Prajwal's Blog

So I had this little idea of building an entire custom CPU instruction set architecture called Rune ISA from scratch - 42-bit instructions, 24-bit registers, a full VM in Python, an assembler, and a text-based RPG called Unknown Runes as a reversing challenge for ISSessions CTF 2026. It felt like the ISA needed more, so I uh made something.

So I was doing my internship at Trend Micro, and during my free time I was looking around at CTF challenges for ideas cause I was also a CTF Dev for ISSessions CTF 2026. One day, I asked a colleague of mine if he had any cool ideas and he showed me an article about a DEFCON challenge that had participants reversing a completely custom instruction set. I can't for the life of me find the link or even remember the challenge name (believe me I've tried finding it since), but the concept stuck with me like glue. A fully custom ISA, no documentation, just raw bytes and vibes, a true nightmare for the players ^w^.

So I was selected in one of the teams Sheridan is sending for cybersci and that meant I gotta prepare myself for the challenge, and what better way to do it than try a hard lab (I should have started with something easier, but atleast the pain was a learning experience). This is my writeup for BrainPan 1, or as I like to call it Brain Pain.

So my previous escapades into windows shellcoding led to me choosing to be more ambitious and thus deciding to try and make a Null byte free, Position Independent shellcode and embed that into an windows utility and having the shellcode to be executed by hijacking a ret call.

Basic Facts Components -         PASTA_MENTOR_PROMO_DEAL_agreement.docx.scr       (Initial Stage) [Program1.exe]      sha256 8d204db953fd7d637f8718f56fbecfbf93ebcc8e7402ce71d5c52b01689777a2       Program1.main.exe        (Second Stage) [Runs under InstallUtil.exe]      sha256 c7ce154d0ab5aec517829623f7b3b30a4e0ea6dc981fdf13134a8f263a062a9a   Malware Type: Injector/Info-Stealer  Windows PE | C# (stage 1) | Nim (stage 2)   --*--*--

In light of my previous success with handling windows API inside shellcode, I wanted to experiment more with what I had learnt.

I was busy making some mini hells for challenges for ISSessions CTF 2025, when I stumbled upon the idea of incorporating shellcode into it while learning about how to create malware (nothing illegal, promise). 

My first challenge as a part of the PMAT course, I have been provided a binary and been asked to analyse it, employing basic static and dynamic analysis methodologies I've learnt.

Very similar to the last lab, however this one focuses on analysis of the reverse shell malware.

The lab instructions are precise and we've got the hashes for the malware this time.

  I start by opening the lab and am made aware that the hashes for the malware weren't provided.

Some application try to prevent SSRF attacks by blacklisting requests containing certain keywords. This could be a good defense if done correctly however if done loosely it could still easily be bypassed.

Login authentication is often plagued with SQL Injection vulnerabilities and thus sanitisation of input from a webpage is all the more important. Such attacks can often lead to compromise of privileged accounts. I load the lab website and navigate to the login page and input the username 'administrator' with a random password:

This lab explores the lack of sanitisation of inputs while retrieving data from a database. This can lead to disclosure of sensitive information to unauthorised individuals and pose serious risk to organisations. I begin by visiting the site and find there are categories filters:

This lab demonstrates server side vulnerability of arbitrary command execution using requests to server. These are generally the result of improper data sanitization on the server and it can lead to giving complete control to the attacker. I begin the lab by loading the website and looking around:

This lab demonstrates the website's lack of proper checks on the file type of the upload and the flaws that arise from implicitly trusting the MIME Type / Content-Type header. I start the lab by loading up the website and logging in with provided credentials 'wiener:peter' and found a similar set to the previous lab I did for File Upload Vulnerabilities:

This Lab shows the flawed file upload methods present on some sites where they do not check for if the file being uploaded is the correct file type and not some malicious script. I started the lab by loading the website and logging in using the provided credentials 'wiener:peter' and went to the 'My Account' page to find the image upload option:

This Lab explores the web servers lack of protection against access of local network, often on internal private network the admin page for web servers is left unprotected due to the network being isolated but if the client facing server doesn't have necessary protections this basically allows the attacker to have free access to admin panel. I load the webpage and choose the first product to see the `POST` request it was sending and stumbled across a private IP:

This Lab demonstrates the lack of protection which allows someone to send request to the server's loopback access and receive output as if it was being accessed locally. I loaded the website and chose a random product to look the request it send for checking stock as that would be communicating as `POST` with the server so this could be used to send commands to the server:

This one was rather simple, it demonstrated the lack of verification controls some websites have for 2FA where they do not check if the user has passed the second check or not.