Phantom
Physical page UAF in a kernel module: reclaim the freed page as a PMD, forge 2MB huge page entries for arbitrary physical memory R/W, and overwrite modprobe_path to read the flag.
Pwn
Featured
Tcademy
Heap exploitation on glibc 2.35: integer underflow to massive heap overflow, and two paths to shell: libc GOT overwrite or House of Apple 2 FSOP.
AHC - Average Heap Challenge
Tcache bin confusion via chunk size corruption.
All Posts
Velvet Table
Glibc 2.32+ heap note manager wrapped in heavy XOR obfuscation. An inverted size check in the cashout handler turns the dev’s careful tcache bookkeeping into a free UAF, with a slightly longer smallbin attack waiting behind it as the intended path.
Grande Inutile Tool
Buffer overflow corrupts path validation flag, enabling path traversal.
speedjournal
Exploiting a TOCTOU race condition to bypass authentication checks.
Ruid_login
Exploiting predictable RUIDs, buffer overflow, and executable stack for shellcode execution.
Encryptor
Leaking a stack canary using RC4 keystream bias, then ret2win.