Writeup in progress
Currently making the solution for PIE TIME 2 and the walkthrough will be published here as soon as it's ready.
Check back soon - or follow our latest updates on the homepage- to be notified when the full writeup goes live.
Currently making the solution for PIE TIME 2 and the walkthrough will be published here as soon as it's ready.
Check back soon - or follow our latest updates on the homepage- to be notified when the full writeup goes live.
Want more picoCTF 2025 writeups?
PIE TIME (rescued-float): a PIE-protected binary leaks main's address on connect. Compute the base, find win()'s offset with objdump, and send the address to redirect execution.
A PIE binary with printf format string vulnerability leaks the binary base and stack addresses. Use them to bypass ASLR and build a write-what-where exploit.
A SUID binary resolves md5sum through PATH. Replace it with a cat script and run flaghasher to get the flag.