H7CTF 2026

This challenge's binary is dispatch; the banner inside it is what names it. H7CTF 2026's pwn track artifacts for the challenge are titled dispatch.zip, and the feedback terminal's prompt…

For H7CTF 2026 the AI-category target here is a toy Solana SPL swap program. A raw-socket harness drives a self-contained re-implementation of the program loader, and solving it is:…

For H7CTF 2026 this Solana challenge ("perp_guard", target program perp_guard_solve) is about draining a transaction's compute budget through a crafted cross-program invocation, on a…

For H7CTF 2026's pwn1 challenge, the target binary is literally called manifest (its debug info says manifest.c), and its whole attack surface is a feedback terminal that echoes what you…

The H7CTF 2026 crypto target in this folder is a firmware-signing service built as an LMS-style hash signature scheme: WOTS one-time leaves wrapped in a Merkle tree (TREE_H = 4, 16…

pwn/4 of H7CTF 2026 hands you the ledger binary, its exact glibc 2.39 runtime, and matches everything with a classic tcache-overwrite chain on a four-action heap menu.

This H7CTF 2026 reverse challenge hands you a static, stripped Linux binary (vmrun, a "shard runtime") and eight-ish .shard files ("guardian agents") whose names are SHA-looking content…

For H7CTF 2026 this web-style challenge is a WebAuthn/FIDO2 Relying Party ("H7 Passport") with a twist: it accepts three attestation formats (packed, tpm, android-key), but only…

For H7CTF 2026's pwn/1 challenge, the target is gatecache (shipped inside keepalive.zip): a stripped PIE x86-64 C++ service, built on Ubuntu 22.04 / glibc 2.35, that listens on TCP 9006…

H7CTF 2026's misc/2 is a hardware-verification challenge with a crypto-challenge smell. The FoundryProof sign-off certifies a combinational 32-bit netlist as equivalent to a golden…

In H7CTF 2026's crypto track, a homomorphic-encryption analytics service leaks enough noise for full key recovery. The service is a minimal CKKS-style scheme over Z_q[x]/(x^N+1) with N =…

For H7CTF 2026 this hardware-adjacent challenge hands you a DOS ROM for a "recovered status panel" that boots under qemu-system-i386 (-drive format=raw,file=panel.rom). In stock…

Challenge Overview Category: Forensics / Memory Analysis Provided Files: - memory.lime.zst (Compressed LiME memory dump) - Q3_patient_records.pdf.locked (Encrypted document, 672 bytes)…

The binary is a "coprocessor" simulator. A 32×32 lattice of bits is grown for 7 generations of a linear (XOR) cellular automaton, and the result is bit-packed into a 128-byte page that…

Reverse engineering of the countersign PIE binary and a protocol-only solver that recovers the 24-byte RUN payload for any live instance.

A Sparrow Freight developer insisted the production carrier token never made it into a commit, and that the history was spotless. It was — the repository was pulled before anyone had a…

An Android password-manager APK (onyx-locker-2.4.0.apk, package com.onyx.locker) plus a live backend at https://web-f328e5c854ffc583.web.h7tex.com. The app's UI only ever prints bullet…

MURMUR is the control channel used between gateways and guest nodes in the Halcyon industrial mesh. This note is the fielded v1.2 profile. It is enough to read a link if you already hold…

Endpoint: https://web-dac032e81309a592.web.h7tex.com Start creds: AKIAANALYST0000000000 / wJalrAnalystSecretKeyEXAMPLEbPxRfiCY (region us-east-1) Start identity:**…

Nothing incriminating — the suspect's story holds. But notice the rowid gap: _id 4 is missing while 1,2,3,5,6,7 are present. Message 4 was deleted, not never-existed.

No sleuthkit and no root on this box, but debugfs / dumpe2fs read the image read-only straight from the file, which is all this needs.