WinKern x64 - Advanced stack buffer overflow - ROP

120 Points  0x0

Reverse the driver, find exposed vulnerabilities and exploit them on a Windows 10 system, in order to obtain SYSTEM privileges

Author

__syscallSynacktiv,  

Level  Difficulty

Validations

26 Challengers 1%

Note  Notation

19 Votes

To reach this part of the site please login

challenges 84 Challenges

Results Name Validations Number of points  Explanation for the scores Difficulty  Difficulty Author Note  Notation Solution Date
pas_valide ELF x86 - Stack buffer overflow basic 1 8% 18857 5 Lyes 11 25 March 2015
pas_valide ELF x86 - Stack buffer overflow basic 2 6% 13496 10 Lyes 10 10 April 2015
pas_valide PE32 - Stack buffer overflow basic 1% 1558 10 Ech0 8 3 December 2019
pas_valide ELF x86 - Format string bug basic 1 4% 8505 15 Lu33Y 6 8 February 2012
pas_valide ELF x64 - Stack buffer overflow - basic 3% 6548 20 Arod 7 31 May 2015
pas_valide ELF x86 - Format string bug basic 2 2% 4318 20 Lyes 5 8 April 2015
pas_valide ELF x86 - Race condition 3% 5596 20 Lu33Y 10 8 February 2012
pas_valide ELF ARM - Stack buffer overflow - basic 1% 1214 25 pickle 7 9 March 2017
pas_valide ELF MIPS - Stack buffer overflow - No NX 1% 435 25 franb 2 28 September 2018
pas_valide ELF x64 - Double free 1% 468 25 Esad 1 23 March 2021
pas_valide ELF x86 - Stack buffer overflow basic 3 2% 4301 25 Lyes 4 10 April 2015
pas_valide ELF x86 - Use After Free - basic 1% 1384 25 Esad 3 26 May 2019
pas_valide ELF ARM - Stack Spraying 1% 225 30 pickle 4 2 April 2017
pas_valide ELF x64 - Stack buffer overflow - PIE 1% 568 30 HomardBoy 2 26 March 2021
pas_valide ELF x86 - BSS buffer overflow 2% 3788 30 Lu33Y 7 8 February 2012
pas_valide ELF x86 - Stack buffer overflow basic 4 1% 2599 30 Lu33Y 5 8 February 2012
pas_valide ELF x86 - Stack buffer overflow basic 6 1% 2564 30 TiWim 5 10 March 2016
pas_valide ELF x86 - Format String Bug Basic 3 1% 1134 35 Lyes 2 27 May 2015
pas_valide PE32 - Advanced stack buffer overflow 1% 192 35 Ech0 4 3 December 2019
pas_valide ELF ARM - Basic ROP 1% 657 40 pickle 5 11 March 2017
pas_valide ELF MIPS - Basic ROP 1% 130 40 dagger 1 7 October 2018
pas_valide ELF x86 - Stack buffer overflow - C++ vtables 1% 800 40 sebbb 2 20 July 2015
pas_valide PE32+ Format string bug 1% 83 45 Ech0 1 3 December 2019
pas_valide ELF x64 - Logic bug 1% 177 50 sbrk 3 8 July 2017
pas_valide ELF x86 - Bug Hunting - Several issues 1% 98 50 sbrk 2 19 January 2018
pas_valide ELF x86 - Stack buffer and integer overflow 1% 1789 50 Lu33Y 4 8 February 2012
pas_valide ELF x86 - Stack buffer overflow - ret2dl_resolve 1% 265 50 kikko 2 28 February 2019
pas_valide ELF x86 - Stack buffer overflow basic 5 1% 1663 50 Lu33Y 1 8 February 2012
pas_valide ELF x64 - Stack buffer overflow - advanced 1% 1205 55 Arod 4 5 June 2015
pas_valide ELF MIPS - Format String Glitch 1% 57 60 pickle 1 21 October 2018
pas_valide ELF x64 - Heap Filling 1% 41 60 voydstack 0 27 May 2021
pas_valide ELF x86 - Information leakage with Stack Smashing Protector 1% 806 60 Arod 2 20 May 2015
pas_valide ELF x64 - File Structure Hacking 1% 48 65 nobodyisnobody 0 27 May 2021
pas_valide ELF ARM - Race condition 1% 127 70 pickle 1 3 June 2017
pas_valide ELF x64 - Browser exploit - Intro 1% 72 70 pickle 1 2 November 2018
pas_valide ELF x64 - Buggy VM 1% 29 70 NonStandardModel 0 10 June 2022
pas_valide ELF x64 - Heap Safe-Linking Bypass 1% 29 70 nobodyisnobody 0 22 October 2021
pas_valide ELF x64 - ret2dl_init 1% 26 70 kikko 0 27 May 2021
pas_valide ELF x86 - Out of bounds attack - French Paradox 1% 102 70 sbrk 3 17 September 2017
pas_valide ELF x86 - Remote BSS buffer overflow 1% 730 75 Tosh 1 6 February 2012
pas_valide ELF x86 - Remote Format String bug 1% 920 75 Tosh 2 6 February 2012
pas_valide PE32+ Basic ROP 1% 49 75 Ech0 0 6 December 2019
pas_valide ELF x64 - Remote heap buffer overflow - fastbin 1% 262 80 franb 1 5 February 2017
pas_valide ELF x86 - Blind remote format string bug 1% 293 80 Lyes 2 8 June 2015
pas_valide LinKern ARM - vulnerable syscall 1% 140 85 pickle 0 22 March 2017
pas_valide LinKern x86 - Buffer overflow basic 1 1% 459 85 franb 3 16 February 2016
pas_valide LinKern x86 - Null pointer dereference 1% 440 90 franb 0 16 February 2016
pas_valide LinKern x64 - Race condition 1% 294 95 franb 3 16 February 2016
pas_valide ELF ARM - Alphanumeric shellcode 1% 40 100 pickle 2 16 March 2017
pas_valide ELF MIPS - URLEncoded Format String bug 1% 27 100 pickle 0 7 October 2018
pas_valide ELF x86 - Hardened binary 1 1% 703 100 sm0k 3 11 February 2012
pas_valide ELF x86 - Hardened binary 2 1% 553 100 sm0k 3 11 February 2012
pas_valide ELF x86 - Hardened binary 3 1% 336 100 sm0k 1 11 February 2012
pas_valide ELF x86 - Hardened binary 4 1% 385 100 sm0k 2 11 February 2012
pas_valide LinKern MIPSel - Vulnerable ioctl 1% 52 100 pickle 0 23 October 2018
pas_valide LinKern x64 - reentrant code 1% 160 100 franb 2 1 March 2016
pas_valide ELF ARM - Heap format string bug 1% 74 105 franb 1 3 June 2017
pas_valide ELF x64 - Sigreturn Oriented Programming 1% 242 105 Arod 4 25 June 2015
pas_valide ELF ARM - Format String bug 1% 83 110 pickle 2 14 March 2017
pas_valide ELF ARM - Use After Free 1% 88 110 pickle 0 22 March 2017
pas_valide ELF x64 - FILE structure hijacking 1% 31 110 voydstack 3 27 May 2021
pas_valide ELF x64 - Heap feng-shui 1% 68 110 laxa 2 4 August 2017
pas_valide ELF x64 - Off-by-one bug 1% 130 110 NeedToLearn 2 19 May 2016
pas_valide ELF x86 - Hardened binary 5 1% 295 110 sm0k 1 11 February 2012
pas_valide LinKern ARM - Stack Overflow 1% 55 110 pickle 0 24 July 2017
pas_valide LinKern x86 - basic ROP 1% 241 110 franb 3 6 May 2016
pas_valide ELF ARM - Heap Off-by-One 1% 53 115 pickle 1 11 March 2017
pas_valide ELF x64 - Remote Heap buffer overflow 1 1% 158 115 Tosh 3 26 June 2015
pas_valide ELF x86 - Hardened binary 6 1% 277 115 sm0k 3 11 February 2012
pas_valide ELF x86 - Hardened binary 7 1% 228 115 Tosh 3 21 January 2013
pas_valide ELF x86 - Remote stack buffer overflow - Hardened 1% 155 115 franb 1 17 August 2016
pas_valide LinKern x64 - RowHammer 1% 72 115 pickle 1 17 March 2019
pas_valide LinKern x64 - SLUB off-by-one 1% 57 115 Tosh 2 9 May 2019
pas_valide ELF ARM - Heap buffer overflow - Wilderness 1% 33 120 pickle 1 25 March 2017
pas_valide ELF ARM - Heap Overflow 1% 40 120 pickle 1 2 April 2017
pas_valide ELF x64 - Seccomp Whitelist 1% 59 120 pickle 0 3 June 2017
pas_valide ELF x86 - Blind ROP 1% 126 120 franb 0 9 October 2016
pas_valide LinKern x64 - Memory exploration 1% 109 120 franb 1 27 July 2016
pas_valide WinKern x64 - Advanced stack buffer overflow - ROP 1% 26 120 __syscall 1 27 January 2020
pas_valide WinKern x64 - Use After Free 1% 18 120 __syscall 0 27 January 2020
pas_valide ELF x64 - Remote Heap buffer overflow 2 1% 120 130 Tosh 1 1 July 2015
pas_valide ELF x64 - Advanced Heap Exploitation - Heap Leakless & Fortified 1% 19 135 nobodyisnobody 1 27 May 2021
pas_valide ELF x64 - Blind ROP 1% 96 135 franb 1 10 March 2018
pas_valide ELF x64 - Browser exploit - BitString 1% 30 135 pickle 0 15 December 2018