b01lers ctf 2026: kernel pwn (part 1)

Thu, 30 Apr 2026 00:00:00 +0000

Intro

Hello! Recently, I competed in b01lersc.tf with team 0bscuri7y, where we placed 12th. I managed to solve all the pwn challenges, and in this post, I’ll walk through my solutions for the kernel pwn tasks: throughthewall (part 1) and multifiles (part 2).

throughthewall

download

Recon

 1#!/bin/bash
 2# start.sh
 3
 4qemu-system-x86_64 \
 5 -m 256M \
 6 -nographic \
 7 -kernel ./bzImage \
 8 -append "console=ttyS0 loglevel=3 oops=panic panic=-1 pti=on kaslr" \
 9 -no-reboot \
10 -cpu qemu64,+smep,+smap \
11 -smp 2 \
12 -initrd ./initramfs.cpio.gz \
13 -monitor /dev/null \
14 -s \
15 2>&1 | tee vm.log

First, create the root directory and unpack the initramfs.

Pwn on

b01lers ctf 2026: kernel pwn (part 1)

Intro

throughthewall

Recon