CTF pwn challenges

When it applies

The handout is a binary, usually with nc host port, often with a bundled libc.so.6 + ld-linux-x86-64.so.2 and sometimes a Dockerfile. This skill covers the CTF-specific workflow — environment reproduction, remote iteration, and format-string handling. For the exploit chains themselves (ret2libc/one_gadget, tcache/fastbin/unsorted techniques, kernel pwn, stabilization), work exploit-pwn-chain; for finding the bug, reverse-eng-binary-triage and exploit-memory-corruption.

Why it works

CTF pwn is deterministic: the organizer ships you the exact remote environment (libc, ld, sometimes the whole image), so "local works, remote crashes" is a choice, not a hazard — if you run the provided libc locally, offsets are identical and the only remote variables left are ASLR (leak it) and network timing (anchor your reads). Format strings recur constantly because they're a compact way to give both a leak and an arbitrary write.