Ctf on icctx

l3ak ctf 2026: pwn writeup (supervisor, piet)

Tue, 04 Aug 2026 00:00:00 +0000

Intro

This weekend I played L3AK CTF 2026 with CTF Academy @ ASU.

We placed 11th.

I got first blood on supervisor (5 solves) and second solve on piet (17 solves).

This post covers both:

supervisor - an emulator-based sandbox
piet - an esolang interpreter that takes a .png as its input

1. Supervisor

download

1|-- Dockerfile
2|-- docker-compose.yml
3|-- readflag.c
4|-- supervisor
5`-- supervisor.c
6
71 directory, 5 files

Recon

 1$ pwn checksec ./supervisor
 2 Arch: amd64-64-little
 3 RELRO: Partial RELRO
 4 Stack: Canary found
 5 NX: NX enabled
 6 PIE: PIE enabled
 7 FORTIFY: Enabled
 8 SHSTK: Enabled
 9 IBT: Enabled
10 Stripped: No

Dockerfile

b01lers ctf 2026: kernel pwn writeup, pt2 (multifiles)

Mon, 18 May 2026 00:00:00 +0000

Intro

Previously I wrote a writeup on the first kernel challenge from this CTF — if you haven’t read it yet, I recommend starting with Part 1.

This post covers multifiles, the second kernel pwn challenge.

Since I’m releasing this a bit late: in Part 1 I reimplemented the exploit from scratch in Rust to cover every step, but this time you’ll get a refactored version of the original C exploit instead.

b01lers ctf 2026: kernel pwn writeup, pt1 (throughthewall)

Thu, 30 Apr 2026 00:00:00 +0000

Intro

Hello! Recently, I competed in b01lersc.tf with team 0bscuri7y, where we placed 12th. I managed to solve all the pwn challenges, and in this post, I’ll walk through my solutions for the kernel pwn tasks: throughthewall (part 1) and multifiles (part 2).

throughthewall

download

Recon

 1#!/bin/bash
 2# start.sh
 3
 4qemu-system-x86_64 \
 5 -m 256M \
 6 -nographic \
 7 -kernel ./bzImage \
 8 -append "console=ttyS0 loglevel=3 oops=panic panic=-1 pti=on kaslr" \
 9 -no-reboot \
10 -cpu qemu64,+smep,+smap \
11 -smp 2 \
12 -initrd ./initramfs.cpio.gz \
13 -monitor /dev/null \
14 -s \
15 2>&1 | tee vm.log

First, create the root directory and unpack the initramfs.