Writeups
CTF and security challenges, solved and explained end to end — LLM & agent security (prompt injection, RAG poisoning), binary exploitation, web, forensics and cryptography.
- AI
CDDC 2026 — RunbookAssist (AcmeOps)
In plain English: a Retrieval-Augmented Generation (RAG) chat assistant — Claude Haiku 4.5 on Bedrock — sits in front of an internal runbook corpus. Players upload fake runbooks ("authoritative policy"), bypass four…
- Binary exploitation
1778608923_chall (pwn / SROP)
$ file 1778608923_chall ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped $ wc -c 1778608923_chall 4424
- CDDC2026
CDDC 2026 — Find The Address (Forensics)
Provided artifact: Find+The+Address.zip containing a 528 MB AccessData FTK Imager AD1 logical image (Find The Address.ad1) with selected NTFS metadata + parts of Users\Star\ (Notion app data, Downloads, Desktop USN,…
- CDDC2026
CDDC 2026 — Find The Key
Using scapy to enumerate hosts and HTTP requests:
- CDDC2026
CDDC 2026 — Have You Seen This Cat (OSINT)
Unzip and list:
- CDDC2026
CDDC2026 — Model Inversion (Mind Reader)
Files: model.pkl, model_interface.py.
- CDDC2026
Inversion
Three files:
- Crypto
COMpetition
The challenge is a 100-round rock-paper-scissors game where you must commit to your move before the server reveals its own. A binding commitment scheme should make winning every round impossible. But the scheme here…
- Crypto
easy-dsa
The service signs arbitrary messages with ECDSA over NIST P-521 and lets us claim a flag if we present a valid signature on a message it has not signed. ECDSA is unforgeable... unless the per-signature nonce k is…
- Forensics
Catch the Criminal — CDDC2026
Artifact: Catch the criminal.zip containing Catch the criminal.ad1 (≈321 MB FTK Imager AD1 logical image) and its .ad1.txt manifest.
- GPN24
GPN24 — fortune2 (crypto)
The challenge looks like NTRU over the dihedral group ring Z[D_100] and dares you to break a lattice. It's a red herring. The encryption multiplies the noise term by p = 3 without reducing modulo q, and only then…
- Hash cracking
autobots (crypto / password cracking)
$ unzip -l 1774262947_autobots.zip autobots/hash.txt (33 bytes) autobots/wordlist.txt (25968 bytes, 3303 lines)
- Network
A FRAGILE TRUTH
We're given A FRAGILE TRUTH.pcapng containing 21 TLS sessions to port 4433 on 172.18.0.2.
- Network
Magic Packet Ride
The "spell" is not just a string — it is a full ICMP Echo Request packet with non-standard code = 1, carrying the payload GENI5 + 4 bytes + Ma9icLAMP + message.
- P2P
Mystery Inc Batch Clue Sheet
The file header spelled out the format:
- Pwn
CDDC 2026 — shim
We're given:
- Pwn
Sign Up Here / PWN2PLAY
A menu-driven "player account" program. Unlike the typical beginner pwn, this one ships with the full mitigation suite, so the flag name is a taunt: there is no win() — you have to leak libc and ROP your way to…
- Pwn
The World's Most Boring Binary
The challenge description — "I might have made the world's most boring binary. Just saying." — is a troll. The binary really is short and dull-looking, but it hides a format-string bug with several layers of defense…
- Reverse
miro — CDDC 2026
A miro.zip containing the build kit for a maze game:
- Reverse engineering
ghost_protocol (reverse engineering / MIPS VM keygen)
$ file ghost_protocol ELF 32-bit LSB executable, MIPS, MIPS32 version 1 (SYSV), statically linked, stripped
- Web
CDDC 2026 — Nexus Reports
Nexus Reports is an Express + Puppeteer 21.11.0 service that turns a user-uploaded SVG logo + JSON metrics into a printable PDF.
- Web
CDDC2026 — Nexus Gallery
The Nexus Gallery is a fake NFT marketplace fronting a private Hardhat EVM chain. The contract's isEligibleForFlag(address) returns true only for the deployer, but the deployer is Hardhat's default account #0…
- Web
CDDC2026 — Nexus Rewards
Target: http://cddc2026-challs-alb-2050157501.ap-southeast-1.elb.amazonaws.com:7219
- Web
GPN24 CTF — Fancy Food Notifications
A full-response SSRF endpoint fetches an attacker-supplied "notification URL" and reflects the response body back through a status API. The flag lives behind /vip-meal, which requires both remote_addr == 127.0.0.1…