Posts on razvan.sh

Cool Arbitrary-Write-to-RCE Chain in glibc's Thread Descriptor

Sat, 28 Feb 2026 12:00:00 +0200

Introduction

This post describes an arbitrary write to RCE chain I found in glibc’s per-thread descriptor (struct pthread) in TLS on x86_64.

On modern glibc versions (2.36+), the relevant fields are conveniently adjacent, allowing a single write to forge a cleanup node and achieve RCE. On older versions, the canceltype field is located far away, usually necessitating two separate writes.

Background

glibc stores per-thread cancellation and cleanup state in struct pthread. The cancellation-unwind path in unwind_stop eventually executes:

rweb @ QnQSec CTF 2025

Sat, 18 Oct 2025 12:00:00 +0300

Challenge details

So you like web and reverse, can you try this one yet

Author: byamb4

challenge

Introduction

challenge: Mach-O 64-bit x86_64 executable, flags:<|DYLDLINK|PIE>

The challenge binary is a GoLang Mach-O executable compiled for x86_64 architecture. The challenge also provides an IP address and port where an HTTP server is running.

Reversing the Binary

Most of the significant code is located in the main.main.func1 function. Reversing the binary reveals that the server listens on port 8080 and exposes a single endpoint: /search.

UAF in Linux Kernel Module - baby-kernel @ UIUCTF 2025

Mon, 28 Jul 2025 12:00:00 +0300

Challenge details

handout.tar.zst

Introduction

The challenge features a vulnerable kernel module vuln.ko in a QEMU VM with Linux kernel v6.6.16. It exposes /dev/vuln with ioctl commands for allocating, freeing, reading, and writing a global kernel buffer. The main vulnerability is a UAF, as the buffer pointer remains dangling after free without nullification:

case FREE: {
    if (!buf) {
        return -EFAULT;
    }
    kfree(buf);
    break;
}
case USE_READ: {
    if (!buf) {
        return -EFAULT;
    }
    return copy_to_user((char*)arg, buf, size);
}

KASLR, SMEP & SMAP are enabled.

FSOP in Cosmopolitan - cosmofile @ L3akCTF 2025

Sun, 13 Jul 2025 12:00:00 +0300

Challenge details

Have you ever read files? Hopefully, this will teach you how to read them. Go read the code, the Dockerfile, the fake flag, and the secrets of the universe…and the real flag, of course.

cosmofile.zip

Introduction

This challenge features a binary compiled with Cosmopolitan Libc - a build system that creates “Actually Portable Executable” binaries. There are no protections enabled except for NX.

The binary opens /tmp/cosmofile.txt and provides a menu with options to read from the file or exit. There’s also a hidden backdoor option 7238770 that allows writing up to 0x70 bytes directly to the FILE structure:

Allocating inside tcache_perthread_struct - limit @ smileyCTF 2025

Tue, 24 Jun 2025 12:00:00 +0300

Challenge details

I heard you could malloc into scary places, so im adding a check to prevent that from ever happening!

limit.tar.gz

Introduction

This challenge implements a heap note system with malloc/free/print/write operations on glibc 2.39. A limit check preventing chunks above the heap boundary via sbrk(0) is present upon allocation:

chunks[idx] = malloc(sz);
if (chunks[idx] > limit) {
    puts("hey where do you think ur going");
    // if (malloc_usable_size(chunks[idx])) free(chunks[idx])
    chunks[idx] = 0;
    break;
}
// this will be abused later
// chunks are still allocated even if above limit, only operations are blocked

The main vulnerability is an off by null bug in the write function, overflowing a null byte into the next chunk: