Breaking Git(Hub) and Authentik at Plfanzen CTF
Writeups for the challenges I solved during Plfanzen CTF
gk.wtf
Recent content on gk.wtf
Latest posts
swiss hacking challenge 2026 qualifier - bedrockbank
Difficulty medium Categories rev Description Bedrock Bank & Trust is the most secure financial institution in all of Bedrock! Their new stone-tablet vault app uses “pterodactyl-grade” account key protection. Unfortunately Dino forgot his password 😭 Can you help recover it?
swiss hacking challenge 2026 qualifier - brachiosaurus
Difficulty medium Categories web Description Gresslyosaurus, the local post officer has unfortunately lost access to the service managing the delivery of letters (the dino swears that he typed the password correctly, he tried it twice). Additionally, it seems that some messages have re-appeared! Please help him to sort this situation out and find the messages that still need to be delivered.
swiss hacking challenge 2026 qualifier - buffer-overflow-intro
Difficulty baby Categories pwn Description This program asks for a password. There’s a variable called is_admin that needs to equal 0xdeadbeef to get the flag. The program uses gets(), which is vulnerable to buffer overflow. Access: Connect to the binary with ncat --ssl [host] [port] or use pwntools.
swiss hacking challenge 2026 qualifier - canopysaurus
Difficulty medium Categories pwn Description Something’s wrong with the brontosaurus powering Fred’s car. The Dino Control Unit (DCU) is acting up, and the mechanics at the Bedrock Motor Pool can’t figure it out. Can you find the reset code for the DCU and help Fred get back on the road? Author Kiwi Attachments canopysaurus.tar.gz Service Challenge has a remote instance. LLM…
swiss hacking challenge 2026 qualifier - connivance
Difficulty hard Categories rev Description Bad guys like to obfuscate their code. This challenge implements a part of the DRM behind Tinfoil , a homebrew application that enables pirated games on the Nintendo Switch. Good luck! Author Yannik Attachments connivance.tar.gz LLM Usage I used ChatGPT to guess function signatures and structs. Also, the code for tracing of the compare opcode (at the end)…
swiss hacking challenge 2026 qualifier - dino-configurator
Difficulty easy Categories rev Description Feel like you have been transported back in time by looking at this lovely .NET WinForms application. Note: This challenge only runs on windows. Author NoRelect Attachments dino-configurator.tar.gz Solution It’s a .NET reversing challenge.
swiss hacking challenge 2026 qualifier - dino-test-bank
Difficulty easy Categories web Description Dino Bank has setup a test server so e-banking is going to be less painful when going prod! Author Tobias 'floyd' Ospelt Service Challenge has a remote instance. Overview The challenge initially presents us with a login page, which we can bypass by reading the source code:
swiss hacking challenge 2026 qualifier - dino-vault
Difficulty easy Categories crypto Description Do you have a park with dinosaurs of your own? Then make sure back your dinos up regularly! You never know when the next mass extinction event will happen, so better safe than sorry. We encrypt all your dinosaur data so that you need not worry that anyone is able to copy your designs. Our encrypted designs are uploaded as well for anyone to verify that…
swiss hacking challenge 2026 qualifier - dinodata
Difficulty medium Categories web Description DinOData gives developers instant access to rich, structured dinosaur data through a fast, modern interface. Build educational apps, research tools, or games with reliable prehistoric data at your fingertips. Author NoRelect Service Challenge has a remote instance. Overview The challenge serves a swagger UI allowing us to call a lot of different API…
swiss hacking challenge 2026 qualifier - fossildash
Difficulty medium Categories web Description The Dinosaur Research Network just launched FossilDash , a collaborative platform where researchers share fossil discoveries. Access requires a valid researcher certificate. Can you find a way to dig up the flag?
swiss hacking challenge 2026 qualifier - grafasaurus
Difficulty medium Categories misc Description Visualizing trends in species, eras, and discoveries of dinosaurs? No better tool for the job than Grafana. Author NoRelect Service Challenge has a remote instance. Solution We get unauthenticated access to a grafana instance. There’s a swagger ui at /swagger and I wrote a script to brute force all paths methods as an unauthenticated user:
swiss hacking challenge 2026 qualifier - juraforum
Difficulty hard Categories web Description The Swiss Jurassic Research Institute just launched JuraForum , an internal discussion board for paleontologists to share findings from the Jura mountains. Can you dig up something they didn’t expect? RAWWWR! Author 0x90 Attachments juraforum.tar.gz Service Challenge has a remote instance. Solution (unintended) The challenge uses the markdown2…
swiss hacking challenge 2026 qualifier - lumon
Difficulty medium Categories rev Description The work is mysterious and important. socat file:$(tty),rawer tcp:$HOST $PORT Author fitfrost4 Attachments lumon.tar.gz Service Challenge has a remote instance. Overview We have a very pretty TUI to “refine” numbers:
swiss hacking challenge 2026 qualifier - meow
Difficulty leet Categories misc Description Like a powerful, dark storm, I will make my presence known to the world. Like a seeping mist, I will creep into the dogs’ center of power, and make them quake in fear at the very mention of my name!
swiss hacking challenge 2026 qualifier - password-checker
Difficulty baby Categories rev Description This program asks for a password. If you enter the correct password, it grants you access. Figure out what password the program expects by looking at its code. Author xnull Service Challenge has a remote instance. Solution When using a disassembler (here r2ghidra), we can see the flag:
swiss hacking challenge 2026 qualifier - pcap-analysis
Difficulty baby Categories misc Description We captured network traffic from a user logging into a website. The credentials were sent over unencrypted HTTP. Analyze the packet capture and extract the password. Author xnull Service Challenge has a remote instance. Solution We can use tshark to dump the HTTP traffic by following the stream:
swiss hacking challenge 2026 qualifier - plumberhub
Difficulty medium Categories misc Description Got a leaky drain? Give us a call! Connect using telnet $HOST $PORT flag is in $FLAG Author Popax21 Attachments plumberhub.tar.gz Service Challenge has a remote instance. Overview The challenge consists of multiple rust files:
swiss hacking challenge 2026 qualifier - punkhash
Difficulty medium Categories crypto Description Look at this punky hash I found. Can you crack it? Author berndoJ Attachments punkhash.tar.gz LLM Usage I used ChatGPT in the browser to get to the general idea of LLL and the CVP approach. The exploit was written by myself. Solution The challenge itself has a really small source code:
swiss hacking challenge 2026 qualifier - sql-injection-basics
Difficulty baby Categories web Description You discovered a login page for a company database system. The credentials are unknown, but you need to gain access to retrieve sensitive information. Find a way to bypass the authentication and log in. Author xnull Service Challenge has a remote instance. Solution On the login page, we use the following credentials to get a login as admin:
swiss hacking challenge 2026 qualifier - stackosaurus
Difficulty easy Categories pwn Description Jurassic Stack Park recently upgraded their containment management terminals. We managed to pull a copy of the binary off one of the kiosks near the T-Rex enclosure. Author 0x90 Attachments stackosaurus.tar.gz Service Challenge has a remote instance. Overview We’re dealing with a 32-bit binary:
swiss hacking challenge 2026 qualifier - stegosaurus
Difficulty medium Categories misc Description In 1337 BC. the stegosaurus was known to write malware, infect company servers and extort them. Your task is to… AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA he’s here. I didn’t pay the ransom! Now he’s coming for my spaghetti
swiss hacking challenge 2026 qualifier - weak random
Difficulty baby Categories crypto Description This authentication system generates a random token for access. The token is different each time you load the page. Can you predict what token the system will generate? Author xnull Service Challenge has a remote instance. Scenario We need to supply a 6-digit code and get the timestamp used for a seed.
swiss hacking challenge 2026 qualifier – writeups
My writeups for the SHC 2026 Qualifier
Endolum CTF - broken-access-control
Difficulty: easy Category : web Author : xnull Description : ### Employee Portal You found an employee portal for a company. Regular users can register and access their dashboard, but there's an admin panel that contains sensitive information. Your goal is to access the admin panel at `/admin` and retrieve the flag. Solution We can just change the role cookie to admin after registration:
Endolum CTF - buffer-overflow-intro
Difficulty: easy Category : pwn Author : xnull Description : ### Buffer Overflow Introduction This program asks for a password. There's a variable called is_admin that needs to equal 0xdeadbeef to get the flag. The program uses gets(), which is vulnerable to buffer overflow. **Access:** Connect to the binary with `ncat --ssl [host] [port]` or use pwntools. The web interface provides educational…
Endolum CTF - caesar-cipher
Difficulty: easy Category : crypto Author : xnull Description : ### Intercepted Message We intercepted an encrypted message that uses a Caesar cipher (also known as a shift cipher). In this cipher, each letter is shifted by a fixed number of positions in the alphabet. Solution We are presented with the string RAQYZ{pnrfne_jnf_abg_irel_frpher_9s2n} . We can simply transform this with chepy : >>>…
Endolum CTF - command-injection
Difficulty: easy Category : web Author : xnull Description : ### Network Diagnostic Tool This web tool lets you ping any server to check if it's reachable. The tool runs the ping command on the server and shows you the output. The flag is stored in `/flag.txt` on the server. Solution We can just get the flag with simple command injection in the ping functionality:
Endolum CTF - disassembly-intro
Difficulty: easy Category : rev Author : xnull Description : ### Flag Checker This program builds a flag internally and checks if your input matches it. You can see how the flag is constructed by looking at the program's code. Solution We just open up the program in our favorite disassembler and look at the main function: int64_t main () { char var_48 ; __builtin_strncpy ( & var_48 ,…
Endolum CTF - ecb-mode-detection
Difficulty: easy Category : crypto Author : xnull Description : ### Encrypted Session System This web application stores your session data in an encrypted cookie. When you visit the site, you get a cookie that marks you as a regular user. Only users with admin privileges can see the flag. The cookie is encrypted using AES encryption, but the implementation might have a weakness you can exploit.…
Endolum CTF - file-signature-analysis
Difficulty: easy Category : forensics Author : xnull Description : ### Suspicious File We recovered a file from a compromised system. It has a .txt extension, but something seems off about it. Download the file and determine its real type to view the contents. Solution Based on the header of the file, we can see it’s a PNG file: �PNG ��� We can just look at it and get the flag.
Endolum CTF - format-string-basics
Difficulty: easy Category : pwn Author : xnull Description : ### Format String Vulnerability This program echoes back whatever you type. The flag is stored in memory on the stack. Can you leak it using a format string vulnerability? **Access:** Connect to the binary with `ncat --ssl [host] [port]` or use pwntools. The web interface provides educational content and downloadable source code.…
Endolum CTF - hash-length-extension
Difficulty: easy Category : crypto Author : xnull Description : ### Signed API This API uses MD5 signatures to authenticate requests. You have a valid signature for 'user=guest', but you need admin access. The signature is created as MD5(secret + data), where the secret is unknown to you. **Hint:** The server expects data as a hex string. It does `bytes.fromhex(data)` to decode it. Don't convert…
Endolum CTF - integer-overflow
Difficulty: easy Category : pwn Author : xnull Description : ### Integer Overflow Shop This shop sells flags for 1000 coins each. You only have 500 coins in your wallet. Can you exploit an integer overflow to buy the flag anyway? **Access:** Connect to the binary with `ncat --ssl [host] [port]` or use pwntools. Solution We can use the max. signed 64-bit integer divided by the cost (…
Endolum CTF - metadata-extraction
Difficulty: easy Category : forensics Author : xnull Description : ### Vacation Photo Someone sent you a vacation photo with a hidden message. The image looks normal, but there's more to it than meets the eye. Find the secret message hidden in the file. Solution The flag is stored in EXIF data; this data is plaintext anyways, so instead of (as intended) running exiftool , we can just pipe it into…
Endolum CTF - password-checker
Difficulty: easy Category : rev Author : xnull Description : ### Secure Password Vault This program asks for a password. If you enter the correct password, it grants you access. Figure out what password the program expects by looking at its code. Solution Again, when using a disassembler (here r2ghidra), we can see the flag: ulong sym . check_password ( char * arg1 ) { int64_t iVar1 ; ulong uVar2…
Endolum CTF - path-traversal
Difficulty: easy Category : web Author : xnull Description : ### Documentation Viewer This application lets you view company documentation files. The docs are stored in a specific directory on the server. The flag is stored in `/flag.txt` on the server filesystem. Solution The challenge is self-explanatory, we can just visit https://<uuid>.ctf.endolum.io:1337/view?file=../../../flag.txt to get the…
Endolum CTF - pcap-analysis
Difficulty: easy Category : forensics Author : xnull Description : ### Network Traffic Capture We captured network traffic from a user logging into a website. The credentials were sent over unencrypted HTTP. Analyze the packet capture and extract the password. Solution We can use tshark to dump the HTTP traffic by following the stream: # tshark -r capture.pcap -z follow,http,ascii,0 1 0.000000…
Endolum CTF - sql-injection-basics
Difficulty: easy Category : web Author : xnull Description : ### Company Database Login You discovered a login page for a company database system. The credentials are unknown, but you need to gain access to retrieve sensitive information. Find a way to bypass the authentication and log in. Solution On the login page, we use the following credentials to get a login as admin:
Endolum CTF - steganography-basics
Difficulty: easy Category : forensics Author : xnull Description : ### Hidden Message in Image Someone sent you a cute cat picture, but they claim there's a secret message hidden inside it. The image looks completely normal. Can you find what's hidden? Solution After downloading the image, we can run zsteg on it: $ zsteg cat.png b1,r,lsb,xy .. text: 'ENDLM{h1dd3n_1n_pl41n_s1ght_8a7c}'…
Endolum CTF - string-analysis
Difficulty: easy Category : rev Author : xnull Description : ### Secret Vault Someone wrote a program to protect a secret code, but they might not have done a great job hiding it. Download the program and see if you can find the secret without even running it. Solution strings ./program | grep ENDLM Flag: ENDLM{strings_are_not_so_secret_after_all_9a4f}
Endolum CTF - use-after-free-intro
Difficulty: easy Category : pwn Author : xnull Description : ### Use After Free Bug This program manages users. There is a use after free vulnerability that allows you to escalate privileges. Can you trigger the bug to call the admin function and get the flag? **Access:** Connect to the binary with `ncat --ssl [host] [port]` or use pwntools. Scenario: ===== User Management System ===== 1. Create…
Endolum CTF - weak-random
Difficulty: easy Category : crypto Author : xnull Description : ### Secure Token System This authentication system generates a random token for access. The token is different each time you load the page. Can you predict what token the system will generate? Scenario We need to supply a 6-digit code and get the timestamp used for a seed. Solution If we’re fast enough, we can just reuse the…
Endolum CTF - xor-cipher
Difficulty: easy Category : rev Author : xnull Description : ### XOR Password Checker This program checks a password that has been encrypted with XOR. Download the binary and figure out what the password is. You'll need to find the XOR key and decrypt the password. Solution We’ll extract the XOR key from the binary using our disassembler: 004a4040 encrypted_flag: 004a4040 07 0c 06 0e 0f 39…
Endolum CTF – writeups
I participated in the endolum CTF for fun; here's my solutions
Prometheus monitoring with NixOS on Proxmox
This post goes over how I deployed an observability stack for my homelab using Prometheus, Alertmanager and Grafana on NixOS running in an LXC container on my Proxmox server.
swiss hacking challenge 2024 - a-smap-in-the-face
Difficulty: medium Category : pwn Author : kiwi Sarah from business communication told Peter from accounting about our team retreat to Brussels and now it has been CANCELED! :( We worked so hard on that, it feels like a smap in the face. Florah told me (the one who always says she wants to work out but never does and honestly everybody has given up on that idea ever happening), that Peter might…
swiss hacking challenge 2024 - buzzword-browserpwn
Difficulty: hard Category : pwn Author : muffinx Steve from the Compliance Departement made a presentation about CYBER Security where he used all kinds of buzzwords. Like for example “Webbrowser Exploitation”, “Zero Days”, “Drive-By Downloads”, “Patch Management”, “Sandbox Escaping” he was just brabbling stuff for 2 hours and basically in…
swiss hacking challenge 2024 - centralized-identity
Difficulty: medium Category : web Author : NoRelect Steve : Hey, Bob, have you heard about the new system that centralizes the identity store? Bob : Oh, yeah, I think I read something about it in the latest IT newsletter. It’s supposed to streamline user authentication processes across all our platforms, right? Steve : Exactly. It’s going to consolidate all our user data into one…
swiss hacking challenge 2024 - cheated-results
Difficulty: medium Categories : misc, forensics Author : NoRelect Just as Susan was about to release the yearly statistics about who printed how many pages of paper in 2024, Steve thought something was strange and that the report got tampered with. Some of his coworkers that love trees suddenly print 1000’s of pages?! Can you help uncover who wanted to skip paying the fees and who falsely…