> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/binary-exploitation/9447-ctf-search-engine.md).

# 9447 CTF - Search Engine

Search engine was an interesting but difficult UAF challenge that I struggled with over the course of several weeks. You have to understand this was my first foray into heap exploitation too so to say I learned a lot from this challenge is an understatement. I've also been slowly working on my usage of pwntools for developing exploits, so please forgive me if my sample exploit isn't exactly opTiMIzeD.

This challenge taught me to...

1. Reverse-engineer a stripped binary
2. Download a target glibc version via ParrotOS
3. Patch the binary to utilize my target glibc version
4. Turn a UAF into a double-free, completing a dup-into-stack to gain nearly arbitrary read and write privileges and spawn a shell on the system

## Resources

* [9447 CTF 2015: Search Engine Writeup](https://gsgx.me/posts/9447-ctf-2015-search-engine-writeup/)