CTF Miscellaneous

Quick reference for miscellaneous CTF challenges. See supporting files for full details.

Prerequisites

# Python packages
pip install z3-solver pwntools Pillow numpy requests dnslib

# Linux
apt install ffmpeg qrencode

# macOS
brew install ffmpeg qrencode

Manual: SageMath — Linux: apt install sagemath, macOS: brew install --cask sage

Additional Resources

File	Coverage
pyjails.md	Python jail/sandbox escape, quine context detection, repunit decomposition, decorator bypass, walrus operator, restricted charset
bashjails.md	Bash jail escape, HISTFILE file read, bash -v verbose, ctypes.sh, no-letter SansAlpha/SansOmega, Bazel action_env injection
other-jails.md	vim/ruby/java/zig/GDB/DEBUG.EXE/emacs/haskell/GCC jails, nsjail/container escape via UMH
encodings.md	Encodings, QR codes, esolangs, UTF-16, BCD, multi-layer auto-decoding, Punycode, UTF-7, Base58Check, POSTNET, Morse
encodings-advanced.md	Verilog/HDL, Gray code, RTF extraction, SMS PDU, UTF-9, pixel binary, hex Sudoku + QR, TOPKEK, MaxiCode, font analysis, FNAF, Blender scripts
rf-sdr.md	RF/SDR/IQ signal processing (QAM-16, carrier recovery, timing sync)
dns.md	DNS exploitation (ECS spoofing, NSEC walking, IXFR, rebinding, tunneling)
games-and-vms.md	WASM patching, PyInstaller, marshal, Python env RCE, Z3 SAT solving, K8s RBAC, float precision, Lua sandbox escape, custom assembly sandbox escape
games-and-vms-2.md	Cookie brute-force, Flask cookie game state, WebSocket manipulation, De Bruijn sequence, Brainfuck instrumentation, WASM memory manipulation
games-and-vms-3.md	memfd_create packed binaries, HMAC commitment-reveal, emulator ROM-switching, Python marshal injection, Benford's Law, nonogram solver, 100 prisoners, C emoji jail, BuildKit exploitation, Docker escape, Levenshtein oracle, SECCOMP high-bit bypass, rvim jail
linux-privesc.md	Sudo wildcard injection, monit process injection, PostgreSQL COPY TO PROGRAM, backup cronjob SUID, NFS exploitation, PaperCut privesc, Squid pivoting, Zabbix reset, PATH hijacking, GTFOBins, lxd group privesc, Docker group privesc

When to Pivot

• Cryptography/number theory centered -> /ctf-crypto
• Real binary exploit (not jail/toy VM) -> /ctf-pwn or /ctf-reverse
• File/image/audio/PCAP recovery -> /ctf-forensics
• ML/AI model attacks, adversarial examples -> /ctf-ai-ml

Quick Start Commands

# File identification
file mystery_file
xxd mystery_file | head -5

# Encoding detection
echo '<data>' | base64 -d
echo '<hex>' | xxd -r -p

# QR code decode
zbarimg qr.png

# Z3 constraint solving
python3 -c "from z3 import *; x=BitVec('x',32); s=Solver(); s.add(x^0xdead==0xbeef); s.check(); print(s.model())"

# Python jail test
python3 -c "__import__('os').system('id')"

# pwntools interaction
python3 -c "from pwn import *; r=remote('host',1337); r.interactive()"

# Find SUID binaries
find / -perm -4000 2>/dev/null

# Useful grep
grep -rn "flag{" .
strings file | grep -i flag

Quick Reference

Encodings & Ciphers

Encoding	Charset / Indicator	Decode	File
Base64	A-Za-z0-9+/=	base64 -d	encodings.md
Base32	A-Z2-7= (no lowercase)	base32 -d	encodings.md
Hex	0-9a-fA-F	xxd -r -p	encodings.md
ROT13	Garbled English	tr 'a-zA-Z' 'n-za-mN-ZA-M'	encodings.md
IEEE-754 float	Numbers hiding bytes	struct.pack('>f', val) → ASCII	encodings.md
Keyboard Shift	Adjacent keys pressed	dCode	encodings.md
Pigpen/Masonic	Geometric symbols on grid	Grid position mapping	encodings.md
MaxiCode	Hexagonal 2D barcode	zxing (Java)	encodings-advanced.md
TOPKEK	KEK=0, TOP=1, !=repeat	Binary decode	encodings-advanced.md

Auto-identify: dCode Cipher Identifier

Unicode Steganography

Technique	Range	Decode	File
Variation Selectors	U+E0100-E01EF	chr(ord(c) - 0xE0100 + 16)	encodings.md
Unicode Tags	U+E0000-E007F	chr(ord(c) - 0xE0000)	encodings.md
UTF-16 endianness	CJK mojibake	text.encode('utf-16-be').decode('utf-16-le')	encodings.md

Detection: Text longer than expected in bytes. Check [hex(ord(c)) for c in text] for high codepoints.

QR Codes & Audio

Technique	Command / Tool	File
QR decode	zbarimg qr.png	encodings.md
QR generate	qrencode -o out.png "data"	encodings.md
Spectrogram	sox audio.wav -n spectrogram	-
SSTV decode	qsstv	-
USB Mouse PCAP	USB-Mouse-Pcap-Visualizer	encodings.md

Python Jail Escape

Technique	Example	File
Oracle pattern	L() length, Q(i,x) compare, binary search	pyjails.md
Walrus bypass	(abcdef := "new_chars") reassigns constraints	pyjails.md
Decorator bypass	@__import__ no-call, no-quotes escape	pyjails.md
String join	open(''.join(['fl','ag.txt'])).read()	pyjails.md
Quine context	Dual-purpose quine with globals gate	pyjails.md
Repunit decomposition	Target as sum of 1+11+111+...	pyjails.md

Bash Jail Escape

Technique	Payload	File
HISTFILE file read	HISTFILE=/flag bash && history	bashjails.md
Verbose mode	bash -v flag.txt prints lines	bashjails.md
ctypes.sh	dlcall for direct C library calls	bashjails.md

Games, VMs & Sandbox Escape

Technique	Summary	File
PyInstaller	pyinstxtractor.py packed.exe → opcode remap	games-and-vms.md
WASM patching	wasm2wat → flip logic → wat2wasm	games-and-vms.md
Flask cookie game	flask-unsign -d leaks game answers	games-and-vms-2.md
Z3 boolean gate SAT	Model 250 gates as Z3 constraints, solve	games-and-vms.md
K8s RBAC bypass	SA token → impersonate → hostPath mount	games-and-vms.md
Float precision	Large multipliers amplify FP errors	games-and-vms.md
Docker escape	Host device mount, docker.sock, cgroup agent	games-and-vms-3.md
C emoji jail	(X==X) as 1, embed gadgets in add eax,imm32	games-and-vms-3.md
SECCOMP high-bit bypass	64-bit fd passes BPF, kernel truncates to 32-bit	games-and-vms-3.md
rvim jail escape	:python3 import os; os.system("cmd")	games-and-vms-3.md
Emulator ROM-switch	/load replaces ROM but preserves CPU state	games-and-vms-3.md
BuildKit secrets	Nested buildctl build --mount=type=secret	games-and-vms-3.md

DNS Exploitation

Technique	Quick Payload	File
ECS spoofing	dig @server domain TXT +subnet=10.13.37.1/24	dns.md
NSEC walking	Follow NSEC chain to enumerate DNSSEC zones	dns.md
IXFR	dig @server domain IXFR=0 (when AXFR blocked)	dns.md
DNS rebinding	Low-TTL alternating resolution	dns.md

Linux Privilege Escalation

Technique	Quick Check	File
SUID binaries	find / -perm -4000 2>/dev/null + GTFOBins	linux-privesc.md
Sudo perms	sudo -l	linux-privesc.md
Docker group	id | grep docker → mount host root	linux-privesc.md
GECOS passwords	/etc/passwd 5th field	linux-privesc.md
ACL permissions	getfacl /path/to/file	linux-privesc.md
PostgreSQL RCE	COPY TO PROGRAM 'cmd'	linux-privesc.md
Sudo wildcard	fnmatch() matches * across arg boundaries	linux-privesc.md
PATH hijacking	Write to early PATH dir	linux-privesc.md

Hash & Crypto Quick Checks

Hash Type	Magic Constant	Tool
MD5	0x67452301	hashcat
SHA-256	0x6a09e667	hashcat
MurmurHash64A	0xC6A4A7935BD1E995	-

SHA-256 length extension: hlextend — forge MAC from SHA-256(SECRET \|\| msg) with known msg/hash. Vulnerable: SHA-256, MD5, SHA-1. NOT: HMAC, SHA-3.

RF/SDR Quick Reference

• cf32: np.fromfile(path, dtype=np.complex64) | cs16: int16 reshape(-1,2) | cu8: RTL-SDR raw
• Circles in constellation = constant frequency offset; Spirals = drifting frequency
• 4-fold ambiguity in DD carrier recovery — try 0/90/180/270 rotation
• See rf-sdr.md for full QAM-16 demod pipeline

Miscellaneous Patterns

Pattern	Technique	File
Backdoor in source	strncmp(input, "exec:", 5) → system()	-
3D printer video	Track nozzle X/Y, plot 2D histogram for letters	-
Discord API flags	Roles, animated emoji, embeds metadata	/ctf-osint
ASCII in CSV columns	Values 48-126 → chr()	encodings.md
Nested archives	while loop with 7z x	-

Common Flag Locations

Files: /flag.txt, /flag, /app/flag.txt, /home/*/flag*. Env: /proc/self/environ. DB: flag, secret tables. Container: host filesystem via docker -v /:/mnt.