lab Challenge series

ARM Exploitation Challenges

Dive deep into low-level Reversing & Exploitation techniques on ARM architectures.
Designed for:
  • Reverse Engineers and Exploit developers
  • Security researchers
  • ARM CTF enthusiasts 
  • Embedded Mobile device and System security professionals
Write your awesome label here.

Explore the Challenges

What’s Inside?

A collection of fun and diverse vulnerable ARM64 binaries purpose-built to challenge and sharpen your skills.

Challenge: Heap Overflow Hijack 💥📦

You’ve stumbled upon a strange binary that allocates two chunks of memory on the heap: one for your input, and one that contains... something suspicious 🤔

Your goal is to exploit the overflow to overwrite a nearby function pointer in memory and hijack control flow to execute the hidden win() function — which, if called, will spawn a shell and drop a flag right at your feet 🎯

Can you control the heap precisely enough to get what you want?

Objective

Redirect execution to win() function

Challenge: Challenge: ROP: Return to Win 🔁💣

Welcome to the world of ROP (Return-Oriented Programming), where you don’t need shellcode, all you need is just a well-placed return address 💥

You must craft a payload that overwrites the return address to call a hidden function named win()

If you succeed, you'll be rewarded with a shell and a shiny flag waiting in /home/ctf/flag.txt 🏴‍☠️

Can you control the stack precisely enough to redirect execution and become a ROP master?

Objective

Redirect execution to win() function

Challenge: Use After Free — Callback to Shell 🧠💣

Welcome to the wonderful (and dangerous) world of heap exploitation where one forgotten pointer can lead to a full system compromise. In this challenge, you’re dealing with a vulnerable program that manages a simple user structure with a name field and a function pointer (callback).

Your goal is to overwrite the freed callback pointer with the address of a hidden win() function. If you succeed, calling the callback will hand you a shell on a silver platter — and a flag to go with it 🎯

Can you control the heap layout, overwrite the function pointer, and execute your payload before the system catches on?

Objective

Redirect execution to win() function

Challenge: Stack Smash Classic 🧨🧵

Welcome to a throwback to one of the most iconic vulnerabilities in exploitation: the classic stack-based buffer overflow.

All you need to do is overflow the buffer, overwrite the return address, and redirect execution to a hidden win() function that pops a shell.

Sounds simple? It is, if you know your ARM64 stack layout and can craft the perfect payload 🧠🔧

Objective

Redirect execution to win() function

Challenge: Say My Name — Format String Attack 🎤🪓

You’ve seen printf(name) in wild CTFs and war stories, and now it’s your turn to exploit it.

This binary greets you by asking for your name… then recklessly echoes it back.

This opens the door to a powerful format string vulnerability, giving you the ability to leak memory, dump stack contents, and possibly even control execution, depending on your skills.

Your mission: abuse this format string bug to leak critical addresses from the stack. The win() function is already sitting there, and your job is to find a way to get to it.

Objective

Redirect execution to win() function

Challenge: Blind Format — Echoes in the Dark 🕳️🧵

Most format string challenges are loud. This one? Completely silent.

In this challenge, the program takes your input and passes it directly to fprintf(stderr, input), creating a classic format string vulnerability, except there’s a twist.

This is a blind format string bug, meaning you’ll have to get clever. No printed stack dumps, no visual feedback. You’ll need to leak memory, discover offsets, and potentially redirect execution, all without seeing a single %p.

But if you figure it out, there’s a hidden win() function waiting to reward your effort with a shell and a flag.

Objective

Redirect execution to win() function

Challenge: ROP — Triple Threat 🔁🔁🔁

Welcome to the world of ROP chains, where you don’t call functions, you build them 🧩

In this challenge, you’ll face a classic stack buffer overflow, but rather than simply jumping to win(), your task is more surgical. You must craft a ROP chain that calls three specific function gadget1 -> gadget2->gadget3 — one after the other in the correct order.

No shellcode. No shortcuts. Just a clean, crafted return chain that walks through memory like it owns the place.

Objective

Redirect execution to call the functions gadget1 -> gadget2->gadget3 in the same order

Challenge: Type Confusion — Cast Away 🌀🧠

Sometimes, it’s not what you allocate, it’s how you use it.

In this challenge, you’re dealing with a classic type confusion bug.

And guess what? You control the input that populates that memory before the cast happens.

That means you can smuggle a function pointer into the structure, and when the program tries to call it, boom you get arbitrary control of execution. If you manage to redirect execution to the hidden win() function, you’ll be rewarded with a shell and the flag.

Objective

Redirect execution to win() function

Challenge: Use-After-Free — Fake Vtable, Real Shell 🎭📦

Welcome to the world of memory reuse and object fakery. In this challenge, you’ll exploit a classic Use-After-Free vulnerability by crafting a fake vtable-like structure which is a technique commonly used in real-world C++ exploitation.

Your goal? Make the program believe in your fake vtable, and win().

Objective

Redirect execution to win() function

After You Upload Your Solution:

01    

Review

We’ll review your submission to confirm correct exploitation. This may take up to 5 business days
02    

Certification

Successfully completing the challenges earns you a verified digital certificate to showcase your skills
03

Recognition

Add your certificate to your LinkedIn profile and portfolio, validating your hands-on skills in ARM64 exploitation

Earn a Free Certification and Showcase Your ARM64 Expertise

Outcomes & Takeaways

Each ARM challenge is designed to sharpen your skills and simulate the kinds of problems you’d face in the field. Here's what you’ll walk away with:
 Hands-On Exploitation Skills
Practice reverse engineering, static and dynamic analysis, and bypassing security controls that apply to real ARM based binaries.

 Real-World Scenarios
Work with multiple binaries that have vulnerabilities ranging from classic heap overflows to subtle use-after-free bugs that simulate the challenges you'd face in real world cases for ARM64 exploitation.

 Tool Proficiency
Get comfortable using tools like pwndbg, radare2, Ghidra, and more in practical settings.

 Security Mindset
Train yourself to think like an attacker: identify weaknesses, understand threat models, and build intuition around ARM binary attack strategies and defense evasion.

 Portfolio-Ready Experience
Build a strong foundation that you can showcase, whether you are applying for security roles or contributing to embedded environments.

Are you ready to test your ARM Security skills?

Turn theory into practice, and see how far you can go.