All posts
2026.09.30Clean SweepECOVACS DEEBOT T9 firmware 1.4.9 — `reqDo`'s JSON command dispatcher builds a string with `sprintf` and hands it to `popen()`NNS CTF 2026176ptboot2root2026.09.30Dot MatrixParse the I2C capture → map registers to LEDs → rebuild frames → fix the row order → recover the true scroll periodNNS CTF 2026146ptMisc2026.09.30DownhillHidden-parallelepiped attack on a 2003 signature scheme — recover `f` with covariance plus FFT-augmented 4th-moment gradient descentNNS CTF 2026155ptCrypto2026.09.30dont-worryCSP bypass via path traversal in the Prism autoloader's `data-dependencies`, chained with `No-Vary-Search` cache-key confusion to replay the bot's authenticated responseNNS CTF 2026129ptWeb2026.09.30AgilePaste 3Differential handling of duplicate Erlang ETF map keys — a term that never passed validation reaches the client's JSON encoderNNS CTF 2026Web2026.09.30Count on me!`vb.htm?checkupdate=<url>` reflects the server-side fetch body verbatim — response-reflected SSRF (the SSID injection and `update.cgi` crash were dead ends)NNS CTF 2026boot2root2026.09.30dyslexic`vboxsf` is a client filesystem — the guest trusts the host's SHFL RPC responses without validating themNNS CTF 2026127ptMisc2026.09.30Embedded encryptorLocate the encryption in the power trace, align per-block, recover the key with CPA (last two bytes handled separately)NNS CTF 2026133ptMisc2026.09.30Flag Pointer RegisterPE32+ — the decoder always runs, the result pointer just never reaches RDX. Replay the 8-byte-key XOR insteadNNS CTF 202697ptReversing2026.09.30bloatware.jsNext.js resume-data-cache blobs are base64 → inflate → JSON.parse with no integrity check, and the client Flight decoder's synchronous reference walk has no guards at all.NNS CTF 2026299ptWeb2026.09.301up clank broLadybird LibJS inline-cache type confusion after a GC sweep → unchecked heap OOB R/W → native function table hijack for RCENNS CTF 2026253ptPwn2026.09.30File MonsterUploads are written verbatim to `/tmp/<name>` on the shared MongoDB container → CVE-2026-13078 / SERVER-128832NNS CTF 2026Web2026.09.30Ein milljón bjóra`Exif.ReadLocation()` returns a raw `JsonElement`, giving a zero-byte write; steer the classifier to inflate the approved countNNS CTF 2026Web2026.09.30Min Beste Venn1,135 HTTP HEAD requests, all 404 — the information is in the shape of the **request paths**, not the responsesNNS CTF 202668ptForensics2026.09.30happy`--frozen-intrinsics` freezes only the ECMAScript intrinsics — Node core prototypes such as `EventEmitter.prototype` are left aloneNNS CTF 2026131ptMisc2026.09.30No Strings AttachedRecover the 56 bytes of `secret` (0x404040) XORed against a glibc-style LCG keystreamNNS CTF 202695ptReversing2026.09.30Omniscient`SetApConfig` base64-wraps every input except the `ts` field added in the X5 → command injection into `popen()`NNS CTF 2026boot2root2026.09.30Open SecretStatic ELF using raw syscalls only, so there are no libc calls for ltrace to catchNNS CTF 202699ptReversing2026.09.30Patch TuesdayRuntime opcode patch (`jz` → `jnz`)NNS CTF 2026113ptReversing2026.09.30jailnetThe Janet compiler runs outside the sandbox it is compiling for, and nothing verifies the bytecode it emits.NNS CTF 2026Pwn2026.09.30perchanceMissing trailing slash in a `startsWith` check (userinfo bypass), then a hardcoded extension UUID and an origin-less postMessage handler to steal `activateOn`NNS CTF 2026131ptWeb2026.09.30PurgatoryErlang hot code loading — the worker's local calls stay pinned to old.beam, but the fully-qualified `Mod:Fun` call is late-bound and lands in new.beamNNS CTF 2026122ptReversing2026.09.30Raymarine NavigationLightHouse 4.11.133 (0day) — command injection in a CGI binaryNNS CTF 2026boot2root2026.09.30Scratch SpaceDecoded into an mmap'd scratch page and then wiped — reconstruct the pre-wipe stateNNS CTF 2026105ptReversing2026.09.30silentpyjail — reach `object` without `__class__`, then build an arbitrary-getattr primitive without spelling a single nameNNS CTF 2026122ptMisc2026.09.30The BuilderThe page tag is `sha256(content)[:12]`, so it is predictable, and the registry accepts anonymous pushes → smuggle in `ONBUILD COPY --from=theme /flag.txt`NNS CTF 202699ptdevsecops2026.09.30The TempleTempleOS — print to the terminal after `MountIDEAuto`, and decode the 8x8 glyphs from the noVNC canvas pixels instead of reading them by eyeNNS CTF 2026155ptMisc2026.09.30Time LockLie to `time()` with `LD_PRELOAD` to pass the time gateNNS CTF 2026116ptReversing2026.09.30Self-serviceAbuse LDAP attribute-driven group "provisioning" → reset `ops`'s password → pivotNNS CTF 2026103ptdevsecops2026.09.30Triangle PlatformStart from tenant-a's `console` ServiceAccount and escape through Kyverno's YAML handlingNNS CTF 2026devsecops2026.09.25small-guyAll 256 rounds of the checker live in .eh_frame; the C++ unwinder is the VM, and it consumes its key one frame late.NNS CTF 2026Reversing2026.09.24Sleepy CPUThe length of each sleep interval is the flag byte - a power side-channel you can read with a threshold.NNS CTF 202691ptMisc2026.09.23NNS International LoungeA hardcoded HMAC key plus one unvalidated field, compounded by a one-time bonus escape hatch.NNS CTF 2026195ptMisc2026.09.22littlefsDriving a discontinued Saleae app headlessly through its socket API to open an undocumented capture format.NNS CTF 2026108ptMisc2026.09.21KeyboardDecoding USB Low-Speed off the raw wire, then replaying every keystroke - including the edits that build the real flag.NNS CTF 2026Misc2026.09.20Hardware accelerated flag checker 2Extracting a netlist back out of a fabricatable SKY130 layout with no PDK installed.NNS CTF 2026105ptMisc2026.09.19Hardware accelerated flag checker 1Writing a gate-level simulator for an anonymous Yosys netlist and walking its KMP-style automaton.NNS CTF 202695ptMisc2026.09.17CheeseReproducing a lockdown browser's integrity headers from its config file alone, without ever installing it.NNS CTF 2026235ptMisc2026.09.16Light-Weight EncryptionPublishing the whole LWE relation lets any kernel vector cancel the secret, reducing the break to a scalar trapdoor.NNS CTF 202694ptCrypto2026.09.15ImpossibleLeaked ceremony toxic waste turns Groth16 into a rubber stamp for any public statement at all.NNS CTF 2026121ptCrypto2026.09.14From NothingRecovering a withheld Mumford v-polynomial, then the Jacobian's order via complex multiplication instead of point counting.NNS CTF 2026102ptCrypto2026.09.13Crypto Party 2A UUID4 used as an ECDSA nonce has ~106 unpredictable bits, recovered with a 168-dimension lattice.NNS CTF 2026135ptCrypto2026.09.12RLP GolfHand-written Yul assembling canonical RLP with mstore8 headers and calldatacopy bodies, scored purely on gas.NNS CTF 2026235ptBlockchain2026.09.11VoidAn off-by-one in Cairo's circuit failure-guarantee lets a STARK prove that an invertible element has no inverse.NNS CTF 2026220ptBlockchain2026.09.10ForkA Move VM module cache that lives outside Block-STM's tracked read-set, raced into a permanent chain fork.NNS CTF 2026176ptBlockchain2026.09.09CERNTwo Aztec functions share a 4-byte selector, so redirecting a callback to the contract itself mints its private notes to me.NNS CTF 2026161ptBlockchain2026.09.08Block RehearsalCrashing a Mina validator through a zip_exn that fires before any proof is ever verified.NNS CTF 2026195ptBlockchain2026.09.07Bank of NNSA permutation-cycle bug in kimchi's connect_64bit leaves a range-check limb entirely unconstrained.NNS CTF 2026313ptBlockchain2026.09.06Reverse Grand PrixZero-cost AST nodes defeat solc's inliner size heuristic, compressing a 157-second compile bomb into 637 bytes.NNS CTF 2026195ptBlockchain2026.09.05Glomma River TradingA perp market that reads its mark price straight off the thin AMM pool you are free to trade against.NNS CTF 2026207ptBlockchain2026.09.04eu261A textbook checks-effects-interactions violation, reentered 16 times to drain a compensation fund to exactly zero.NNS CTF 2026158ptBlockchain2026.08.18Crypto/OopsI am from the future! I accidentally forgot to link chall.zip!scriptCTF 2026Crypto2026.08.18misc golfProduce a number spiral while staying within a strict rendered pixel-width limit.scriptCTF 2026Misc2026.08.18FaaS 1.5The service fetched a user-supplied host with curl and displayed the page title.scriptCTF 2026Pwn2026.08.18pwn faas 2The service takes a host, validates it, and passes it to curl.scriptCTF 2026Pwn2026.08.18Rev/MeowvelousShopAnalyze a custom virtual machine and uncover the hidden flag path.scriptCTF 2026Reversing2026.08.18LeaksThe service passed user input directly to printf, creating a format-string vulnerability.scriptCTF 2026Pwn2026.08.18web wpm game2Recover the flag through a constrained server-side expression.scriptCTF 2026Web2026.08.18Bonus 1, 2 & 3All three challenges were solved through passive investigation of public profiles and repositories connected to the fictional “newbie” character.scriptCTF 2026Misc2026.08.18DiabolicalThe challenge presented a large, statically linked, stripped Go executable.scriptCTF 2026Reversing