Skip to content
0xbenzo

CTF Writeups

Step-by-step walkthroughs, exploitation scripts, and technical explanations of cybersecurity challenge solutions.

Backdoor CTF 2025

Mizuhashi Simple Domain — Backdoor CTF 2025

Writeup for the Misc challenge Mizuhashi Simple Domain from Backdoor CTF 2025. Extracting a flag hidden in S-parameter (S11) network data by plotting admittance in the complex plane and applying binary thresholding with XOR.

Category: MiscHard
07CTF 2025

JailhouseRock — 07CTF 2025

Writeup for the Misc challenge JailhouseRock from 07CTF 2025. Exploiting a Rockstar language jail by writing a decryption function that reverses a custom character-shift encryption.

Category: MiscHard
N0PS CTF 2025

XSS Lab — N0PS CTF 2025

Writeup for the 4-stage XSS challenge from N0PS CTF 2025. Progressively bypassing server-side regex filters to steal admin bot cookies using crafted payloads.

Category: WebHard
PicoCTF

Hash Only 2 — PicoCTF 2025

Writeup for the Pwn challenge Hash Only 2 from PicoCTF 2025. Escaping a restricted shell and hijacking PATH to trick a setuid flaghasher binary into running cat instead of md5sum.

Category: PwnEasy
1753 CTF 2025

Do Not Cheat — 1753 CTF 2025

Writeup for the Web challenge Do Not Cheat from 1753 CTF 2025. Exploiting CVE-2024-4367 (pdf.js arbitrary JS execution) via a crafted malicious PDF delivered to a headless-browser admin bot.

Category: WebMedium
PicoCTF

Hash Only 1 — PicoCTF 2025

Writeup for the Pwn challenge Hash Only 1 from PicoCTF 2025. Exploiting a setuid flaghasher binary via PATH hijacking to substitute md5sum with a custom script that spawns a root shell.

Category: PwnEasy
PicoCTF

PIE Time 2 — PicoCTF 2025

Writeup for the Pwn challenge PIE Time 2 from PicoCTF 2025. Leaking a runtime address via format-string vulnerability then calculating the win function address to bypass PIE and redirect execution.

Category: PwnMedium
PicoCTF

PIE Time — PicoCTF 2025

Writeup for the Pwn challenge PIE Time from PicoCTF 2025. Computing the offset between main and win then using the leaked runtime main address to redirect execution to the win function.

Category: PwnEasy