2024weight 25.00Hack The Box

Cyber Apocalypse 2024: Hacker Royale

48 challenges with 111 published community solutions between them. Solution links go to CTFtime’s task page, which aggregates every writeup for a challenge - individual blog posts rot, the aggregator does not.

Full task list on CTFtime

Misc25

Everything that fits no other box: esolangs, puzzles, scripting exercises, and the jail escapes that have not yet earned their own category.

Solve it with:Brainfuck and esolang decoder Cipher identifier and automatic decoder Regex tester with match offsets and capture groups Learn: Recognising encodings

Flag Command
4 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
TimeKORP
4 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Unbreakable
350 pts4 writeups
- misc
Same technique in picoCTF: Permissions, Specialer, Codebook
Dynastic
3 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Iced TEA
3 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
LootStash
3 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Russian Roulette
3 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Stop Drop and Roll
3 writeups
- coding
Same technique in picoCTF: Permissions, Specialer, Codebook
Arranged
2 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
BoxCutter
2 writeups
- engineering
Same technique in picoCTF: Permissions, Specialer, Codebook
Character
2 writeups
- coding
Same technique in picoCTF: Permissions, Specialer, Codebook
Flash-ing Logs
375 pts2 writeups
- hardware
Same technique in picoCTF: Permissions, Specialer, Codebook
Lucky Faucet
2 writeups
- blockchain
- solidity
Same technique in picoCTF: Reentrance, Smart_Overflow, Access_Control
Partial Tenacity
2 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Rids
2 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Blunt
1 writeup
- factors
- prime
Same technique in picoCTF: Permissions, Specialer, Codebook
BunnyPass
1 writeup
Same technique in picoCTF: Permissions, Specialer, Codebook
Gloater
1 writeup
Same technique in picoCTF: Permissions, Specialer, Codebook
Maze
1 writeup
Same technique in picoCTF: Permissions, Specialer, Codebook
Maze of Mist
1 pts1 writeup
Same technique in picoCTF: Permissions, Specialer, Codebook
Path of Survival
1 writeup
Same technique in picoCTF: Permissions, Specialer, Codebook
Percetron
1 writeup
Same technique in picoCTF: Permissions, Specialer, Codebook
Pursue The Tracks
1 writeup
- filesystem
Same technique in picoCTF: Permissions, Specialer, Codebook
The PROM
350 pts1 writeup
Same technique in picoCTF: Permissions, Specialer, Codebook
Tsayaki
1 writeup
Same technique in picoCTF: Permissions, Specialer, Codebook

Binary exploitation7

Turn a memory-safety bug in a native binary into control of execution. Usually a stack overflow, a format string, or a heap primitive.

Solve it with:ROP gadget finder Shellcode assembler and library Cyclic pattern generator and offset finder Format string exploit builder Learn: Binary exploitation

delulu
300 pts4 writeups
- pwn
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
Writing on the Wall
300 pts4 writeups
- pwn
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
Pet Companion
300 pts3 writeups
- pwn
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
Rocket Blaster XXX
300 pts3 writeups
- pwn
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
pwn-oracle
2 writeups
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
Sound of Silence
375 pts2 writeups
- pwn
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
Deathnote
325 pts1 writeup
- pwn
- heap
Same technique in picoCTF: tea-cash, sice_cream, zero_to_hero

Forensics7

Recover something from a file, a capture, or a disk image - often from a part of it the format says is unused.

Solve it with:File type identifier by magic bytes Magic byte and file signature table PCAP analyzer for CTF network forensics EXIF metadata viewer Learn: File forensics and carving Learn: Network forensics

Phreaky
350 pts4 writeups
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Data Siege
350 pts3 writeups
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Fake Boost
300 pts3 writeups
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
An Unusual Sighting
2 writeups
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
It Has Begun
300 pts2 writeups
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Urgent
300 pts2 writeups
- forensics
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions
Recovery
1 writeup
Same technique in picoCTF: FindAndOpen, c0rrupt, extensions

Web5

Reach data or functionality the application meant to keep from you - through its inputs, its tokens, or its trust in the client.

Solve it with:JWT decoder and signature verifier JWT alg=none bypass generator Web attack payload catalog JWT secret brute force Learn: Web attacks and session tokens

KORP Terminal
4 writeups
- web
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3
Labyrinth Linguist
3 writeups
- web
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3
Locktalk
3 writeups
- bypass
- jwt
Same technique in picoCTF: Java Code Analysis!?!, JaWT Scratchpad, JAuth
Testimonial
3 writeups
- grpc
- web
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3
SerialFlow
1 writeup
- web
- pickle
- pickle-deserialization
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3

Cryptography3

Recover a plaintext or a key from something that was supposed to protect it. In practice: identify the scheme, find the parameter the author got wrong, exploit it.

Solve it with:Cipher identifier and automatic decoder Vigenere cipher solver with automatic key recovery RSA decryption and attack runner Wiener’s attack on small RSA private exponents In-browser hash cracker with rule transforms Learn: Classical ciphers and frequency analysis Learn: RSA and the parameters that break it

Makeshift
300 pts3 writeups
- crypto
Same technique in picoCTF: StegoRSA, Timestamped Secrets, AES-ABC
Primary Knowledge
300 pts3 writeups
- crypto
Same technique in picoCTF: StegoRSA, Timestamped Secrets, AES-ABC
Oracle
1 writeup
Same technique in picoCTF: StegoRSA, Timestamped Secrets, AES-ABC

Reverse engineering1

Work out what a compiled program does without its source, then work backwards from the check to the input that passes it.

Solve it with:Strings extractor for binaries and blobs WebAssembly disassembler Java .class disassembler Python .pyc bytecode disassembler Learn: Binary exploitation

Packed Away
300 pts3 writeups
- reversing
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300

Misc25

Flag Command

TimeKORP

Unbreakable

Dynastic

Iced TEA

LootStash

Russian Roulette

Stop Drop and Roll

Arranged

BoxCutter

Character

Flash-ing Logs

Lucky Faucet

Partial Tenacity

Rids

Blunt

BunnyPass

Gloater

Maze

Maze of Mist

Path of Survival

Percetron

Pursue The Tracks

The PROM

Tsayaki

Binary exploitation7

delulu

Writing on the Wall

Pet Companion

Rocket Blaster XXX

pwn-oracle

Sound of Silence

Deathnote

Forensics7

Phreaky

Data Siege

Fake Boost

An Unusual Sighting

It Has Begun

Urgent

Recovery

Web5

KORP Terminal

Labyrinth Linguist

Locktalk

Testimonial

SerialFlow

Cryptography3

Makeshift

Primary Knowledge

Oracle

Reverse engineering1

Packed Away

Other 2024 events