2015weight 70.00StratumAuhuur

32C3 CTF

52 challenges with 137 published community solutions between them. Solution links go to CTFtime’s task page, which aggregates every writeup for a challenge - individual blog posts rot, the aggregator does not.

Full task list on CTFtime

Binary exploitation15

Turn a memory-safety bug in a native binary into control of execution. Usually a stack overflow, a format string, or a heap primitive.

Solve it with:ROP gadget finder Shellcode assembler and library Cyclic pattern generator and offset finder Format string exploit builder Learn: Binary exploitation

Readme 200
6 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015, ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
gurke
300 pts5 writeups
- exploit
- python
- pickle
Same technique in picoCTF: lockdown-horses, Guessing Game 1, Bizz Fuzz
Readme
200 pts3 writeups
Also written up in: qwaz/solved-hacking-problem, insuyun/CTF-writeup
- pwn
Same technique in picoCTF: lockdown-horses, Guessing Game 1, Bizz Fuzz
forth
150 pts4 writeups
- pwn
Same technique in picoCTF: lockdown-horses, Guessing Game 1, Bizz Fuzz
Teufel
200 pts2 writeups
Also written up in: insuyun/CTF-writeup, shift-crops/CTFWriteups
- pwn
Same technique in picoCTF: lockdown-horses, Guessing Game 1, Bizz Fuzz
Bingo 500
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Cryptmsg 400
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Forth 150
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Ranger 400
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Sandbox 300
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Teufel 200
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Tree 500
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
tree
500 pts1 writeup
Also written up in: scwuaptx/CTF
- #pwn
Same technique in picoCTF: lockdown-horses, Guessing Game 1, Bizz Fuzz
cryptmsg
400 pts1 writeup
- pwn
Same technique in picoCTF: lockdown-horses, Guessing Game 1, Bizz Fuzz
Teeufel
1 official solution
Also written up in: b1gtang/writeups

Reverse engineering11

Work out what a compiled program does without its source, then work backwards from the check to the input that passes it.

Solve it with:Strings extractor for binaries and blobs WebAssembly disassembler Java .class disassembler Python .pyc bytecode disassembler Learn: Binary exploitation

Carder 500
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Ey Or 150
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Flash 300
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
libdroid
150 pts2 writeups
Also written up in: yous.be
- reverse engineering
- apk
Same technique in picoCTF: Checkpass, WinAntiDbg0x100, WinAntiDbg0x200
Libdroid 150
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Pica 300
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Flash
300 pts1 writeup
Also written up in: insuyun/CTF-writeup
- reverse engineering
Same technique in picoCTF: Checkpass, WinAntiDbg0x100, WinAntiDbg0x200
blobberry
300 pts1 writeup
- raspberry
- reverse engineering
Same technique in picoCTF: Checkpass, WinAntiDbg0x100, WinAntiDbg0x200
ey or
150 pts1 writeup
- elymas
- reverse engineering
Same technique in picoCTF: Checkpass, WinAntiDbg0x100, WinAntiDbg0x200
Flash (Reversing 300)
1 official solution
Also written up in: quanyang.github.io
NordicByNature
400 pts1 writeup
- embedded
- reverse engineering
Same technique in picoCTF: Checkpass, WinAntiDbg0x100, WinAntiDbg0x200

Misc10

Everything that fits no other box: esolangs, puzzles, scripting exercises, and the jail escapes that have not yet earned their own category.

Solve it with:Brainfuck and esolang decoder Cipher identifier and automatic decoder Regex tester with match offsets and capture groups Learn: Recognising encodings

Aes 250
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Blobberry 300
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Gurke 300
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Hd44780 150
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Nordic A5ac374dc3458596b6ba59ec5d9c41aeda1aafb3
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Nordicbynature 400
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Traces 200
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Vault 400
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Docker
250 pts1 writeup
- containers
- docker
Same technique in picoCTF: PW Crack 2, Permissions, Specialer
HD44780
150 pts1 writeup
- electronics
- hardware
Same technique in picoCTF: PW Crack 2, Permissions, Specialer

Web7

Reach data or functionality the application meant to keep from you - through its inputs, its tokens, or its trust in the client.

Solve it with:JWT decoder and signature verifier JWT alg=none bypass generator Web attack payload catalog JWT secret brute force Learn: Sessions, tokens and access control

Itd 150
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Kummerkasten 300
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Monkeybase 200
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Sequence Hunt 200
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
TinyHosting
250 pts3 writeups
- rce
- web
Same technique in picoCTF: Live Art, secure-email-service, No FA
Tinyhosting 250
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
Kummerkasten
300 pts1 writeup
- xss
- web
Same technique in picoCTF: Live Art, secure-email-service, msfroggenerator2

Uncategorised6

The upstream scoreboard did not say, so neither do we.

Solve it with:Cipher identifier and automatic decoder Learn: Recognising encodings

Misc300 Gurke
4 official solutions
Also written up in: krx/CTF-Writeups, kareemroks101/CTF-Writeups, krx/CTF-Writeups, kareemroks101/CTF-Writeups
Gurke Misc 300
2 official solutions
Also written up in: p4-team/ctf, p4-team/ctf
Hd44780 Embedded 150
2 official solutions
Also written up in: p4-team/ctf, raccoons-team/ctf
Tiny Hosting Web 250
2 official solutions
Also written up in: p4-team/ctf, raccoons-team/ctf
Sandbox
1 official solution
Also written up in: insuyun/CTF-writeup
Traces Embedded 200
1 official solution
Also written up in: raccoons-team/ctf

Forensics3

Recover something from a file, a capture, or a disk image - often from a part of it the format says is unused.

Solve it with:File type identifier by magic bytes Magic byte and file signature table PCAP analyzer for CTF network forensics EXIF metadata viewer Learn: File forensics and carving Learn: Network forensics

Config Bin 150
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
The 300
3 official solutions
Also written up in: ctfs/write-ups-2015, AntiRootkit1/write-ups-2015, TycoRyco/write-ups-2015
the
300 pts1 writeup
- forensics
Same technique in picoCTF: investigation_encoded_2, FindAndOpen, Ph4nt0m 1ntrud3r

Binary exploitation15

Readme 200

gurke

Readme

forth

Teufel

Bingo 500

Cryptmsg 400

Forth 150

Ranger 400

Sandbox 300

Teufel 200

Tree 500

tree

cryptmsg

Teeufel

Reverse engineering11

Carder 500

Ey Or 150

Flash 300

libdroid

Libdroid 150

Pica 300

Flash

blobberry

ey or

Flash (Reversing 300)

NordicByNature

Misc10

Aes 250

Blobberry 300

Gurke 300

Hd44780 150

Nordic A5ac374dc3458596b6ba59ec5d9c41aeda1aafb3

Nordicbynature 400

Traces 200

Vault 400

Docker

HD44780

Web7

Itd 150

Kummerkasten 300

Monkeybase 200

Sequence Hunt 200

TinyHosting

Tinyhosting 250

Kummerkasten

Uncategorised6

Misc300 Gurke

Gurke Misc 300

Hd44780 Embedded 150

Tiny Hosting Web 250

Sandbox

Traces Embedded 200

Forensics3

Config Bin 150

The 300

the

Other 2015 events