https://cybersecurityelite.com/tags/reverse/Recent content in Reverse on CyberSecurity Elitehttps://cybersecurityelite.com/images/og-default.pnghttps://cybersecurityelite.com/images/og-default.pngHugoen-usThu, 16 Jul 2026 13:41:29 +0200https://cybersecurityelite.com/ctf-writeups/broncoctf-2026-pwn-reverse-writeup/Thu, 16 Jul 2026 10:30:00 +0000https://cybersecurityelite.com/ctf-writeups/broncoctf-2026-pwn-reverse-writeup/Step-by-step BroncoCTF 2026 pwn and reverse writeup — three pwn challenges (Crab Trap: seccomp-restricted service allowing only open/read/write, solved with a 50-byte x86_64 ORW shellcode that pushes flag.txt on the stack; Proper Pwning: four gets() calls, three integer gates with an adjacent baby_chicken decoy plus an exact 13371337 gate, ending in a 6776-byte ret2win at win+5 for stack alignment; World's Hardestest Flag: Roblox .rbxl binary place file with a SecureDeh9001Server Lua sandbox whose read() blocks TypeTag=0 entries but whose write() can mutate that same TypeTag, plus a client-side banned-word filter bypassed with string.char) and four reverse challenges (Cat Simulator: 5-day game with score/mood/talk-letter constraints leading to a mood-seeded FNV-mix XOR decrypt of the real flag past the bonco{almost_there} decoy; C++ Unplugged: valid C++ with song titles substituted for every syntactic token, translated and compiled; Dog Simulator: ARM64 Mach-O with a 6-day rhythm state machine, an FNV-1a preimage recovered via Z3 for a 12-letter first speak, and a required 'gremlin' second speak matching the day-6 owner line; Mirror Mirror: Python script XOR-decrypting a hard-coded blob using a SHA-256 of a 300-char slice of its own source starting at a marker string, keyed by the repeating string MirrorMirror).