tl;dr

• ECDSA signing server with biased nonce
• Exploitation by modelling a EHNP instance and using z3 Solver for breaking Mersenne Twister

tl;dr

• memcpy in CPY goes out-of-bounds of VM stack.
• Abuse memcpy to copy the register struct to stack and modify the values using stack operations and register operations.
• Copy values back to the register struct, modifying the VM stack bp and sp registers.
• This migrates the VM stack to wherever you want, gaining arbitrary read and write.
• Leak environ pointer to get stack leak.
• Migrate VM stack to main function’s stack to overwrite return address with ROP chain or one-gadget.

tl;dr

• Analysis of different types of malware in a linear storyline
• Windows timelining
• Analysis of Rootkit, Ransomware, C2 Framework, Process Hollowing, Persistence, and more

tl;dr

• appending same bytes to an existing collision results in a collision as well
• reusing nonce leads to secret leak

tl;dr

• Timing-based attack on the double-and-add algorithm to recover secret value d
• Predict pseudo-random value using the NSA backdoor on Dual_EC_DRBG

tl;dr

• Challenge 2 of Batman Investigation series
• Ransomware Investigation
• Rust based Ransomware Analysis with process dump analysis to recover the randomly generated decryption vector and windows malware analysis
• Recovering from a ransomware attack

Full solution of Batman Investigation II - Gotham Underground Corruption from bi0sctf 2024

tl;dr

• Challenge 1 of Batman Investigation series
• Memory Forensics - WinDBG Dump Debugging - Malware Analysis - Incident Response - Threat Hunting

tl;dr

• Analysis of eBPF assembly
• Simple optimization

tl;dr

• Binary obfuscation with hidden anti-debug checks
• Linear Cryptanalysis (AES with linearly dependent SBOX)

tl;dr

• Custom hook to syscall 0x31337 using eBPF
• Check on the argument passed to syscall to verify correct/incorrect key