https://d3bo.eu/en/tags/pwn/Recent content in pwn on d3boHugo -- gohugo.ioenCopyright (c) 2025 HyasTue, 15 Jul 2025 00:00:00 +0000https://d3bo.eu/en/blog/buffer-overflow-with-emojis/Tue, 15 Jul 2025 00:00:00 +0000https://d3bo.eu/en/blog/buffer-overflow-with-emojis/Last weekend, at a CTF (l3ack ctf 2025), I came across a simple ret2win, or so it seemed. The code had a gets that stored the input in a 272-character buffer, and there was also a win function that ran /bin/sh, but there was a problem… On the server, the binary wasn’t run directly: the input first went through a Python script that contained the following:https://d3bo.eu/en/blog/integer-overflow/Mon, 24 Feb 2025 00:00:00 +0000https://d3bo.eu/en/blog/integer-overflow/Why is 4294967295 + 1 equal to 0? You will find out in this post…