Binary exploitation and reverse engineering challenges from the COlicyber practice track.
ASMR — Static XOR Reverse Engineering
Reverse a static XOR encryption: subtract flag bytes from key bytes position-by-position to recover the plaintext.
Binary
Binary exploitation challenges from COlicyber — buffer overflows, format strings, ROP, shellcode, reversing.
Coffee Hash — Z3 Cyclic Hash Constraint Solving
Model a cyclic windowed hash as a system of linear equations over integer variables and solve it with Z3 to recover the flag.
CrackMat — Z3 Per-Character Quadratic Equations
Each flag character satisfies an independent quadratic equation in integer form; Z3 solves all 20 simultaneously to recover the flag.
Doge Ransom — IBAN Buffer Overflow with Control Byte Injection
The IBAN input field copies 28 bytes into a buffer with room for 49. Appending the control byte 0x03 after the valid IBAN data overflows into an adjacent flag variable and unlocks the ransomware payment path.
Doge Ransom 2 — ROP ret2puts Leak then ADMIN re-login
Overflow the IBAN field to leak the binary’s own password via puts, then re-login as ADMIN using the leaked credential and repeat the overflow to reach the flag path.
Emergency Call — ROP Syscall Chain for execve
Write /bin/sh into a known writable address, then build a ROP chain that sets rax=59, rdi=/bin/sh, rsi=0, rdx=0 using dedicated pop gadgets and a syscall instruction to get a shell.
Formatted — Format String Write with %n
Use a format string %n write to overwrite a target variable at a known address and unlock the flag path.
Generatore Poco Casuale — Shellcode Injection via Leaked Stack Address
The binary leaks a runtime stack address disguised as a ‘random number’. Add 6 to land inside the shellcode region, then spray that address 800 times to cover the return target and get a shell.
Guess The Number — Stack Overflow + Integer Overflow
Overflow the name buffer to corrupt the internal number variable, then feed back the overflowed value as a decimal integer to satisfy the equality check.
Guess the Number 2 — ROP Chain GOT Overwrite via gets
Build a ROP chain that calls gets twice to plant arbitrary data in the GOT, redirect strcspn to a shellcode stub, then trigger the win print path.