This is my last writeup for PlaidCTF! You can get a list of all my writeups here. Kappa is a 275-point pwnable level called Kappa, and the goal is to capture a bunch of Pokemon and make them battle each other!
Ultimately, this issue came down to a type-confusion bug that let us read memory and call arbitrary locations. Let’s see why!Continue reading