[ WRITEUP NODE / FIELD REPORTS ]
SOLVED CHALLENGES & FIELD ANALYSIS
Documented challenges from competitions we have participated in, written by the members who solved them.
ucas Flag: gaslightCTF{m4n1f3st1ng e4sy 0ff3r5 f0r ev3ry0n3 c2b03a9886c1} Overview ucas is the "university application" challenge (a play on the UK UCAS admissions system). It has two bugs : A format string on the...
Read more →good-enough Category : pwn Difficulty: beginner–intermediate (classic ret2win with a PIE leak) Author: sportshead Attachments: good-enough.tar.zst containing good-enough (binary), libc.so.6, ld-linux-x86-64.so.2 Remote:...
Read more →icon-sketch Category: forensics · Author: riyc Description: "the pee people found the first version of the gaslightCTF icon... apparently theres a flag in here?" Attachment: icon.zip → icon.png (2000×800 RGBA,...
Read more →blackout Category: forensics · Author: riyc Description: "i was doing my work, then my power went off! my computer spat this out afterwards, can you recover the flag?" Attachment: recovered file (PDF 1.4, 8 pages, 106...
Read more →corridors Category: web · Points: 500 · Author: sportshead Description: "The path will guide you to the flag." Service: https://<instance>.play.gaslightctf.cooking:1337 Flag: gaslightCTF{fr33d0m 4t l4st 3ebe19fd9908}...
Read more →down-the-stream-2 — gaslightCTF 2026 writeup Category: crypto (456 points) Author: william etotheipi Solves: 67 Series: down-the-stream (part 2 of 2) Flag: gaslightCTF{st0p-rev3al1ng-4ll-the-pl4int3xts} "The author...
Read more →down-the-stream-1 — gaslightCTF 2026 writeup Category: crypto (500 points) Author: william etotheipi Solves: 77 Series: down-the-stream (part 1 of 2) Flag: gaslightCTF{d0nt-r3veal-y0ur-co3ff-v3ct0r} "A synchronous...
Read more →Where the dream starts 3 Category: crypto (500 points) Author: william etotheipi Solves: 58 Challenge: "A modification of a very nice classic." Flag: gaslightCTF{theindecipherablecipher} --- Table of contents Challenge...
Read more →jsbox — gaslightCTF 2026 writeup Category: misc (100) Author: sportshead Solves: 201 Service: ncat --ssl <instance>.play.gaslightctf.cooking 31337 Flag: gaslightCTF{n4t1v3 c0d3 0r n4t1v3 fl4g? 0142da7d4c7e} "I created a...
Read more →json-warehouse Category: Web Author: sportshead Platform: BergCTF / gaslightCTF infra Deployed as: single compiled Bun binary on a distroless container Flag: gaslightCTF{p0llut3d w4r3h0us3s ar3nt v3ry s4f3 c0nd1ti0ns...
Read more →messageboard Challenge I left a little message for only my closest friends :) Endpoint: https://<instance>.play.gaslightctf.cooking:1337 Source: messageboard.tar.zst A Bun + Postgres message board. Every seeded user...
Read more →biscuit Challenge Hello world! italics bold Endpoint: https://<instance>.play.gaslightctf.cooking:1337 Source: biscuit.tar.zst A Flask app that uses Biscuit authorization tokens for authentication. The flag is only...
Read more →badcat Challenge you've seen batcat, are you ready for badcat? Login: badcat:b4788c115ea4eb42 Service: ssh -o "ProxyCommand=ncat --ssl %h %p" <instance>.play.gaslightctf.cooking -p 31337 The flag lives at /flag (mode...
Read more →ram-conservation Challenge RAM prices are going up due to AI, this shell reduces memory use by limiting your inputs. Find the flag! Service: ncat --ssl <instance>.play.gaslightctf.cooking 31337 The remote shell is a...
Read more →gaslightCTF — crypto: CompleteHTTP Challenge: CompleteHTTP Category: crypto Author: William Tu / sportshead Flag: gaslightCTF{gu3s5 y0u n33d l0ng sl33v35 ev3n in 5umm3r?} Description How do you make RSA fashionable? The...
Read more →gaslightCTF — rev: Compiled Source Sheets Challenge: Compiled Source Sheets Category: rev Author: sportshead Flag: gaslightCTF{ch3ck 0ut lyra-horse!! 2QY90H6F} Description My new VM is Spectre-proof! It's also...
Read more →Intergalactic - Beacon v0 Summary The binary is a stripped 64-bit PIE ELF that always prints 72 bytes, but that output is not the flag directly. There are two layers: main builds a 72-byte beacon buffer. If a success...
Read more →CTF Write-up: Flappy Challenge Information Name: Flappy Points: 500 URL: http://exp.cybergame.sk:7010 Initial Discovery Upon visiting the challenge URL, we are presented with a Flappy Bird game clone. The page title is...
Read more →Tower of Hanoi Revenge - Writeup Challenge Overview The "Tower of Hanoi Revenge" challenge provides a network service and a zip file containing an emulator environment. The goal is to obtain the flag hidden within the...
Read more →Writeup – Where the dreams start Part 2 Challenge Recap We are given: Description : Musicians transpose keys regularly. Cryptanalysts transpose columns regularly. Keylength: key of cipher in Where the dream starts 1...
Read more →Writeup: Caesar Cipher Challenge Challenge Overview We are given two files: encrypt.py: Python script that implements a Caesar cipher (shift cipher) with a secret key K. output.txt: Contains the resulting ciphertext....
Read more →Writeup – NewJeans is Five Challenge Overview We are given: chall.py – an implementation of AES‑128 but with a critical component missing: SubBytes and SubWord are replaced by the identity function (they just return the...
Read more →Affine‑Hill Cipher Challenge Challenge Overview We are presented with a custom Affine‑Hill Cipher that operates on blocks of 4 characters over an alphabet of size 37: Alphabet: abcdefghijklmnopqrstuvwxyz0123456789-...
Read more →Twin Spirit — Crypto Writeup Name: Twin Spirit Channels Category: Crypto (RSA oracle + BBS) Flag: Africc{sp1r1t ch4nn3ls bbs 0r4cl3} Challenge overview We connect to a TCP service that prints the modulus M at startup...
Read more →Fortress — Reverse Engineering Writeup Category: Reverse Engineering / Windows PE Binary: fortr3ss.exe (PE32+ x86-64 console, GCC 15-win32 C++, not stripped) Flag: Africc{R3v3rs3 Eng1n33r1ng 1s Fun} --- Recon strings...
Read more →d3lulu — Reverse Engineering Writeup Challenge Our resident AI went a bit delulu and tried to create an uncrackable password vault, but here is the twist: the AI suffered a massive hallucination. We are given d3lulu.zip...
Read more →Deja VM — Reverse Engineering Writeup Category: Reverse Engineering / VM-Based Crackme Binary: dej4 VM (ELF 64-bit, PIE, not stripped) Flag: Africc{reverse the vm to win } --- Recon strings reveals the interesting bits...
Read more →Deputy's Ledger — Web Exploitation Writeup Category: Web Exploitation Difficulty: Medium Author: LordSudo Flag: africc{d3putys l3dg3r h4s s0 much fun} Overview The challenge presents a ledger/accounting service for a...
Read more →Confused Deputy — Web Exploitation Writeup Category: Web Exploitation Difficulty: Easy Author: LordSudo Flag: africc{alg confusion 3v3rywh3r3} Overview The service authenticates users with a JWT signed with RS256 . It...
Read more →