[ WRITEUP NODE / FIELD REPORTS ]
SOLVED CHALLENGES & FIELD ANALYSIS
Documented challenges from competitions we have participated in, written by the members who solved them.
Pickle Rick ELF Challenge Write-Up Description "I turned my ELF binary into a pickle, Morty! Note: not related to the python pickle library" Solution Analyzing the File First, looking at pickled.txt, it contains a...
Read more →RSA Dreams - CTF Writeup The Challenge We are given a zip file rsa dreams dist.zip which contains two files: encrypt.py: A Python script showing how the secret message (the "flag") was locked. output.txt: A text file...
Read more →Solving the "Custom Cipher" CTF Challenge In this challenge, we are given a Python script that encrypts messages, an output.txt file containing the scrambled encrypted message (the "ciphertext") and a scrambled look-up...
Read more →CTF Write-up: GLaDOS Network - Alright. Paradox time Challenge Description To maintain a constant testing cycle, I simulate daylight at all hours and add adrenal vapor to your oxygen supply. So you may be confused about...
Read more →Chromatic Challenge Write-up The Goal The objective of this challenge is to find a hidden flag within a video file named chromatic.mp4. The description given to us is simply: "Red". The Solution Process Step 1: Examine...
Read more →Stereotyped Message Attack CTF Writeup Flag: byuctf{cuz st3r30typ3s hurt 92de04} Here is a step-by-step, simple explanation of how we found the hidden flag for this challenge! The Setup When we open the challenge files,...
Read more →Kittiessss - CTF Challenge Write-up Introduction In this challenge, we were given a website related to cats (https://cats.chals.cyberjousting.com) and a downloadable file containing the source code of the application....
Read more →RCaaS Writeup This challenge provides a Linux executable binary called rcaas. The goal is to reverse engineer this program and discover the hidden flag. Step 1: Investigating the Binary First, we checked what kind of...
Read more →Incontinent - CTF Writeup The Challenge We were given an executable program (incontinent dist) and a remote server address (chals.cyberjousting.com:1366). The description told us that the flag was located on the remote...
Read more →Ouroboros — Rev CTF Write-up Flag: r00t{0ur0b0r0s 6f86002f214455d445fd6522} Description "Can you escape it?" The challenge is a VM inside a VM. The outer VM's program is a single HLT. After it runs, the ouroboros binary...
Read more →350 points. Three endpoints, all described on the page. A roster, a recovery flow, and a door.
Read more →300 points. The page was a soccer-themed desk with two API hints: lists documents, opens one. I started with the list.
Read more →450 points. The blurb was one line: the old theater has seen a few surprising acts.
Read more →A cinema-themed login at guarding a . Unauthenticated visits to redirected to . The vault, once opened, listed secrets including an encrypted and exposed a endpoint plus a JavaScript constant holding an encoded key.
Read more →A fan-club greeting page with a single message field. Whatever I typed came back inside an on the same page. The hint said nothing looked wrong at first and that things would reveal themselves on the way back, which suggested the output deserved a closer look.
Read more →> Something went wrong. Then, somehow, everything looked normal again. > The system recovered quickly — but...
Read more →450 points. The blurb had three instructions packed into one paragraph: reach the reviewer, slip into the hollow, and take what the staff keep there.
Read more →150 points. The blurb just said travel light, leave room for discovery. That turned out to be literal.
Read more →There was no web page to look at. Opening the main address just returned JSON and set a cookie. I saved both. The cookie was a token, the body said:
Read more →A dispatch console with a URL fetcher. The page sent JSON like to and rendered the fetched headers and preview. The text around it stressed things meant to stay inside and files already in place, which pointed at server-side fetching as the way in.
Read more →A record-store login page with two fields: username and access level. The access-level selector only offered , and the login script sent the request with a fixed header. After login the page linked to , described as a listening room.
Read more →350 points. One text field, a greeting back, nothing else. The page title was CITRUS STUDIO and the form said "Lock Up The Usual Suspects", which felt like a hint about what kind of mistake was sitting behind it.
Read more →550 points. The front page was all light colors and a little in-browser console for hitting the API. Two endpoints mattered: one to open a visitor session, one to submit a proof with a layout. I spent a while on the layout before I realized the token was the real door.
Read more →300 points. The page was an upload form for a street art gallery. It accepted files and showed a success box with a URL. The first thing I did was try a PHP file with the wrong MIME type.
Read more →450 points. The landing page was a newsroom skin called THE DAILY SCOOP. Two links mattered: a press pack zip and a record search. I grabbed both before I thought too hard about the story.
Read more →A Flask login page titled Pole Position with a username and password form. Any visitor could try to log in. A successful login as a normal user returned , which told me the flag was only shown to the account.
Read more →A museum collection page that fetched user records through XML. The front end built a small document like and posted it to , then rendered the returned fields. The description hinted that one catalog pointed to a second, unrelated store of data.
Read more →A Flutter AOT app, package , about 47 MB. It shows a lock, the words *Device integrity required*, and a button: **Run integrity scan**. Tap it honestly and it refuses, because the device really is compromised. Tap it after convincing it otherwise and it decrypts the secret and writes it to a sqflite database at , which only root can read.
Read more →> A favorite record deserves another listen. > The needle drops, the familiar rhythm returns, and somewhere between the first play and the replay, something feels different.
Read more →200 pts. Forensics. The description pointed at a replay system still serving old data:
Read more →> The streets are quiet, the lights are fading, and one delivery is still waiting to be collected.
Read more →An internal cache service accepts serialized objects over HTTP and deserializes them directly. Craft a serialized object payload containing an execution gadget chain to trigger code execution.
Read more →A dynamic notification system evaluates user-supplied greeting strings directly inside a server-side template engine. Escape the template interpolation block to execute commands within the underlying runtime.
Read more →An enterprise API gateway hosts a GraphQL endpoint with production introspection queries left enabled. Probe the introspection schema to enumerate hidden object types and query the administrative flag field.
Read more →An internal identity directory misconfigures Cross-Origin Resource Sharing by dynamically reflecting arbitrary headers with credentials allowed. Exploit the origin trust flaw to capture sensitive profile records.
Read more →A client-side dashboard merges nested JSON state objects recursively into the global application prototype. Pollute Object.prototype properties to bypass the access-control filter.
Read more →A financial invoice processor parses uploaded XML payloads with external entity expansion enabled. Define a custom XML entity pointing to internal system resources to read local files. **FORMAT:** FLAG{ }
Read more →A document conversion microservice fetches external image URLs on behalf of users. Exploit the server-side fetching mechanism to query internal cloud metadata endpoints inaccessible from the external perimeter. **FORMAT:** FLAG{ }
Read more →A microservices token service validates JSON Web Tokens but accepts signatures marked with the unsigned algorithm type. Forge an administrative token payload with a null signature. **FORMAT:** FLAG{ }
Read more →An enterprise report viewer ingests document filenames through a GET parameter to serve static files. Escape the restricted document directory using relative path sequences to read sensitive system configuration records. **FORMAT:** FLAG{ }
Read more →A perimeter authentication portal concatenates user-supplied form fields directly into backend database query strings. Exploit the boolean evaluation flaw to authenticate as the root operator without a valid password. **FORMAT:** FLAG{ }
Read more →[BASIC] 05 Git Metadata Leak 100 web basic cwa2026 A production web application deployed its webroot directly from an active version-control directory. Query the exposed .git object database to reconstruct historical repository commits and recover the redacted credential. FORMAT: FLAG{ }
Read more →> A logistics inventory management console validates user checkout permissions via hidden DOM parameters > before submission. Audit the client-side markup and manipulate the internal form values.
Read more →> A corporate portal attempts to hide restricted administrative paths by defining crawler exclusion standards without enforcing endpoint authentication. Inspect the spider directives to discover the unlinked directory.
Read more →An internal administrative session manager encodes client state directly into browser cookies using predictable transformations. Alter the serialized identity parameters to elevate privileges to administrator status.
Read more →A regional payment gateway diagnostic endpoint was exposed during a rollout. The web server emits sensitive debugging flags and authorization headers inside its HTTP response metadata. Inspect the exchange headers.
Read more →An enterprise single sign-on assertion parser verifies signed XML blocks but checks assertion attributes outside the signed scope. Apply XML Signature Wrapping (XSW) to inject an unauthorized administrative identity. **FORMAT:** FLAG{ }
Read more →A target binary implements active debugger detection via system tracing calls, intentionally terminating if monitored. Bypass or neutralize the anti-debugging checks to step through the execution path. **FORMAT:** FLAG{ }
Read more →A high-performance calculation engine derives verification keys into processor registers during execution before zeroing them out. Inspect dynamic register states at the calculation breakpoint. **FORMAT:** FLAG{ }
Read more →A compiled licensing binary checks for hardware dongle responses and immediately branches to an error handler. Modify the conditional jump instructions in the binary to force successful validation. **FORMAT:** FLAG{ }
Read more →An enterprise middleware component was retrieved as a compiled JVM bytecode class. Decompile the class structure to audit the secret derivation method. **FORMAT:** FLAG{ }
Read more →An operational automation script was deployed only as compiled Python bytecode (.pyc). Decompile the bytecode into source logic to review the validation conditions. **FORMAT:** FLAG{ }
Read more →A dropped executable was modified with an executable packer to obstruct static analysis tools. Unpack the compressed sections to uncover the core disassembly. **FORMAT:** FLAG{ }
Read more →A proprietary credential validator dynamically links against standard C library routines to evaluate passcodes. Trace the dynamic library calls during verification to intercept the argument comparison. **FORMAT:** FLAG{ }
Read more →The artifact is presented as a compiled binary but is 98 bytes. Its first sixteen bytes are the ELF identification string, and from offset 16 onward it is ASCII rather than machine code:
Read more →A firmware blob extracted from an edge sensor operates on bare-metal AArch64 hardware without an underlying OS kernel. Disassemble the reset vector and memory map. **FORMAT:** FLAG{ }
Read more →A client-side authentication routine was compiled to WebAssembly. Decompile the WASM module into readable text representation to locate the hardcoded validation logic. **FORMAT:** FLAG{ }
Read more →The service allocator manages small dynamic allocations via glibc thread-local caching bins. Corrupt the forward pointer of a freed tcache chunk to force the allocator to return an arbitrary memory location. **FORMAT:** FLAG{ }
Read more →A session management service fails to nullify object pointers following dynamic deallocation. Allocate a crafted structure into the freed chunk to hijack the subsequent function pointer dereference. **FORMAT:** FLAG{ }
Read more →A transaction buffer allocates storage based on user-supplied item counts multiplied by record size. Provide boundary integer values to trigger an arithmetic overflow, resulting in an undersized allocation. **FORMAT:** FLAG{ }
Read more →A diagnostic routine passes user input directly into a formatted output function without format specifiers. Exploit direct parameter access specifiers to leak pointers and secret data from the stack. **FORMAT:** FLAG{ }
Read more →An embedded service allocates an executable memory region and transfers execution directly to the submitted buffer. Craft compact machine code to read the flag from the environment. **FORMAT:** FLAG{ }
Read more →An access-control check compares a local stack variable to an administrative magic constant immediately following a buffer read. Adjust input length to overwrite the adjacent stack variable. **FORMAT:** FLAG{ }
Read more →A legacy management daemon running on internal infrastructure reads unchecked user input directly into a fixed-size stack frame. Overwrite the saved instruction pointer to hijack execution to the victory subroutine. **FORMAT:** FLAG{ }
Read more →Given a severe constraint on available ROP gadgets, the sigreturn syscall mechanism permits an entire processor register context to be forged from user-controlled memory. **FORMAT:** FLAG{ }
Read more →Domain telemetry alerted on anomalous Ticket Granting Service requests utilizing degraded encryption ciphers. The intercepted authentication handshake contains an encrypted service ticket payload. Recover the plain authorization token. **FORMAT: FLAG{ }**
Read more →A workstation used by an insider threat was impounded. While the operator cleared their screen, raw SQLite databases storing visited resources, auto-completion caches, and local session artifacts remain on the disk. Uncover the submitted credentials. **FORMAT: FLAG{ }**
Read more →Following an emergency drive seizure from a compromised hypervisor node, examiners isolated the raw Master File Table. Although the operating system reported the flag document as deleted, residual record extents remain preserved across resident attributes. **FORMAT:** FLAG{ }
Read more →Border firewalls observed abnormal ICMP Echo Request size variance moving toward an unclassified off-shore IP. Data payloads within each echo request contain sequenced fragments of an exfiltrated token. Reassemble the payload stream. **FORMAT:** FLAG{ }
Read more →An encrypted archive discovered on an adversarial staging server protects exfiltrated audit records. One member file is known to be identical to an unmodified open-source operational license. Exploit the stream cipher implementation to recover the archive passkey. **FORMAT:** FLAG{ }
Read more →Regional listening stations intercepted an encrypted acoustic carrier pulse over VHF frequencies. Intelligence confirms the message modulates high-frequency phase shifts into an ambient WAV recording. Extract the hidden dispatch. **FORMAT:** FLAG{ }
Read more →During a malware staging event, an adversary altered the file signatures and chunk CRC checksums of an internal floor layout graphic to evade automated gateway sandboxing. Restore the damaged structural markers to render the hidden image. **FORMAT:** FLAG{ }
Read more →A physical flash memory drive recovered from an unauthorized drone flight near a maritime container terminal contains surveillance photography. Threat actors failed to purge hardware markers and geodetic tags before abandoning the unit. Audit the internal file descriptors. **FORMAT:** FLAG{ }
Read more →The brief describes a workstation that was transmitting supervisor credentials over an unsegmented internal network, and the capture was taken before anyone isolated the interface. The traffic is therefore still in cleartext, and the task is to reconstruct the single request that carried the key.
Read more →A live RAM acquisition preserved the runtime memory of an active OpenSSL cryptographic routine during an active TLS tunnel. Extract the expanded round keys directly from the key schedule buffer to recover the session master secret.
Read more →Adversaries executed an unlinking routine across a Linux database server to prevent incident analysis. Given a raw unallocated disk partition slice, trace the unlinked inode structures and reconstruct the cleared records. **FORMAT: FLAG{ }**
Read more →A rogue microcontroller was detected posing as a standard USB human interface peripheral on a critical infrastructure terminal. The provided capture recorded raw interrupt transfers detailing keystroke scan codes. Decode the keystroke sequence. **FORMAT: FLAG{ }**
Read more →Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.
Read more →Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.
Read more →Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.
Read more →Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.
Read more →Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.
Read more →Decoding the segment yields the same string, which confirms the encoding rather than revealing anything further. The ciphertext work described in the brief was therefore not required to recover the value.
Read more →An industrial telemetry broker exposes an unauthenticated MQTT message bus to the internet. Intercept subscribed topic streams carrying sensor metrics and operator commands. **FORMAT: FLAG{ }**
Read more →Telemetry monitors detected anomalous BGP routing advertisements hijacking an Autonomous System Number prefix. Correlate historic routing table updates to identify the rogue origin AS. **FORMAT: FLAG{ }**
Read more →A public-facing web gateway exposes an unauthenticated SSRF endpoint. Query the cloud Instance Metadata Service (IMDSv1) to extract temporary instance credentials. **FORMAT:** FLAG{ }
Read more →A developer removed an access key from a production repository in a recent commit, but the historical change log remains intact. Audit the commit graph and detached dangling commits. **FORMAT:** FLAG{ }
Read more →Adversaries published a video claiming to stage operations outside a regional energy sub-station. Analyze spatial markers, transmission pylons, and topographical shadows to identify the exact coordinates. **FORMAT:** FLAG{ }
Read more →A company migrated its internal administrative panel behind a private tunnel, but historic DNS records still log the original public IP coordinates. Identify the historical records. **FORMAT:** FLAG{ }
Read more →A pod running within an internal cluster has an attached service account token with excessive cluster role bindings. Query the Kubernetes API to pivot into administrative secrets. **FORMAT:** FLAG{ }
Read more →A microservice container was provisioned with the host's mounted into the runtime environment. The Docker API socket can be used to escape the container boundaries. **FORMAT:** FLAG{ }
Read more →A compromised low-privileged service account holds limited permissions across cloud resources. Identify configuration oversights to attach broader administrative policies to your role. **FORMAT:** FLAG{ }
Read more →An automated asset deployment script created a cloud object storage repository with public read access. Identify the bucket namespace and retrieve the unlisted storage objects. **FORMAT:** FLAG{ }
Read more →A suspected dark fleet vessel rendezvous was captured off the East African coast via Synthetic Aperture Radar (SAR). Analyze radar reflectivity anomalies within the raw telemetry dataset to track the rendezvous coordinates.
Read more →Adversaries operated within an under-monitored secondary cloud region. Parse multi-region CloudTrail audit logs to identify anomalous API calls and carved secrets. **FORMAT: FLAG{ }**
Read more →Audit logs reveal a developer role with permission to create temporary debugging pods. Exploit the cluster RBAC privileges to execute commands within the control plane namespace. **FORMAT: FLAG{ }**
Read more →Herbarium A Goppa code over GF(43^2) hid five messages behind burst errors and a 78-million-step time-lock. I recovered the hidden support signs with a linear system, decoded exactly at the interleaved bound, then...
Read more →ucas Flag: gaslightCTF{m4n1f3st1ng e4sy 0ff3r5 f0r ev3ry0n3 c2b03a9886c1} Overview ucas is the "university application" challenge (a play on the UK UCAS admissions system). It has two bugs : A format string on the...
Read more →good-enough Category : pwn Difficulty: beginner–intermediate (classic ret2win with a PIE leak) Author: sportshead Attachments: good-enough.tar.zst containing good-enough (binary), libc.so.6, ld-linux-x86-64.so.2 Remote:...
Read more →icon-sketch Category: forensics · Author: riyc Description: "the pee people found the first version of the gaslightCTF icon... apparently theres a flag in here?" Attachment: icon.zip → icon.png (2000×800 RGBA,...
Read more →blackout Category: forensics · Author: riyc Description: "i was doing my work, then my power went off! my computer spat this out afterwards, can you recover the flag?" Attachment: recovered file (PDF 1.4, 8 pages, 106...
Read more →corridors Category: web · Points: 500 · Author: sportshead Description: "The path will guide you to the flag." Service: https://<instance>.play.gaslightctf.cooking:1337 Flag: gaslightCTF{fr33d0m 4t l4st 3ebe19fd9908}...
Read more →down-the-stream-2 — gaslightCTF 2026 writeup Category: crypto (456 points) Author: william etotheipi Solves: 67 Series: down-the-stream (part 2 of 2) Flag: gaslightCTF{st0p-rev3al1ng-4ll-the-pl4int3xts} "The author...
Read more →down-the-stream-1 — gaslightCTF 2026 writeup Category: crypto (500 points) Author: william etotheipi Solves: 77 Series: down-the-stream (part 1 of 2) Flag: gaslightCTF{d0nt-r3veal-y0ur-co3ff-v3ct0r} "A synchronous...
Read more →Where the dream starts 3 Category: crypto (500 points) Author: william etotheipi Solves: 58 Challenge: "A modification of a very nice classic." Flag: gaslightCTF{theindecipherablecipher} --- Table of contents Challenge...
Read more →jsbox — gaslightCTF 2026 writeup Category: misc (100) Author: sportshead Solves: 201 Service: ncat --ssl <instance>.play.gaslightctf.cooking 31337 Flag: gaslightCTF{n4t1v3 c0d3 0r n4t1v3 fl4g? 0142da7d4c7e} "I created a...
Read more →json-warehouse Category: Web Author: sportshead Platform: BergCTF / gaslightCTF infra Deployed as: single compiled Bun binary on a distroless container Flag: gaslightCTF{p0llut3d w4r3h0us3s ar3nt v3ry s4f3 c0nd1ti0ns...
Read more →messageboard Challenge I left a little message for only my closest friends :) Endpoint: https://<instance>.play.gaslightctf.cooking:1337 Source: messageboard.tar.zst A Bun + Postgres message board. Every seeded user...
Read more →biscuit Challenge Hello world! italics bold Endpoint: https://<instance>.play.gaslightctf.cooking:1337 Source: biscuit.tar.zst A Flask app that uses Biscuit authorization tokens for authentication. The flag is only...
Read more →badcat Challenge you've seen batcat, are you ready for badcat? Login: badcat:b4788c115ea4eb42 Service: ssh -o "ProxyCommand=ncat --ssl %h %p" <instance>.play.gaslightctf.cooking -p 31337 The flag lives at /flag (mode...
Read more →ram-conservation Challenge RAM prices are going up due to AI, this shell reduces memory use by limiting your inputs. Find the flag! Service: ncat --ssl <instance>.play.gaslightctf.cooking 31337 The remote shell is a...
Read more →gaslightCTF — crypto: CompleteHTTP Challenge: CompleteHTTP Category: crypto Author: William Tu / sportshead Flag: gaslightCTF{gu3s5 y0u n33d l0ng sl33v35 ev3n in 5umm3r?} Description How do you make RSA fashionable? The...
Read more →gaslightCTF — rev: Compiled Source Sheets Challenge: Compiled Source Sheets Category: rev Author: sportshead Flag: gaslightCTF{ch3ck 0ut lyra-horse!! 2QY90H6F} Description My new VM is Spectre-proof! It's also...
Read more →Intergalactic - Beacon v0 Summary The binary is a stripped 64-bit PIE ELF that always prints 72 bytes, but that output is not the flag directly. There are two layers: main builds a 72-byte beacon buffer. If a success...
Read more →CTF Write-up: Flappy Challenge Information Name: Flappy Points: 500 URL: http://exp.cybergame.sk:7010 Initial Discovery Upon visiting the challenge URL, we are presented with a Flappy Bird game clone. The page title is...
Read more →Tower of Hanoi Revenge - Writeup Challenge Overview The "Tower of Hanoi Revenge" challenge provides a network service and a zip file containing an emulator environment. The goal is to obtain the flag hidden within the...
Read more →Writeup – Where the dreams start Part 2 Challenge Recap We are given: Description : Musicians transpose keys regularly. Cryptanalysts transpose columns regularly. Keylength: key of cipher in Where the dream starts 1...
Read more →Writeup: Caesar Cipher Challenge Challenge Overview We are given two files: encrypt.py: Python script that implements a Caesar cipher (shift cipher) with a secret key K. output.txt: Contains the resulting ciphertext....
Read more →Writeup – NewJeans is Five Challenge Overview We are given: chall.py – an implementation of AES‑128 but with a critical component missing: SubBytes and SubWord are replaced by the identity function (they just return the...
Read more →Affine‑Hill Cipher Challenge Challenge Overview We are presented with a custom Affine‑Hill Cipher that operates on blocks of 4 characters over an alphabet of size 37: Alphabet: abcdefghijklmnopqrstuvwxyz0123456789-...
Read more →Twin Spirit — Crypto Writeup Name: Twin Spirit Channels Category: Crypto (RSA oracle + BBS) Flag: Africc{sp1r1t ch4nn3ls bbs 0r4cl3} Challenge overview We connect to a TCP service that prints the modulus M at startup...
Read more →Fortress — Reverse Engineering Writeup Category: Reverse Engineering / Windows PE Binary: fortr3ss.exe (PE32+ x86-64 console, GCC 15-win32 C++, not stripped) Flag: Africc{R3v3rs3 Eng1n33r1ng 1s Fun} --- Recon strings...
Read more →d3lulu — Reverse Engineering Writeup Challenge Our resident AI went a bit delulu and tried to create an uncrackable password vault, but here is the twist: the AI suffered a massive hallucination. We are given d3lulu.zip...
Read more →Deja VM — Reverse Engineering Writeup Category: Reverse Engineering / VM-Based Crackme Binary: dej4 VM (ELF 64-bit, PIE, not stripped) Flag: Africc{reverse the vm to win } --- Recon strings reveals the interesting bits...
Read more →Deputy's Ledger — Web Exploitation Writeup Category: Web Exploitation Difficulty: Medium Author: LordSudo Flag: africc{d3putys l3dg3r h4s s0 much fun} Overview The challenge presents a ledger/accounting service for a...
Read more →Confused Deputy — Web Exploitation Writeup Category: Web Exploitation Difficulty: Easy Author: LordSudo Flag: africc{alg confusion 3v3rywh3r3} Overview The service authenticates users with a JWT signed with RS256 . It...
Read more →