Exploiting a Use-After-Free (UAF) Vulnerability - "Unsubscriptions Are Free" Pwn Challenge [PicoGym]

"Unsubscriptions Are Free" (Pwn) challenge from PicoGym (picoCTF) - "Check out my new video-game and spaghetti-eating streaming channel on Twixer!". In this challenge we'll use Ghidra, GDB-PwnDbg and PwnTools to exploit a Use After Free (UAF) vulnerability and read the flag. Write-ups/tutorials aimed at beginners - Hope you enjoy 🙂 #Pwn #BinaryExploitation #BinExp #CTF #CaptureTheFlag #Pico #PicoCTF

↢Social Media↣
Twitter: https://twitter.com/_CryptoCat
GitHub: https://github.com/Crypto-Cat/CTF
HackTheBox: https://app.hackthebox.eu/profile/11897
LinkedIn: https://www.linkedin.com/in/cryptocat
Reddit: https://www.reddit.com/user/_CryptoCat23
YouTube: https://www.youtube.com/CryptoCat23
Twitch: https://www.twitch.tv/cryptocat23

↢PicoCTF↣
https://play.picoctf.org/practice/challenge/187
https://picoctf.org/discord
https://twitter.com/picoctf

↢Resources↣
Ghidra: https://ghidra-sre.org/CheatSheet.html
Volatility: https://github.com/volatilityfoundation/volatility/wiki/Linux
PwnTools: https://github.com/Gallopsled/pwntools-tutorial
CyberChef: https://gchq.github.io/CyberChef
DCode: https://www.dcode.fr/en
HackTricks: https://book.hacktricks.xyz/pentesting-methodology
CTF Tools: https://github.com/apsdehal/awesome-ctf
Forensics: https://cugu.github.io/awesome-forensics
Decompile Code: https://www.decompiler.com
Run Code: https://tio.run

↢Chapters↣
Start: 0:00
Basic file checks: 0:24
Review source code: 1:17
Ghidra analysis: 6:44
Debug with GDB-PwnDbg: 8:06
PwnTools Script: 13:07
End: 16:46