// the find
pwning/plaidctf2014
Source for some problems from PlaidCTF 2014.
Source code and solutions for several PlaidCTF 2014 challenges across crypto, pwn, reversing, web, and forensics categories. PlaidCTF is run by PPP (Plaid Parliament of Pwning) at Carnegie Mellon, one of the top CTF teams in the world, so the challenge quality is unusually high. This is a reference archive, not a tool — useful for studying CTF challenge design or working through old problems.
The challenge variety is genuinely good: hash length extension (mtpox/parlor), heap exploitation (ezhp), lazy evaluation reversing (hudak), XSS with a C OTP checker (bronies) — these cover real attack classes, not toy puzzles. Solver scripts are included alongside challenge source, so you can see both the intended vulnerability and a working exploit in the same directory. The web challenges ship full server-side PHP/Python source, which is exactly what you need to understand why the vuln exists. ezhp.c in particular is a clean, minimal heap challenge — good teaching artifact for understanding malloc exploitation.
No READMEs on most challenges — you get source and maybe a solver, but no explanation of what the challenge asked, what the intended path was, or what made it interesting. The repo is frozen at May 2014 and covers only a subset of that year's PlaidCTF problems, so if you're looking for a specific challenge it may just not be here. Build systems are bare Makefiles with no dependency documentation — several pwnables will need a 32-bit toolchain and specific libc versions to reproduce the intended environment, and there's no guidance on that. Solutions are single-author (mserrano) with no commentary, so they read as working scripts rather than educational write-ups.