FrizN

Linux kernel

• (February 2021) The curious case of CVE-2020-14381 : kernel use-after-free exploitation and patching in the various distributions

glibc

• (February 2018) From Heap to RIP : From glibc heap control to generic code execution

BKP CTF 2016

• (March 2016) qwn2own - generic browser exploits : Vector corruption for browser exploitation

Plaid CTF 2015

• (April 2015) PlaidDB - pwn 550 : NUL off-by-one in the heap

BKP CTF 2014

• (March 2014) Risc_emu - pwn 100 : Function pointer overwrite
• (March 2014) Zen garden - pwn 300 : Heap corruption

iCTF 2013

• (December 2013) Poipoi service : Stack overflow

Hack.lu 2013

• (October 2013) ELF - RE 400 : Crackme Linux feat. ptrace, PLT and GOT

Defcon 21 Quals

• (June 2013) Annyong - pwn 4 : x64 remote stack overflow

PlaidCTF 2013

• (April 2013) Ropasaurusrex - pwn 200 : ROP basique sur un stack overflow
• (April 2013) Pork - pwn 250 : stack overflow + ROP
• (April 2013) Servr - pwn 400 : x64 kernel SLUB overflow

iCTF 2012

• (March 2013) Nuclearboom service : Format string et stack overflow basiques
• (March 2013) Pewpew service : Stack overflow + off-by-one

Codegate YUT 2013 Preliminary

• (March 2013) Vulnerable 100 : Stack overflow exploité sur la pile
• (March 2013) Vulnerable 200 : Stack overflow exploité dans le BSS
• (March 2013) Vulnerable 400 : int overflow, uninitialized function pointer

CSAW 2012 Quals

• (September 2012) Exploitation 300 : Stack overflow exploité dans le BSS
• (September 2012) Exploitation 400 : Stack overflow exploité sur la pile
• (September 2012) Exploitation 500 : Stack overflow exploité par return into libc

Defcon 20 Quals

• (June 2012) pwn 100 : Stack overflow

PlaidCTF 2012

• (April 2012) Bunyan - pwn 200 : Stack overflow exécutable Go
• (April 2012) Secure FS - pwn 600 : C++ virtual table corruption

iCTF 2011

• (January 2012) Challenge 31 - Reverse 150
• (January 2012) Challenge 25 - Reverse 150 : Patch d'exécutable basique
• (January 2012) Challenge 32 - Reverse 250
• (January 2012) Convicts service : Restricted bash
• (January 2012) Msgdispatcher service : Python local module import
• (January 2012) Mailgateway service : Heap overflow, function pointer overwrite
• (January 2012) Smsgateway service : Heap overflow, 4-bytes write anywhere

iCTF 2008

• (December 2011) Development Server : Format string basique
• (December 2011) Bomb Server : Reverse et patching d'ELF

Other 0daysober writeups

• Hack.lu 2013 FluxArchive 1 & 2 : Crackme Linux
• BKP CTF 2013 FSS Gainville : Stack ROP detailed explanation

External resources

• CSAW 2013 Finals Brad Oberberg : kernel arbitrary read/write (EpicPhail writeup)