No Hack No CTF 2025

modprobe_path overwrite exploit after kernel commit fa1bdca98d74472dcdb79cb948b54f63b5886c04. trigger modprobe using struct sockaddr_alg.

First ever kernel pwn!

Using strlen on binary data is the definition of insanity.

Limited inital ropchain => pivot stack to bss for unlimited control.

From Text injection to open redirect using javascript: pseudo protocol for unrestricted XSS.

First major web solve since picoCTF.

First time solving a race condition / shared memory CTF challenge.

SUID Binary with relative path => recipie for disaster.

UN-INTENDED SOLVE, Notified organisers about it.