Vesper — Missed-Handover Recovery
The bundle describes a deterministic recovery export from a small RV32IM fixture. An MCU talks to a simulated sensor hub and a two-lane RF bridge, both of which stay powered while the…
hotwater / research archive
CTF Writeup Archive
Exploitation, analysis and challenge solutions. Find the technique behind the flag.
177 writeups
The Ledger Access Gate
The landing page exposed a tiny API description:
The Export That Never Existed
The goal was to reproduce export job 204 from dispatch.capture, then calculate the SHA-256 of the exact bytes returned by the supplied exporter.
Thaw Ladder
We are given a 7.2 bench kit for thawd, a controller that executes small programs called thaw plans in a made-up 16-bit instruction set, FROSTLANG. The live pod runs an undocumented 7.3…
SILT Field Rack / Revision D
The service bundle silt-revision-d.zip contains:
Rime
No binary was provided, only a TCP service. On connect it prints:
Recovering the Sealed Manifest
The repository was "tidied up" through a history rewrite: old branches were force-pushed, the pre-rewrite history was left unreachable, and a deleted .env.local was removed from the…
Q.E.D. — Prove the Impossible
We are given qedvm, a static Rust proof checker for a small intuitionistic propositional logic called QPL. The goal is to submit a module whose exported definition has formula bot…
Poisoned Update
The target is a shared VX-410 controller exposed through a JSON API. The intended path is to stage firmware into bank B, boot the trial, pass the boot diagnostic, and confirm the trial.…
Neve
The service only exposed a TCP endpoint, no binary was provided. It prints:
Missing Receipt
We are provided with five forensic artifacts collected from a field relay environment: desc.txt: Challenge description stating that CRYO-LT-07 started an export at 03:17 UTC and pushed…
Ligatures & Liabilities
Inspecting site/index.html reveals a static client-side web page with no backend interaction:
Halo Telemetry Align
Requesting the endpoint returns a single ASCII bit:
Glacier
The challenge exposed only a TCP service with no downloadable binary. After connecting, it printed:
Frostline Hall C — Thermal Camera Patrol
We are given two lossless recordings of a thermal camera patrol:
Frost Paw
The unit starts each submitted job at a 64-bit register value x. After the job, it advances its ratchet by running a secret, six-line job on the same starting value. If that secret job…
Floe
The service starts with floe stream open. and a floe> prompt. It accepts a two-byte big-endian length followed by that many payload bytes:
Embedded Bytecode VM
The .bss range 0x403040–0x403160 is suspiciously large and is filled at runtime. The important part of .text is the function at 0x4003c0, which is passed directly to __libc_start_main:
Drumlin — Frostline Cold Archive (Build 2.4)
201 {"base":"https://.../s/ ","token":" "} ```
Drif
Only the remote service was provided. It offered:
Deadbit Thermostat
The power cut left a later epoch-1 page in NAND, but its journal checksum is invalid. The last committed resource is epoch 0. Its archive needs two pieces of volatile evidence: a key…
CryoVault Thaw Interlock (Firmware 4.3)
The vault thaws at a temperature of $2^{39}$. Four ordinary order requests can add less than $4\cdot 2^{32}$, so they cannot reach that threshold. The maintenance override accepts a…
CryoVault Dial Verification
I read CHART_NOTES.txt first. Its marking convention identifies a verified reading by a ring around one hex character with two lines beneath it. The number beside the ring gives the…
CryoVault 2.0
The archive is a ten-stage chain. Each stage's answer is the key to the next sealed record; the final ten answers together decrypt vault.sealed.
Conduit Preview — SSTI Filter Bypass
The target was a small Flask/Werkzeug label-preview service:
Cold Registry — frost-n04 Vault Release Code
The job was purged on 14 Jan, but the registry is copy-on-write. The four job/8149285a1114b9b0/... keys were tombstoned, while the old cursor leaf pages remained in freed pages. Each…
Cold Dock
Frostline Edge is the only public listener. It authenticates the client, assigns a role (viewer), and forwards a sealed CCIP manifest to vaultd, the cold core. The goal is to thaw the…
Chronoglyph
We are given chronoglyph.zip, containing a single disk image:
Borrowed Address — Recovering the Closing Batch
The recovered batch is recovered.fld2: 167 rows, 6,688 bytes.
Blizzard
Two-byte big-endian length followed by that many payload bytes:
Algebraic Mirage
public_exchange.sage gives the epoch 0 parameters, Alice's and Bob's public states, and a shuffled pool of 48 braid anchors. ciphertext.json contains seven frames. Frame e is encrypted…
Weighty Secrets
A hardened Merkle-Hellman knapsack: 96 public weights generated as a_i = r·b_i mod q from a tight superincreasing sequence, at density ≈ 0.91 — deliberately just under the 0.9408 CJLOS…
Two Keepers
A stego challenge built on visual secret sharing: two images (share1.png, share2.png) from a lighthouse keeper's apprentices. Individually they look like noise; XOR them back together…
Truncated Oracle
A stream cipher built on an LCG, leaking only the high 16 bits of each 64-bit state. The flag is XORed with the low bytes of the state sequence — so recovering the hidden low bits…
Total Recall
Total Recall (SunshineCTF 2026) is a statically linked, stripped x86-64 binary with essentially no code to reuse — but it leaks its own stack address and offers two full-chunk reads,…
TCTF Misc: Command Fuzzer
The TCTF 2026 challenge behind this folder presents a shell-like service on a remote host (TCP port 23, banner included) that ships with a very restricted command vocabulary. Without any…
TCTF Crypto
This TCTF 2026 crypto service ("Feed the BOX") encrypts every supplied 16-byte block with a custom AES variant under a fixed secret key, handshakes a checksum cryptogram (the key…
TCP Schrödinger
An incident-response-flavoured networking challenge: a TCP stream crosses the 32-bit sequence-number boundary, and an attacker injects ghost duplicate segments on the wrapped sequence…
Sparrow Freight Dispatch — Stack Overflow to ret2libc
This challenge's binary is dispatch; the banner inside it is what names it. H7CTF 2026's pwn track artifacts for the challenge are titled dispatch.zip, and the feedback terminal's prompt…
Solana Swap Emulator: SwapAToB Account Puzzle
For H7CTF 2026 the AI-category target here is a toy Solana SPL swap program. A raw-socket harness drives a self-contained re-implementation of the program loader, and solving it is:…
Smooth DH
A Diffie-Hellman instance with p = 1870283325551092163712001 — suspiciously small, and, as it turns out, with a fully smooth p - 1. The private exponent is recovered from the public key…
Small Private
An RSA key with a deliberately tiny private exponent d — small enough that Wiener's attack recovers it from the public key alone. The modulus, exponent and ciphertext are all that's needed.
Slow Motion
A looping loading animation left running on a harbour crane control panel — a GIF that never finishes. The hidden message is carried in the least-significant bits of the red channel,…
Shattered Oracle
Lunar CTF's SHATTERED ORACLE is a multi-stage crypto chain. The handout publishes 12 secp256k1 signatures whose nonces leak 40 bits (MSB- or LSB-truncated), a transcript of…
Route 666
An insane-tier core-backbone incident: BGP route flapping between two peers on a transit edge gateway, with a hidden exfiltration target. The core trick is reconstructing route flap…
Related Messages
Franklin-Reiter related-message attack: two plaintexts encrypted with the same RSA key (N, e = 3), where m₂ = m₁ + α for a known constant α. Two polynomial relations mod N with a known…
Pset1
pset1 is an introductory stack overflow NNS CTF pwn challenge. The handout/solve.py captures the whole exploit in 12 lines: the target binary's input handler overflows a stack buffer,…
Phantom Eclipse
The phantom_eclipse forensics challenge ships an evidence bundle (evidence/): a .ECL container (artifact.dat) of fourteen sec_NNNN sections, a notes.jpg, a suspicious_image.png carrying…
PerpGuard — Solana Compute-Unit Exhaustion via a Player CPI Program
For H7CTF 2026 this Solana challenge ("perp_guard", target program perp_guard_solve) is about draining a transaction's compute budget through a crafted cross-program invocation, on a…
Partial Exposure
RSA where the most significant bits of one prime are leaked — enough that p splits into a known high part and an unknown low part of manageable size. Coppersmith / Howgrave-Graham…
Paleter
A palette-swap stego challenge: an ordinary PNG whose hidden content lives in the PLTE chunk. The provided palet.py rewrites the palette so exactly one palette index is white and the…
Nostalgia
crypto_nostalgia is a brute-force-the-seed crypto challenge. The handout chall.py generates the AES-256 key from an LCG run 1337 times over a "nanosecond precision" time seed — but since…
Neve
Neve (ISFCR CTF 2026) is a noisy-channel statistical inference challenge against the SHARD-24's NEVE sounding head: you hand it symbols 0–15 and it answers with a single biased bit, the…
Monodromy
Monodromy (ISFCR CTF 2026) hands you a MONOVM3 capsule, two 8x8 matrices, and a stripped ELF that demands "the lost rotation index" before it will say anything useful. The rotation index…
Mirror
mirror is a pwn challenge shipped as a PIE x86-64 ELF served over socat (handout/mirror/ Dockerfile EXPOSE 1337). The binary stores records in a global session structure with two record…
Mirage
Mirage (ISFCR CTF 2026) was a remote binary at 0.cloud.chals.io:23023 that accepted input with an obvious format-string sink. Since only short, one-shot interactions were reliable over…
min-beste-venn (Chatflare)
forensics_min-beste-venn hides a chat conversation inside a capture.pcap of requests to a Cloudflare-fronted web app. Every asset the pair of participants fetches goes through…
Matrix Over Mind
RSA lifted from scalars to 2×2 matrices over Z/nZ: C = M^e mod n, with the public constants trace(M) = T and det(M) = D. The matrix analogue of RSA still leaks the plaintext because the…
Manifest — Format String Into Clearance
For H7CTF 2026's pwn1 challenge, the target binary is literally called manifest (its debug info says manifest.c), and its whole attack surface is a feedback terminal that echoes what you…
LUN4R-MU Timing Leak
The moonchace hardware challenge exposes a tiny VM ("LUN4R-MU") over TCP (103.49.131.90:31337) whose debugger accepts load $rN , load $rN 0($r0), batch … end, reset, and quit commands,…
LMS Firmware Signer: Leaf Zero for Free
The H7CTF 2026 crypto target in this folder is a firmware-signing service built as an LMS-style hash signature scheme: WOTS one-time leaves wrapped in a Merkle tree (TREE_H = 4, 16…
Linear Guess
An LCG with unknown a, c and known modulus m = 2³² leaks consecutive outputs, then uses the same generator as a keystream to XOR the flag. Recover a and c from three outputs, then…
Ledger — Tcache Poisoning Into free@GOT
pwn/4 of H7CTF 2026 hands you the ledger binary, its exact glibc 2.39 runtime, and matches everything with a classic tcache-overwrite chain on a four-action heap menu.
KumoSec ChainVault
Luna CTF hosted an EVM playground ("KumoSec ChainVault") behind a team-token API at http://103.49.131.90 with a JSON-RPC node at /chain/rpc. Two contracts exist: an AuditorRegistry…
Kintsugi Vault — Shard Chain, One Byte Chain Piece at a Time
This H7CTF 2026 reverse challenge hands you a static, stripped Linux binary (vmrun, a "shard runtime") and eight-ish .shard files ("guardian agents") whose names are SHA-looking content…
Kairo — Adaptive Instruction Classifier
A pwn challenge around kairothd, an "adaptive instruction classification engine": it learns how your program behaves, decides it is trustworthy, and stops double-checking. The binary…
H7 Passport — Legacy Attestation Path for Enterprise Tier
For H7CTF 2026 this web-style challenge is a WebAuthn/FIDO2 Relying Party ("H7 Passport") with a twist: it accepts three attestation formats (packed, tpm, android-key), but only…
Ground
The "ground" web challenge (SunshineCTF 2026) is the Punxsutawney Orbital Weather Authority's Perpetual Forecast Console. A leftover operator comment in the page source hands out a…
GitDumper
The GenCyS CTF 2026 challenge folded into this folder is a story-driven intelligence exercise around TheSecureTrust Bank: a mission-kickoff email carrying a nested alert.eml attachment,…
Ghost in the Wire
A network-forensics challenge whose answer is hidden in plain sight as a Base85 string in the incident artefacts. Decode it and the flag falls out.
GateCache — Heap Reuse Into Another Thread's Session
For H7CTF 2026's pwn/1 challenge, the target is gatecache (shipped inside keepalive.zip): a stripped PIE x86-64 C++ service, built on Ubuntu 22.04 / glibc 2.35, that listens on TCP 9006…
FoundryProof Tiny-HDL Equivalent-but-Sabotaged
H7CTF 2026's misc/2 is a hardware-verification challenge with a crypto-challenge smell. The FoundryProof sign-off certifies a combinational 32-bit netlist as equivalent to a golden…
Cut Me
The challenge handed over hereyougo.png, a PNG whose IHDR height field had been shrunk so most of the image was invisible in a normal viewer. Because JPEG-style truncation does not apply…
Cuspidal Drift
A custom "elliptic curve" cryptosystem with a = 0, b = 0 — the curve is
Common Modulus
The same plaintext encrypted twice under one RSA modulus with two different public exponents, e₁ = 65537 and e₂ = 65539. Since gcd(e₁, e₂) = 1, Bézout coefficients give the plaintext by…
CKKS Approximate-Decryption Key Recovery
In H7CTF 2026's crypto track, a homomorphic-encryption analytics service leaks enough noise for full key recovery. The service is a minimal CKKS-style scheme over Z_q[x]/(x^N+1) with N =…
BYOC
"Bring Your Own Code" — BYOC's chall.c does exactly what its name promises: it mmaps 200 bytes as RWX, reads up to 200 attacker-controlled bytes into it, and calls it. No bug to find at…
Broadcast Linear
Håstad's broadcast attack with a twist: the same message is RSA-encrypted under three moduli with e = 3, but the plaintext is first mapped through a known linear padding m' = a·m + b.…
Boneh-Durfee
A small-private-exponent RSA challenge placed just beyond Wiener's bound, so continued fractions alone fail. The private exponent is small enough for the Boneh-Durfee lattice attack…
Bit Flip CRT
Two RSA-CRT signatures over the same message, with a hardware glitch flipping a single bit in one signature's computation modulo q. That's the textbook setup for the Bellcore fault…
BGP From Hell
A core-network forensics challenge: an IXP border router's BGP session is captured, and the exfiltrated flag is smuggled inside BGP COMMUNITY attributes of eight UPDATE messages. Each…
auth-gw Biased-Nonce ECDSA
The captured_tokens.json artifact contains ECDSA session-attestation signatures intercepted from "auth-gw" (VLAN 12) on secp256k1 with SHA-256. A leaked commit note in gen_notes.txt…
Afterglow — DOS Panel ROM Bitplane Reconstruction
For H7CTF 2026 this hardware-adjacent challenge hands you a DOS ROM for a "recovered status panel" that boots under qemu-system-i386 (-drive format=raw,file=panel.rom). In stock…
Zygote Conspiracy
The two APKs cooperate to reconstruct an encrypted DEX payload. Each contains a 32,768-byte asset named half.bin. Their native libraries publish their own half through a memory-backed…
Turning Chart — Reverse Engineering
It is a stripped, statically linked, 64-bit x86-64 ELF executable. This means there are no helpful function symbols, so the validation logic must be located by inspecting its control…
Toxic Waste
The challenge provides chall.py and output.json. A trusted setup samples a secret integer tau and builds a structured reference string (SRS) containing successive powers of the secret in…
The Shape of Silence
The archive the_shape_of_silence.zip contains:
The Last Committed Message
Recover the note and its attachment record as they existed immediately after the operation committed for export export-07abca69cd99. The evidence consists of four ASCII strings, in order:
The Image That Forgot
Recover the incident token belonging to the container instance serving dispatch-ac1af5608a at 2026-08-14 10:10:08.555 +05:30. The input archive contains:
Sparse-change
Files provided:** chall (3).py, output (3).json
signed, but which original?
The challenge asks us to identify the derivative matching the constraints in case.json, reconstruct its manifest ancestry all the way back to the original capture, and use six exact…
PHANTOM-15: The Sensor That Transmitted Nothing
PHANTOM-15 was declared permanently offline during an industrial pressure incident. Although the gateway delivered a low-priority continuity report, it did not deliver the subsequent…
Phantom Mesh
An unrecognized device was observed on a Lumeta smart-lighting mesh, sending a periodic diagnostic report. The challenge supplies:
Ouroboros — Reverse Engineering
We are given a single executable named chall and must find the 32-byte input that causes it to accept our answer. Unlike a simple strcmp checker, this program transforms the input before…
One pound fish
The challenge required identifying a location from an image and submitting the associated market name as the flag.
last packet — Forensics
We are provided with a network packet capture file challenge2.pcap. Using tshark, we inspect the HTTP requests and responses contained within the capture:
Insanity Check 3 — CRYOVAULT 2026
The challenge pointed participants toward the CRYOVAULT 2026 competition rules. The clue was in Rule 2 — Flag Format, which appeared to show an ordinary example of the flag syntax.
Half-Truths
chall (1).py — the challenge generator, including the polynomial construction and encryption scheme. output (1).json — 512 shuffled shares, finite-field parameters, and the AES-GCM…
Ghost Spooler — Forensics
FP02CF4.SHD — Windows print-job shadow/metadata file FP02CF4.SPL — spooled print data scan.png — scanned printed page with a faint tracking-dot pattern Tools: file, strings (including…
Frost-ledger
The archive includes a registry.fvr volume, fvrctl, an SDK header, documentation, and daemon logs. The daemon uses fvregd 1.4.2 / on-disk format v1. In v1, the 16-byte cell descriptor…
Zygote-Conspiracy Bundle
The two apps are two halves of one decryption scheme. Each ships a 32 KB half.bin. At runtime the native libs exchange halves through sealed memfds, XOR them, and ChaCha20-decrypt the…
Write-hole
A 3-drive RAID5 NAS lost power while isfc-stage.py was rewriting a sealed report. Nobody saved the md settings, and the sealing key was burn-after-read. Recovery needed four steps:
Turning_chart
It is tiny (~10 KB), static, stripped, and uses raw syscalls (no libc). Running it:
The-press
the-press** (binary: chall_1_) is a stripped x86-64 ELF. It reads exactly 32 bytes from stdin, compresses them with a custom LZMA-style range encoder, and compares the 36-byte result…
The Deletion Echo
A regression service claims a deletion request was fulfilled by exact retraining. We get:
The Aggregate Remembers
A federated linear regression model (16 features plus a bias term, every label equal to 1) was updated over many rounds. Each round mixed three clients with integer mix weights, and only…
slab store
Connecting to the service prints a banner and a prompt:
SilverGate — silvergate.apk + base.odex
base.odex is not a real ART/OAT file — it's a hand-crafted container with a small AArch64 "native code" section and three methods:
Recurrence
We are given a stripped 64-bit ELF binary chall. Running it:
Prismwake
observations.json holds 6000 pairs (multiplier mᵢ, observation oᵢ) with
Parallax
The challenge provides model (1).py and observations (1).json. The forty silhouettes are modular subset sums of fourteen hidden atoms. Recovering the binary subset mask reveals the…
Palimpsest — Restoration Press 04
Running the binary with ? prints the archive catalogue. The live prompt also prints all the surviving job cards:
loom — Reversible Cellular Automaton Crackme
loom is a stripped x86-64 ELF that reads exactly 32 bytes from stdin, runs them through roughly a million generations of a second-order (reversible) cellular automaton, and compares the…
Leger
chall is a stripped 64-bit ELF that reads exactly 16 bytes of input and prints CORRECT iff the input satisfies a very specific arithmetic condition. At a high level the check is a…
leaky-eval — HTB Crypto Challenge
The challenge provides chall.py and output.json. The service uses a polynomial ring
Journal-necromancy
Given: a single 64 MiB NTFS raw image, evidence.img.
Implicit Twins — RSA Lattice Attack
The challenge provides two RSA moduli, N1 and N2, a public exponent e = 65537, and a ciphertext ct. The flag is textbook RSA-encrypted under N1.
Hidden Weights -
The challenge chooses ten secret weights a_1, ..., a_10 modulo a 200-bit prime M, then publishes 50 totals:
GHOST-13 offline investigation
The solution combines commit-journal recovery, TCP and Modbus fragment reconstruction, ECDSA nonce reuse, DTMF decoding, and an authenticated OTA decryption. All work is local; no…
Free-lunch
We are given chall.py and output.json. A permutation P acts on GF(p)^2 with p = 4611686018427387761 (a 62-bit prime, p % 3 == 2) over R = 20 rounds:
Field Console
Field teams use the Field Console handset app to talk to dispatch nodes on a depot network. Routine (operator) jobs work fine; the maintenance path is meant to be off-limits. We are…
End Mark
The worker read 24 payloads of 24 bytes each. Concatenating them in ascending slot order gives 576 bytes with SHA-256:
Cryovault Attestation
The front desk serves a small OCI-inspired registry. Each POST /session creates a private, writable copy of repository cryovault with:
coldpack — rimefold (IFSCR)
Service:** nc 0.cloud.chals.io 15036 — fresh process per connection.
Cassandra Fintech — cassandra-edge/2.3.1 (IFSCR CTF)
The edge proxy enforces its restricted-header rules only while decoding the primary HEADERS frame. By padding the header block so the sensitive headers fall into CONTINUATION frames, the…
Canonical-sin
The instance is a "Capability Broker" (auth-gw, Node/Express) that mills Ed25519-signed CBOR capability tokens, plus a secret vault (vault-api, Python/Flask) that enforces role + caps…
The Third Key Phase
The evidence fields, in the required order, are:
The Meridian
The site is a hash-routed SPA (nothing renders from the server). The useful surface is all in the JavaScript:
The API That Knows Too Much
The employee directory exposed internal employee records without enforcing that the requested record belonged to the logged-in user. The leaked debug_reference for another employee led…
The Alphabet That Wasn't There
The recovered evidence passes the AES-GCM authentication check supplied in the challenge.
one-more — Blind Schnorr "one-more" forgery via ROS
server.py is a blind Schnorr signing service over secp256k1. On connect it sends its public key for that connection:
Mirror Garden
The input to enter into the app's "whisper" field is:
Lossless Not Harmless
The supplied mosaic_0417.png is a 256 × 300 indexed-color PNG. It contains a palette, two text chunks, nine IDAT chunks, and no data after IEND. The picture looks like colorful noise.
LeetVault: The Hidden Test Case
The challenge page identifies the target as the legacy problem search. The Problems page shows that searches are sent to:
Keystone — Attestation Portal (boot2root)
Attack chain:** Jinja2 SSTI (RCE as webapp) → forged TPM attestation against the internal vault (VAULT-114) → leaked tpm-admin SSH key → TOCTOU symlink race in the measure-and-run sudo…
Ghosts in the Bulb — Local Version
The capture is plain, unencrypted MQTT from a dozen smart-home devices. Two devices hide data in covert channels:
Ghosts in the Bulb
The capture is plain, unencrypted MQTT from 12 smart-home devices. Two devices hide data in covert channels:
Fluxgate G3 — Factory Service Mode Bypass
A small industrial controller exposes a line-oriented ASCII maintenance service over TCP. Factory service mode is supposed to be reachable only by on-site technicians with a dedicated…
FlaGuard
This flag was confirmed accepted by the challenge submission system.
Faraday
The attachment is an Android diagnostic app for the LumoWise LW-7 smart bulb. Its UI accepts a 16-byte challenge response as 32 hexadecimal characters. The actual validation and flag…
ECHOCHAMBER — Boot2Root
The box protects its flags with a warden (/opt/warden/warden.py, runs as root). The real flag files live in /var/lib/warden/real/, while the decoys live in /var/lib/warden/decoy/. The…
ECHO-9
ECHO-9's watchdog recovery preserved its boot counter and restarted its transmit sequence. This caused a reset event to reuse the AES-CTR nonce of an earlier service response. The…
Draftpad
The application loads its document data from:
Sensor Logs
Unzipping the archive gives a second zip with four logs. Three of them (auth.log, network.log, system.log) each have a flag-looking string, but they're all decoys.
Redacted Minutes
redacted/XploitX_Stego03_Participants/extractions/NIGHTINGALE_memo_RESTRICTED.docx.extracted/0/word/document.xml 1. Zero-width chars in the RE: line → key. Map \u200b=10, \u200c=00,…
Two Faces
Base64-decodes to tw1n_f4c3s_4r3_h4rd ("twin faces are hard").
Port 0xBEEF (Hyper-Nested)
Incident Case File: #2026-2184-GAMMA | PORT 0xBEEF (HYPER-NESTED) Category: Networking / Network Forensics / Cryptography Target Flag Format: XploitX[beta]{...} (decoded as XploitXβ{...})
Orisond
Binary protocol: u32 command | args, reply u32 status | u64 value (cmd 5 replies with two qwords: arena base + code pointer).
Nested Steam Package
The challenge is a chain of nested archives ("nested stream package").
Neon Relic (07_neon_relic.mid)
The MIDI file is a container. A ZIP is appended after the MIDI tracks, and inside it is a PNG whose top three pixel rows hide the flag as a 1-bit-per-pixel bitmap. The other files are…
Double Exposure
file on double_exposure.jpg reveals a JPEG comment:
Biased Nonce
We are given a set of ECDSA-style signatures over the secp256k1 curve whose nonces were generated with a bias: the top 8 bits of each nonce are zero, i.e. every nonce k satisfies
Shadow Consent
Organization: Beacon Data Systems Incident Date: 2024-03-14 Analysis Date:** 2024-03-16
Welcome
We are provided with a packet capture file welcomecall.pcap.
TOMORROW-MART — SunshineCTF 2026
The storefront offers a Founder’s Vault deed as lot 4042 for 1,000,000 credits. New FutureBank accounts only receive 500 credits, so the intended path is to find a discount code that is…
Chrome Horizon — Manual Solve
1. Open the challenge site in Chrome. 2. Press F12 and open the Console tab. 3. Paste and run the following script:
St. Cascade General — Mid-Run Ransomware
Challenge Overview Category: Forensics / Memory Analysis Provided Files: - memory.lime.zst (Compressed LiME memory dump) - Q3_patient_records.pdf.locked (Encrypted document, 672 bytes)…
Hothouse
The binary is a "coprocessor" simulator. A 32×32 lattice of bits is grown for 7 generations of a linear (XOR) cellular automaton, and the result is bit-packed into a 128-byte page that…
Countersign attestation core v2
Reverse engineering of the countersign PIE binary and a protocol-only solver that recovers the 24-byte RUN payload for any live instance.
Sparrow Freight API — Leaked Production Token
A Sparrow Freight developer insisted the production carrier token never made it into a commit, and that the history was spotless. It was — the repository was pulled before anyone had a…
Onyx Locker 2.4.0 (mobile)
An Android password-manager APK (onyx-locker-2.4.0.apk, package com.onyx.locker) plus a live backend at https://web-f328e5c854ffc583.web.h7tex.com. The app's UI only ever prints bullet…
MURMUR v1.2 Mesh Control Protocol
MURMUR is the control channel used between gateways and guest nodes in the Halcyon industrial mesh. This note is the fielded v1.2 profile. It is enough to read a link if you already hold…
FlyWithHer.io
It fetches arbitrary URLs and returns their content, making it vulnerable to SSRF.
DeputyCorp Cloud Integration — AWS IAM Privilege Escalation
Endpoint: https://web-dac032e81309a592.web.h7tex.com Start creds: AKIAANALYST0000000000 / wJalrAnalystSecretKeyEXAMPLEbPxRfiCY (region us-east-1) Start identity:**…
Deleting a Thing
Nothing incriminating — the suspect's story holds. But notice the rowid gap: _id 4 is missing while 1,2,3,5,6,7 are present. Message 4 was deleted, not never-existed.
CherryPic — Cybercom
The home page exposed a CherryPic image-metadata feature:
"sudo zip, sudo shred, zero proof"
No sleuthkit and no root on this box, but debugfs / dumpe2fs read the image read-only straight from the file, which is all this needs.
Lunar Forensic Challenge 4
A PNG image (case_evidence.png) containing multiple layers of hidden data.
Roulette Online
The program starts with a balance of 10 and lets us place roulette wagers. A successful spin doubles the wager, while a losing spin subtracts it from the balance. The flag is printed…
ET — Tu Brute
The crew's inside man left a note taped under a desk, written for someone who "already knew the rotation." No key was given — but old habits die hard, and this cipher has exactly 25…
Blackout Gateway
The Blackout Gateway is a simulated API security console with a server-side fetch simulator, JWT token workbench, and an admin console. The goal is to bypass an SSRF filter, forge a JWT,…
Web Hacker 2
A beginner web exploitation challenge focusing on IDOR (Insecure Direct Object Reference) vulnerabilities.
Hiding in Your Wi-Fi
We land on a machine at 10.10.10.66 with arpspoof and tcpdump available. The network contains:
VVDrug Cartel — Web
Dont you dare to enter here. You thought it would be this easy ? huh.
The Secure Trust Bank — RAG Data Leakage
This challenge demonstrates a RAG (Retrieval-Augmented Generation) data leakage vulnerability. An AI chatbot exposes restricted/classified documents through its retrieval layer, and the…
SecureTrust Mobile — Forgotten
The challenge presents a "QA" build of a mobile app. Solving it requires:
SecureTrust Cluster Registry
The challenge is a Kubernetes container-registry portal. From a highly restricted service-account, the goal is to reach full cluster admin (system:masters) and read a secret containing…
No matching writeups
Try another event, category or search term.