DefCamp CTF D-CTF 2026 Quals 16th place 8 posts K17 CTF K17 CTF 2026 31st place 10 posts PwnSec CTF PwnSec CTF 2026 49th place 9 posts Script CTF scriptCTF 2026 4th place 9 posts NNS CTF nnsc.tf, 2026 17th place 51 posts
All posts
2026.09.30AgilePaste 3Differential handling of duplicate Erlang ETF map keys — a term that never passed validation reaches the client's JSON encoderNNS CTF 2026Web2026.09.30bloatware.jsNext.js resume-data-cache blobs are base64 → inflate → JSON.parse with no integrity check, and the client Flight decoder's synchronous reference walk has no guards at all.NNS CTF 2026299ptWeb2026.09.30Clean SweepECOVACS DEEBOT T9 firmware 1.4.9 — `reqDo`'s JSON command dispatcher builds a string with `sprintf` and hands it to `popen()`NNS CTF 2026176ptboot2root2026.09.30dont-worryCSP bypass via path traversal in the Prism autoloader's `data-dependencies`, chained with `No-Vary-Search` cache-key confusion to replay the bot's authenticated responseNNS CTF 2026129ptWeb2026.09.30Count on me!`vb.htm?checkupdate=<url>` reflects the server-side fetch body verbatim — response-reflected SSRF (the SSID injection and `update.cgi` crash were dead ends)NNS CTF 2026boot2root2026.09.30Dot MatrixParse the I2C capture → map registers to LEDs → rebuild frames → fix the row order → recover the true scroll periodNNS CTF 2026146ptMisc2026.09.30DownhillHidden-parallelepiped attack on a 2003 signature scheme — recover `f` with covariance plus FFT-augmented 4th-moment gradient descentNNS CTF 2026155ptCrypto2026.09.30dyslexic`vboxsf` is a client filesystem — the guest trusts the host's SHFL RPC responses without validating themNNS CTF 2026127ptMisc2026.09.30Embedded encryptorLocate the encryption in the power trace, align per-block, recover the key with CPA (last two bytes handled separately)NNS CTF 2026133ptMisc2026.09.30Flag Pointer RegisterPE32+ — the decoder always runs, the result pointer just never reaches RDX. Replay the 8-byte-key XOR insteadNNS CTF 202697ptReversing2026.09.30happy`--frozen-intrinsics` freezes only the ECMAScript intrinsics — Node core prototypes such as `EventEmitter.prototype` are left aloneNNS CTF 2026131ptMisc2026.09.301up clank broLadybird LibJS inline-cache type confusion after a GC sweep → unchecked heap OOB R/W → native function table hijack for RCENNS CTF 2026253ptPwn2026.09.30File MonsterUploads are written verbatim to `/tmp/<name>` on the shared MongoDB container → CVE-2026-13078 / SERVER-128832NNS CTF 2026Web2026.09.30Ein milljón bjóra`Exif.ReadLocation()` returns a raw `JsonElement`, giving a zero-byte write; steer the classifier to inflate the approved countNNS CTF 2026Web2026.09.30No Strings AttachedRecover the 56 bytes of `secret` (0x404040) XORed against a glibc-style LCG keystreamNNS CTF 202695ptReversing2026.09.30Min Beste Venn1,135 HTTP HEAD requests, all 404 — the information is in the shape of the **request paths**, not the responsesNNS CTF 202668ptForensics2026.09.30Open SecretStatic ELF using raw syscalls only, so there are no libc calls for ltrace to catchNNS CTF 202699ptReversing2026.09.30Omniscient`SetApConfig` base64-wraps every input except the `ts` field added in the X5 → command injection into `popen()`NNS CTF 2026boot2root2026.09.30Patch TuesdayRuntime opcode patch (`jz` → `jnz`)NNS CTF 2026113ptReversing2026.09.30PurgatoryErlang hot code loading — the worker's local calls stay pinned to old.beam, but the fully-qualified `Mod:Fun` call is late-bound and lands in new.beamNNS CTF 2026122ptReversing2026.09.30jailnetThe Janet compiler runs outside the sandbox it is compiling for, and nothing verifies the bytecode it emits.NNS CTF 2026Pwn2026.09.30perchanceMissing trailing slash in a `startsWith` check (userinfo bypass), then a hardcoded extension UUID and an origin-less postMessage handler to steal `activateOn`NNS CTF 2026131ptWeb2026.09.30Raymarine NavigationLightHouse 4.11.133 (0day) — command injection in a CGI binaryNNS CTF 2026boot2root2026.09.30Scratch SpaceDecoded into an mmap'd scratch page and then wiped — reconstruct the pre-wipe stateNNS CTF 2026105ptReversing2026.09.30silentpyjail — reach `object` without `__class__`, then build an arbitrary-getattr primitive without spelling a single nameNNS CTF 2026122ptMisc2026.09.30The BuilderThe page tag is `sha256(content)[:12]`, so it is predictable, and the registry accepts anonymous pushes → smuggle in `ONBUILD COPY --from=theme /flag.txt`NNS CTF 202699ptdevsecops2026.09.30The TempleTempleOS — print to the terminal after `MountIDEAuto`, and decode the 8x8 glyphs from the noVNC canvas pixels instead of reading them by eyeNNS CTF 2026155ptMisc2026.09.30Time LockLie to `time()` with `LD_PRELOAD` to pass the time gateNNS CTF 2026116ptReversing2026.09.30Self-serviceAbuse LDAP attribute-driven group "provisioning" → reset `ops`'s password → pivotNNS CTF 2026103ptdevsecops2026.09.30Triangle PlatformStart from tenant-a's `console` ServiceAccount and escape through Kyverno's YAML handlingNNS CTF 2026devsecops2026.09.25small-guyAll 256 rounds of the checker live in .eh_frame; the C++ unwinder is the VM, and it consumes its key one frame late.NNS CTF 2026Reversing2026.09.24Sleepy CPUThe length of each sleep interval is the flag byte - a power side-channel you can read with a threshold.NNS CTF 202691ptMisc2026.09.23NNS International LoungeA hardcoded HMAC key plus one unvalidated field, compounded by a one-time bonus escape hatch.NNS CTF 2026195ptMisc2026.09.22littlefsDriving a discontinued Saleae app headlessly through its socket API to open an undocumented capture format.NNS CTF 2026108ptMisc2026.09.21KeyboardDecoding USB Low-Speed off the raw wire, then replaying every keystroke - including the edits that build the real flag.NNS CTF 2026Misc2026.09.20Hardware accelerated flag checker 2Extracting a netlist back out of a fabricatable SKY130 layout with no PDK installed.NNS CTF 2026105ptMisc2026.09.19sea of theft — Flag of YoreAn unused sprite renders to a screenshot of the game in dev mode, and the version string in those pixels names a release the bucket never cleaned up.DefCamp CTF 2026 QualsMisc2026.09.19ratatouilleA 70-byte .recipe section holds the flag, and the nine anti-analysis environment checks are not a defence — they are the key material.DefCamp CTF 2026 QualsReversing2026.09.19hollowdexJNI_OnLoad rewrites verifyFlag's bytecode through /proc/self/mem at load time; the shipped dex is a decoy hiding a 3-round Feistel.DefCamp CTF 2026 Quals250ptReversing2026.09.19bitdebit2One bit flip into IO_list_all, a seccomp filter that never checks the arch, and a flag read out through connection-drop timing.DefCamp CTF 2026 QualsPwn2026.09.19arbitrary-funds-sweepThe vault trusts an un-aliased L1 address that was never deployed on L2, and the same permissionless CREATE2 factory exists on both chains.DefCamp CTF 2026 Quals180ptBlockchain2026.09.19legacyPython 2 parses a 2 MB integer literal in quadratic time, so the backup overruns its timeout and the SIGQUIT trap gcores the root password into /tmp.DefCamp CTF 2026 QualsMisc2026.09.19aethergateEndpoints are validated per list element but stored space-joined and split again into argv, so one space injects curl options and file:// reads /dev/vdb as root.DefCamp CTF 2026 Quals460ptWeb2026.09.19prime calcDownloading and re-uploading a DMTCP checkpoint is a memory read/write primitive; one 36-byte path swap makes the worker read /flag instead of its config.K17 CTF 2026Misc2026.09.19big-winA loop that exits on != and can increment twice per pass never terminates, and its own counter is reachable through the array it bounds.K17 CTF 2026Pwn2026.09.19make-a-wishA signed modulo on the array index makes free() take a stack pointer, and tcache never checks that a chunk lives on the heap.K17 CTF 2026500ptPwn2026.09.19huge binary 1An unchecked stack index leaks libc and printf is called twice, so one GOT overwrite turns the second call into system("/bin/sh").K17 CTF 2026Pwn2026.09.19ihyhfclose() without NULLing the global FILE * lets a 464-byte note become the FILE struct, turning fflush into write(2) and fwrite into system().K17 CTF 2026500ptPwn2026.09.19huge binary 2One byte of leak per run, so the first job is a loop: a single %hhn on a page-aligned libc address makes main call itself forever.K17 CTF 2026Pwn2026.09.19not-jsonTwo loops sharing one buffer compose: the key loop's overflow breaks the canary and the description loop's terminator repairs it, then one byte of saved RBP pivots the frame.K17 CTF 2026500ptPwn2026.09.19solstice-9Three bench captures each hide the real component next to a more attractive decoy; assembling the 96-byte fixture and inverting boarddiag's lane routing yields the Ed25519 private key.DefCamp CTF 2026 Quals450ptMisc2026.09.19spotThe commitment is counted with FIONREAD but never read until after the reveal, and splice() puts a page reference in the pipe rather than bytes.K17 CTF 2026Misc2026.09.19wafThe anti-ROP memset zeroes everything after the first NUL — and since we choose both the NUL position and the length, it becomes the tool that writes the chain.K17 CTF 2026Pwn2026.09.19java notescommons-collections 3.2.1 on the classpath and an unfiltered readObject(), so CC6 gives blind RCE exfiltrated with curl's --data-binary.K17 CTF 2026Pwn2026.09.19Death Ops96 bytes of alphanumeric loader out of a seccomp jail, then a kernel LPE built on a char device that allows exactly two arbitrary writes.PwnSec CTF 2026Pwn2026.09.19Gap Gapp-1 and q-1 share a 600-bit prime, which turns 30 redacted digits of d into a Coppersmith root modulo an unknown divisor of N-1.PwnSec CTF 2026104ptCrypto2026.09.19Freal World ManipulationAn IEEE754 overflow blows the index limit open, and the mincore() bounds check becomes the oracle that defeats 1 GB of brk randomisation.PwnSec CTF 2026Pwn2026.09.19peekabooseccomp allows 8-byte writes from one page only, so the ciphertext is found by mmap binary search and the 24-bit srand seed does the rest.PwnSec CTF 2026Pwn2026.09.19pickleEvery string written as \uXXXX slips past a byte-level blocklist, and the check that should have stopped REDUCE throws inside its own try.PwnSec CTF 2026Web2026.09.19yccThe sandbox flags are airtight; the bug is that emit_dot splices an unescaped key into the generated C, so a map lookup breaks out into system().PwnSec CTF 2026Misc2026.09.19ZigerionsA VMProtect-packed dropper chain whose final payload is an unrunnable ELF carrying an AES key next to its own ciphertext.PwnSec CTF 2026Reversing2026.09.19pwnsec-supportSQLi into a bespoke register VM, then a 4-byte arbitrary write turned into an arbitrary read by type-confusing a Lua table slot.PwnSec CTF 2026142ptPwn2026.09.19PHaultIdentical responses and padded timing close every usual channel, so the oracle becomes PHP's memory_limit: a 34 MB row makes the page fatal.PwnSec CTF 2026Web2026.09.19Hardware accelerated flag checker 1Writing a gate-level simulator for an anonymous Yosys netlist and walking its KMP-style automaton.NNS CTF 202695ptMisc2026.09.17CheeseReproducing a lockdown browser's integrity headers from its config file alone, without ever installing it.NNS CTF 2026235ptMisc2026.09.16Light-Weight EncryptionPublishing the whole LWE relation lets any kernel vector cancel the secret, reducing the break to a scalar trapdoor.NNS CTF 202694ptCrypto2026.09.15ImpossibleLeaked ceremony toxic waste turns Groth16 into a rubber stamp for any public statement at all.NNS CTF 2026121ptCrypto2026.09.14From NothingRecovering a withheld Mumford v-polynomial, then the Jacobian's order via complex multiplication instead of point counting.NNS CTF 2026102ptCrypto2026.09.13Crypto Party 2A UUID4 used as an ECDSA nonce has ~106 unpredictable bits, recovered with a 168-dimension lattice.NNS CTF 2026135ptCrypto2026.09.12RLP GolfHand-written Yul assembling canonical RLP with mstore8 headers and calldatacopy bodies, scored purely on gas.NNS CTF 2026235ptBlockchain2026.09.11VoidAn off-by-one in Cairo's circuit failure-guarantee lets a STARK prove that an invertible element has no inverse.NNS CTF 2026220ptBlockchain2026.09.10ForkA Move VM module cache that lives outside Block-STM's tracked read-set, raced into a permanent chain fork.NNS CTF 2026176ptBlockchain2026.09.09CERNTwo Aztec functions share a 4-byte selector, so redirecting a callback to the contract itself mints its private notes to me.NNS CTF 2026161ptBlockchain2026.09.08Block RehearsalCrashing a Mina validator through a zip_exn that fires before any proof is ever verified.NNS CTF 2026195ptBlockchain2026.09.07Bank of NNSA permutation-cycle bug in kimchi's connect_64bit leaves a range-check limb entirely unconstrained.NNS CTF 2026313ptBlockchain2026.09.06Reverse Grand PrixZero-cost AST nodes defeat solc's inliner size heuristic, compressing a 157-second compile bomb into 637 bytes.NNS CTF 2026195ptBlockchain2026.09.05Glomma River TradingA perp market that reads its mark price straight off the thin AMM pool you are free to trade against.NNS CTF 2026207ptBlockchain2026.09.04eu261A textbook checks-effects-interactions violation, reentered 16 times to drain a compensation fund to exactly zero.NNS CTF 2026158ptBlockchain2026.08.18Crypto/OopsI am from the future! I accidentally forgot to link chall.zip!scriptCTF 2026Crypto2026.08.18Bonus 1, 2 & 3All three challenges were solved through passive investigation of public profiles and repositories connected to the fictional “newbie” character.scriptCTF 2026Misc2026.08.18misc golfProduce a number spiral while staying within a strict rendered pixel-width limit.scriptCTF 2026Misc2026.08.18FaaS 1.5The service fetched a user-supplied host with curl and displayed the page title.scriptCTF 2026Pwn2026.08.18pwn faas 2The service takes a host, validates it, and passes it to curl.scriptCTF 2026Pwn2026.08.18LeaksThe service passed user input directly to printf, creating a format-string vulnerability.scriptCTF 2026Pwn2026.08.18DiabolicalThe challenge presented a large, statically linked, stripped Go executable.scriptCTF 2026Reversing2026.08.18web wpm game2Recover the flag through a constrained server-side expression.scriptCTF 2026Web2026.08.18Rev/MeowvelousShopAnalyze a custom virtual machine and uncover the hidden flag path.scriptCTF 2026Reversing