OmniCTF 2026 Quals Pwn Writeup: 2 Challenges Solved
OmniCTF 2026 Quals shipped a pwn track with two challenges from very different worlds. nullshui (hard, 500 points, 0 solves at release) is glibc 2.39 heap exploitation on Ubuntu 24.04 with every modern mitigation turned on (Full RELRO, canary, NX, PIE, SHSTK, IBT). WinCapture (medium, 111 points, 39 solves) is a Windows kernel-driver TOCTOU race exposed through a named pipe. What they share is a design shape worth noticing: neither one lets you spawn a shell (Ubuntu 24.04 hardening on one side, kernel-mode context on the other both make direct shellcode impractical), neither relies on a stack smash, and the winning primitive in both is a narrow write into carefully-shaped adjacent state that a defender would look at and say “too small to exploit in practice.” ...