TraceBash CTF 2026 Pwn Writeup: 2 Challenges Solved (Badchars ROP, Format-String %hn to Shellcode)
Third post in the TraceBash CTF 2026 series on this site. The earlier ones cover crypto (small-subgroup DH, shared RSA prime, harmonic XOR, 16-bit seed brute) and OSINT (geocaching pivot, Plus Codes, NYC DOB open data, cross-platform handle pivoting). This one walks the two pwn challenges in the same step-by-step format. ...