CTF Miscellaneous

Quick reference for miscellaneous CTF challenges. Each technique has a one-liner here; see supporting files for full details.

Prerequisites

Python packages (all platforms):
CODEBLOCK0

Linux (apt):
CODEBLOCK1

macOS (Homebrew):
CODEBLOCK2

Manual install:

• - SageMath — Linux: apt install sagemath, macOS: INLINECODE1

Additional Resources

• - pyjails.md - Python jail/sandbox escape techniques, quine context detection, restricted character repunit decomposition, funcglobals module chain traversal, restricted charset number generation, class attribute persistence
• bashjails.md - Bash jail/restricted shell escape techniques, HISTFILE file read trick, bash -v verbose mode, ctypes.sh direct C library calls
• encodings.md - Encodings, QR codes, esolangs, UTF-16 tricks, BCD encoding, multi-layer auto-decoding, indexed directory QR reassembly, multi-stage URL encoding chains
• encodings-advanced.md - Verilog/HDL, Gray code cyclic encoding, RTF custom tag extraction, SMS PDU decoding, multi-encoding sequential solvers, UTF-9, pixel binary encoding, hexadecimal Sudoku + QR assembly, TOPKEK, MaxiCode
• rf-sdr.md - RF/SDR/IQ signal processing (QAM-16, carrier recovery, timing sync)
• dns.md - DNS exploitation (ECS spoofing, NSEC walking, IXFR, rebinding, tunneling)
• games-and-vms.md - WASM patching, Roblox place file reversing, PyInstaller, marshal analysis, Python env RCE, Z3 (including boolean logic gate network SAT solving), K8s RBAC, floating-point precision exploitation, custom assembly language sandbox escape via Python MRO chain
• games-and-vms-2.md - Cookie checkpoint game brute-forcing, Flask cookie game state leakage, WebSocket game manipulation, server time-only validation bypass, De Bruijn sequence, Brainfuck instrumentation, WASM linear memory manipulation
• games-and-vms-3.md - memfdcreate packed binaries, multi-phase crypto games with HMAC commitment-reveal and GF(256) Nim, emulator ROM-switching state preservation, Python marshal code injection, Benford's Law bypass, parallel connection oracle relay, nonogram solver pipelines, 100 prisoners problem, C code jail escape via emoji identifiers, BuildKit daemon build secret exploitation, Docker container escape, Levenshtein distance oracle attack
• linux-privesc.md - Sudo wildcard parameter injection (fnmatch), crafted pcap for sudoers.d, monit confcheck process injection, Apache -d override, backup cronjob SUID, PostgreSQL COPY TO PROGRAM RCE, PostgreSQL backup credential extraction, NFS share exploitation, SSH Unix socket tunneling, PaperCut Print Deploy privesc, Squid proxy pivoting, Zabbix admin password reset via MySQL, WinSSHTerm credential decryption

• - PyInstaller: pyinstxtractor.py packed.exe. See games-and-vms.md for opcode remapping.
• Marshal: marshal.load(f) then dis.dis(code). See games-and-vms.md.
• Python env RCE: PYTHONWARNINGS=ignore::antigravity.Foo::0 + BROWSER="cmd". See games-and-vms.md.
• WASM patching: wasm2wat -> flip minimax -> wat2wasm. See games-and-vms.md.
• Float precision: Large multipliers amplify FP errors into exploitable fractions. See games-and-vms.md.
• K8s RBAC bypass: SA token -> impersonate -> hostPath mount -> read secrets. See games-and-vms.md.
• Cookie checkpoint: Save session cookies before guesses, restore on failure to brute-force without reset. See games-and-vms-2.md.
• Flask cookie game state: flask-unsign -d -c '<cookie>' decodes unsigned Flask sessions, leaking game answers. See games-and-vms-2.md.
• WebSocket teleport: Modify player.x/player.y in console, call verification function. See games-and-vms-2.md.
• Time-only validation: Start session, time.sleep(required_seconds), submit win. See games-and-vms-2.md.
• Quine context detection: Dual-purpose quine that prints itself (passes validation) and runs payload only in server process via globals gate. See pyjails.md.
• Repunit decomposition: Decompose target integer into sum of repunits (1, 11, 111, ...) using only 2 characters (1 and +) for restricted eval. See pyjails.md.
• De Bruijn sequence: B(k, n) contains all k^n possible n-length strings as substrings; linearize by appending first n-1 chars. See games-and-vms-2.md.
• Brainfuck instrumentation: Instrument BF interpreter to track tape cells, brute-force flag character-by-character via validation cell. See games-and-vms-2.md.
• WASM memory manipulation: Patch WASM linear memory at runtime to set game state variables directly, bypassing game logic. See games-and-vms-2.md.
• Lua sandbox escape: Bypass load()/os.execute() filters via os["execute"] table indexing or loadstring alias. See games-and-vms.md.
• C code jail via emoji + gadget embedding: When only emoji and punctuation are allowed in C, use (😃==😃) as constant 1, build integers, embed gadgets in add eax, imm32 constants, jump to offset+1 for shellcode primitives. See games-and-vms-3.md.
• Emulator ROM-switching: /load replaces ROM but preserves CPU state (registers, RAM, PC). Switch ROMs at specific PCs to combine INIT from one ROM with display instructions from another → read protected memory. See games-and-vms-3.md.
• BuildKit daemon exploitation: Exposed BuildKit gRPC allows nested buildctl build with --mount=type=secret to read build secrets. Two-stage Dockerfile: install buildctl → submit nested build mounting flag secret. See games-and-vms-3.md.
• Docker container escape: Privileged breakout via host device mount, docker.sock socket escape, CAPSYSADMIN cgroup releaseagent, container info leakage via /proc and overlayfs. See games-and-vms-3.md.
• Hexadecimal Sudoku + QR assembly: 4 QR codes encode 16x16 hex Sudoku quadrants; solve grid, read diagonal as hex pairs → ASCII flag. See encodings-advanced.md.
• Z3 boolean gate network SAT solving: Product key validation as 250 boolean gates (AND/OR/XOR/NOT) over 125 input bits. Model each gate as Z3 constraint, require all outputs True, solve in milliseconds. See games-and-vms.md.

3D Printer Video Nozzle Tracking (LACTF 2026)

Pattern (flag-irl): Video of 3D printer fabricating nameplate. Flag is the printed text.

Technique: Track nozzle X/Y positions from video frames, filter for print moves (top/text layer only), plot 2D histogram to reveal letter shapes:
CODEBLOCK14

Discord API Enumeration (0xFun 2026)

Flags hidden in Discord metadata (roles, animated emoji, embeds). Invoke /ctf-osint for Discord API enumeration technique and code (see social-media.md in ctf-osint).

SUID Binary Exploitation (0xFun 2026)

CODEBLOCK15

Reference: https://gtfobins.github.io/

Linux Privilege Escalation Quick Checks

CODEBLOCK16

Docker Group Privilege Escalation (H7CTF 2025)

User in the docker group can mount the host filesystem into a container and chroot into it for root access.

CODEBLOCK17

Key insight: Docker group membership is equivalent to root access. The docker CLI socket (/var/run/docker.sock) allows creating privileged containers that mount the entire host filesystem.

Reference: https://gtfobins.github.io/gtfobins/docker/

Sudo Wildcard Parameter Injection (Dump HTB)

Sudo's fnmatch() matches * across argument boundaries. Inject extra flags (-Z root, -r, second -w) into locked-down commands. Craft pcap with embedded valid sudoers entries — sudo's parser recovers from binary junk, unlike cron's strict parser. See linux-privesc.md.

Monit Process Command-Line Injection (Zero HTB)

Root monit script uses pgrep -lfa to extract process command lines, then executes a modified version. Create fake process via perl -e '$0 = "..."' with injected flags. Apache -d last-wins overrides ServerRoot; -E captures error output. Include /root/flag causes a parse error that reveals the file content. See linux-privesc.md.

PostgreSQL RCE and File Read (Slonik HTB)

INLINECODE66 executes OS commands as postgres. pg_read_file('/path') reads files. Extract credentials from pg_basebackup archives (global/1260 = pg_authid). SSH tunnel to Unix sockets: ssh -fNL 25432:/var/run/postgresql/.s.PGSQL.5432. See linux-privesc.md.

Backup Cronjob SUID Abuse (Slonik HTB)

Root cronjob copying directories preserves SUID bit but changes ownership to root. Place SUID bash in source directory → backup copies it as root-owned SUID. Execute with bash -p. See linux-privesc.md.

PaperCut Print Deploy Privesc (Bamboo HTB)

Root process runs scripts from user-owned directory. Modify server-command, trigger via Mobility Print API refresh. See linux-privesc.md.

Useful One-Liners

CODEBLOCK18

Keyboard Shift Cipher

Pattern (Frenzy): Characters shifted left/right on QWERTY keyboard layout.

Identification: dCode Cipher Identifier suggests "Keyboard Shift Cipher"

Decoding: Use dCode Keyboard Shift Cipher with automatic mode.

Pigpen / Masonic Cipher

Pattern (Working For Peanuts): Geometric symbols representing letters based on grid positions.

Identification: Angular/geometric symbols, challenge references "Peanuts" comic (Charlie Brown), "dusty looking crypto"

Decoding: Map symbols to Pigpen grid positions, or use online decoder.

ASCII in Numeric Data Columns

Pattern (Cooked Books): CSV/spreadsheet numeric values (48-126) are ASCII character codes.

CODEBLOCK19

CyberChef: "From Decimal" recipe with line feed delimiter.

Backdoor Detection in Source Code

Pattern (Rear Hatch): Hidden command prefix triggers system() call.

Common patterns:

• - strncmp(input, "exec:", 5) -> runs INLINECODE76
• Hex-encoded comparison strings: \x65\x78\x65\x63\x3a = "exec:"
• Hidden conditions in maintenance/admin functions

DNS Exploitation Techniques

See dns.md for full details (ECS spoofing, NSEC walking, IXFR, rebinding, tunneling).

Quick reference:

• - ECS spoofing: dig @server flag.example.com TXT +subnet=10.13.37.1/24 - try leet-speak IPs (1337)
• NSEC walking: Follow NSEC chain to enumerate DNSSEC zones
• IXFR: dig @server domain IXFR=0 when AXFR is blocked
• DNS rebinding: Low-TTL alternating resolution to bypass same-origin
• DNS tunneling: Data exfiltrated via subdomain queries or TXT responses

Unicode Steganography

Variation Selectors Supplement (U+E0100-U+E01EF)

CODEBLOCK20

Detection: Characters appear invisible but have non-zero length. Check with [hex(ord(c)) for c in text] -- look for codepoints in 0xE0100-0xE01EF or 0xFE00-0xFE0F range.

Unicode Tags Block (U+E0000-U+E007F) (UTCTF 2026)

Pattern (Hidden in Plain Sight): Invisible Unicode Tag characters embedded in URLs, filenames, or text. Each tag codepoint maps directly to an ASCII character by subtracting 0xE0000. URL-encoded as 4-byte UTF-8 sequences (%F3%A0%81%...).

CODEBLOCK21

Key insight: Unicode Tags (U+E0001-U+E007F) mirror ASCII 1:1 — subtract 0xE0000 to recover the original character. They render as zero-width invisible glyphs in most fonts. Unlike Variation Selectors (U+E0100+), these have a simpler offset calculation and appear in URL fragments, challenge titles, or filenames where the text looks normal but has suspiciously long byte length.

Detection: Text or URL is longer than expected in bytes. Percent-encoded sequences starting with %F3%A0%80 or %F3%A0%81. Python: any(0xE0000 <= ord(c) <= 0xE007F for c in text).

UTF-16 Endianness Reversal

Pattern (endians): Text "turned to Japanese" -- mojibake from UTF-16 endianness mismatch.

CODEBLOCK22

Identification: CJK characters, challenge mentions "translation" or "endian". See encodings.md for details.

Cipher Identification Workflow

1. 1. ROT13 - Challenge mentions "ROT", text looks like garbled English
2. Base64 - A-Za-z0-9+/=, title hints "64"
3. Base32 - A-Z2-7= uppercase only
4. Atbash - Title hints (Abash/Atbash), preserves spaces, 1:1 substitution
5. Pigpen - Geometric symbols on grid
6. Keyboard Shift - Text looks like adjacent keys pressed
7. Substitution - Frequency analysis applicable

Auto-identify: dCode Cipher Identifier

HISTFILE Trick for Restricted Shell File Reads (BCTF 2016)

Read files without cat/less/head: HISTFILE=/flag /bin/bash && history, or bash -v flag.txt (verbose mode prints lines), or ctypes.sh dlcall for direct C library calls. See bashjails.md.

Levenshtein Distance Oracle Attack (SunshineCTF 2016)

Oracle returns edit distance between guess and secret. Determine length from empty string, identify present chars from single-char repeats, binary search for positions. O(n log n) queries. See games-and-vms-3.md.

SECCOMP High-Bit File Descriptor Bypass (33C3 CTF 2016)

INLINECODE95 passes 64-bit SECCOMP check (≠ 2) but kernel truncates to 32-bit (== 2), closing fd 2. Next open() returns fd 2 for arbitrary file. Type-width mismatch between BPF filter and kernel. See games-and-vms-3.md.

rvim Jail Escape via Python3 (BKP 2017)

INLINECODE97 blocks :! but :python3 import os; os.system("cmd") executes arbitrary commands. Check :version for +python3/+lua/+ruby. See games-and-vms-3.md.