args.https://d3bo.eu/en/ctf/pico/binary-gauntlet-2/Sat, 14 Feb 2026 00:00:00 +0000https://d3bo.eu/en/ctf/pico/binary-gauntlet-2/#!/usr/bin/env python3 from pwn import * exe = ELF("./gauntlet") context.binary = exe def conn(): if args.LOCAL: r = process([exe.path]) if args.https://d3bo.eu/en/ctf/pico/binary-gauntlet-3/Sat, 14 Feb 2026 00:00:00 +0000https://d3bo.eu/en/ctf/pico/binary-gauntlet-3/#!/usr/bin/env python3 from pwn import * exe = ELF("./gauntlet_patched") libc = ELF("./libc.so.6") ld = ELF("./ld-2.27.so") context.binary = exe context.terminal = ['tmux', 'splitw', '-h'] gdb_script = ''' b main b strcpy continue ''' def conn(): if args.https://d3bo.eu/en/ctf/pico/input-injection-2/Sat, 14 Feb 2026 00:00:00 +0000https://d3bo.eu/en/ctf/pico/input-injection-2/#!/usr/bin/env python3 from pwn import * exe = ELF("./vuln_patched") context.binary = exe def conn(): if args.LOCAL: r = process([exe.path]) if args.https://d3bo.eu/en/ctf/pico/input-injection-1/Fri, 13 Feb 2026 00:00:00 +0000https://d3bo.eu/en/ctf/pico/input-injection-1/#!/usr/bin/env python3 from pwn import * exe = ELF("./vuln_patched") context.binary = exe def conn(): if args.LOCAL: r = process([exe.path]) if args.https://d3bo.eu/en/ctf/pico/function-overwrite/Sat, 16 Aug 2025 00:00:00 +0000https://d3bo.eu/en/ctf/pico/function-overwrite/#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/types.h> #include <wchar.h> #include <locale.h> #define BUFSIZE 64 #define FLAGSIZE 64 int calculate_story_score(char *story, size_t len) { int score = 0; for (size_t i = 0; i < len; i++) { score += story[i]; } return score; } void easy_checker(char *story, size_t len) { if (calculate_story_score(story, len) == 1337) { char buf[FLAGSIZE] = {0}; FILE *f = fopen("flag.https://d3bo.eu/en/ctf/pico/x-sixty-what/Fri, 15 Aug 2025 00:00:00 +0000https://d3bo.eu/en/ctf/pico/x-sixty-what/#!/usr/bin/env python3 from pwn import * HOST = "saturn.picoctf.net" PORT = 64947 exe = ELF("./vuln_patched") context.binary = exe context.terminal = ['tmux', 'splitw', '-h'] #context.https://d3bo.eu/en/ctf/pico/clutter-overflow/Wed, 13 Aug 2025 00:00:00 +0000https://d3bo.eu/en/ctf/pico/clutter-overflow/#include <stdio.h> #include <stdlib.h> #define SIZE 0x100 #define GOAL 0xdeadbeef const char* HEADER = " ______________________________________________________________________\n" "|^ ^ ^ ^ ^ ^ |L L L L|^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^|\n" "| ^ ^ ^ ^ ^ ^| L L L | ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ |\n" "|^ ^ ^ ^ ^ ^ |L L L L|^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ==================^ ^ ^|\n" "| ^ ^ ^ ^ ^ ^| L L L | ^ ^ ^ ^ ^ ^ ___ ^ ^ ^ ^ / \\^ ^ |\n" "|^ ^_^ ^ ^ ^ =========^ ^ ^ ^ _ ^ / \\ ^ _ ^ / | | \\^ ^|\n" "| ^/_\\^ ^ ^ /_________\\^ ^ ^ /_\\ | // | /_\\ ^| | ____ ____ | | ^ |\n" "|^ =|= ^ =================^ ^=|=^| |^=|=^ | | {____}{____} | |^ ^|\n" "| ^ ^ ^ ^ | ========= |^ ^ ^ ^ ^\\___/^ ^ ^ ^| |__%%%%%%%%%%%%__| | ^ |\n" "|^ ^ ^ ^ ^| / ( \\ | ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ |/ %%%%%%%%%%%%%% \\|^ ^|\n" ".https://d3bo.eu/en/ctf/pico/basic-file-exploit/Tue, 12 Aug 2025 00:00:00 +0000https://d3bo.eu/en/ctf/pico/basic-file-exploit/#include <stdio.h> #include <stdlib.h> #include <stdbool.h> #include <string.h> #include <stdint.h> #include <ctype.h> #include <unistd.h> #include <sys/time.h> #include <sys/types.h> #define WAIT 60 static const char* flag = "[REDACTED]"; static char data[10][100]; static int input_lengths[10]; static int inputs = 0; int tgetinput(char *input, unsigned int l) { fd_set input_set; struct timeval timeout; int ready_for_reading = 0; int read_bytes = 0; if( l <= 0 ) { printf("'l' for tgetinput must be greater than 0\n"); return -2; } /* Empty the FD Set */ FD_ZERO(&input_set ); /* Listen to the input descriptor */ FD_SET(STDIN_FILENO, &input_set); /* Waiting for some seconds */ timeout.https://d3bo.eu/en/ctf/pico/cve-xxxx-xxxxx/Mon, 11 Aug 2025 00:00:00 +0000https://d3bo.eu/en/ctf/pico/cve-xxxx-xxxxx/Description Enter the CVE of the vulnerability as the flag with the correct flag format: picoCTF{CVE-XXXX-XXXXX} replacing XXXX-XXXXX with the numbers for the matching vulnerability.