https://d3bo.eu/en/tags/ret2libc/Recent content in ret2libc on d3boHugo -- gohugo.ioenCopyright (c) 2025 HyasFri, 01 Aug 2025 00:00:00 +0000https://d3bo.eu/en/ctf/pico/guessing-game-2/Fri, 01 Aug 2025 00:00:00 +0000https://d3bo.eu/en/ctf/pico/guessing-game-2/#!/usr/bin/env python3 from pwn import * exe = ELF("./vuln_patched") context.binary = exe context.terminal = ['tmux', 'splitw', '-h'] gdb_script = ''' b main b *0x080487ce continue ''' def conn(): if args.https://d3bo.eu/en/ctf/htb-ctf/restaurant/Mon, 30 Jun 2025 00:00:00 +0000https://d3bo.eu/en/ctf/htb-ctf/restaurant/leak libc & ret2libchttps://d3bo.eu/en/writeups/hackthebox/october/Wed, 27 Mar 2024 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/october/In this machine we exploit OctoberCMS with default credentials and a file upload that bypasses an extension check. For privilege escalation we perform a buffer overflow with a technique called ret2libc, with ASLR (Address Space Layout Randomization) enabledhttps://d3bo.eu/en/writeups/hackthebox/enterprise/Sat, 11 Nov 2023 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/enterprise/In this writeup we solve the Enterprise machine from HackTheBox. It is a very interesting medium machine: we cover WordPress and Joomla web enumeration and SQL injections, escape from a Docker container and finally exploit a very interesting buffer overflow with the ret2libc technique