BDSec CTF 2026 Pwn Writeup: 2 Challenges Solved
BDSec CTF 2026’s pwn track shipped two 100-point challenges that both hinge on the same class of bug — two components of the same program disagree about the meaning of one operation — but at completely different levels of the stack. Phantom Device is a menu-driven device-driver simulator where the duplicate handle operation copies the descriptor but does not update the object refcount, so release and duplicate disagree about how many live pointers exist. That mismatch drops a stale device handle over a session-object allocation and gives a read/write primitive that leaks the process cookie and forges the privileged role. Muktir Shongket is a custom-bytecode terminal where the verifier and the executor disagree about what a ROUTE order does: the verifier walks past it as metadata, the executor translates it into an x86 jmp rel32. That jump lands inside a later SIGNAL literal, whose bytes were never inspected as instructions, and calls the internal flag.txt printer at a fixed address in the non-PIE binary. ...