🚀 Launch Your Lab Environment

Click here to open a pre-configured terminal on WolfCTF Portal:
👉 https://portal.wolfctf.com/labs/pacise26-ctf-stackoverflow

Log in with your LDAP account (same credentials as this CTFd), then click "Start Terminal". Starter files are in /home/student/courses/ctf/pacise26/stackoverflow/. Inside the terminal, run:

cp /home/student/courses/ctf/pacise26/stackoverflow/* ~/ && cd ~
gcc stackoverflow.c -o stackoverflow -m32 -fno-stack-protector -z execstack -no-pie

You only need to log into the portal once - your session lasts 24 hours.

---

Stack Overflow - Beginner PWN Challenge

Classic ret2func warmup. A 32-bit binary with no stack canary, no NX, no PIE - all mitigations are off. There's a convenient hacked() function already in the binary that will read and print flag.txt for you. Your job is to overflow gets() in return_input() and overwrite the saved return address so the program jumps into hacked() instead of returning to main.

Target

nc 157.245.222.186 19998

Source (simplified)

void hacked() { /* reads flag.txt and prints it */ }

void return_input(void) {
    char array[50];
    gets(array);          // <-- overflow here
    printf("You said: %s\n", array);
}

int main(void) {
    return_input();
    return 0;
}

Hints

1. Use gdb + GEF's pattern create / pattern offset to find the exact distance from the start of array[] to the saved return address.
2. Use objdump -d ./stackoverflow | grep '<hacked>:' to find the address of hacked(). It's fixed because the binary is compiled with -no-pie.
3. Payload: b'A' * offset + p32(hacked_addr)
4. The binary on the remote server is exactly the same as the one you compile locally from stackoverflow.c (same flags, same source).

Goal

Trigger hacked() on the remote server and receive the flag in its output.

Flag format: pacise26{...}

🚀 Launch Your Lab Environment

Click here to open a pre-configured terminal on WolfCTF Portal:
👉 https://portal.wolfctf.com/labs/pacise26-ctf-fmtleak

Log in with your LDAP account, click "Start Terminal". Starter files in /home/student/courses/ctf/pacise26/fmtleak/:

cp /home/student/courses/ctf/pacise26/fmtleak/* ~/ && cd ~
gcc fmtleak.c -o fmtleak -m32 -fno-stack-protector -no-pie

---

Format String Leak - Intermediate PWN Challenge

The program reads flag.txt into a local variable on the stack, then calls printf(user_input) with your input as the format string. Use format specifiers like %p, %x, and %s to leak the flag from the stack.

No shellcode. No ROP. Just printf doing what printf does.

Target

nc 157.245.222.186 19996

Source (key part)

void vuln() {
    char flag[64];
    char buf[128];

    FILE *f = fopen("flag.txt", "r");
    fgets(flag, sizeof(flag), f);  // flag is now ON THE STACK
    fclose(f);

    fgets(buf, sizeof(buf), stdin);
    printf(buf);                   // <-- format string vuln
}

Hints

1. Try %p.%p.%p.%p first to see stack values in hex.
2. Use %N$x to read specific stack positions (e.g., %10$x, %11$x, ...).
3. The flag is ASCII — convert leaked hex to bytes (remember: little-endian on 32-bit!).
4. Or try %N$s at different positions — if a value on the stack happens to point at the flag buffer, it will print the flag directly as a string.

Goal

Recover the full flag from the stack.

Flag format: pacise26{...}

🚀 Launch Your Lab Environment

Click here to open a pre-configured terminal on WolfCTF Portal:
👉 https://portal.wolfctf.com/labs/pacise26-ctf-final

Log in with your LDAP account (same credentials as this CTFd), then click "Start Terminal". You get a ready-to-go shell with pwntools, gdb+GEF, gcc-multilib, rizin, checksec, etc. All challenge files (final, libc.so.6, ld-linux.so.2, final.c, attack.py) are in /home/student/courses/ctf/pacise26/final/. Inside the terminal, run:

cp /home/student/courses/ctf/pacise26/final/* ~/ && cd ~

💡 You only need to log into the portal once — your session lasts 24 hours.

---

The Final — PWN Challenge

The ultimate PWN challenge. A classic 32-bit binary with ASLR + NX + Stack Canary enabled, but PIE disabled.

Target

nc 157.245.222.186 19999

Protections

Protection	Status
ASLR	✅ Enabled
NX	✅ Enabled
Stack Canary	✅ Enabled
PIE	❌ Disabled

Hints

• There are two bugs in the vulnerable function — you will need both.
• Leak the canary and a libc address via the format string bug first, then build your ret2libc chain.
• The attached files (final, libc.so.6, ld-linux.so.2) are provided so you can debug locally with the exact libc used by the remote server.
• The Wolverine terminal already has an attack.py template pre-configured for this target (157.245.222.186:19999) — just copy it and start filling in the blanks.

Goal

Pop a shell on the remote server and cat flag.txt.

Flag format: pacise26{...}

You intercepted an encrypted message from a secret vault. Intelligence suggests it was encrypted using the Vigenere cipher.

Here is the ciphertext:

ppyq{zgqilovc_mmnrip_xitov_bsiq}

A crumpled sticky note found at the scene reads:

The key to everything is: KEY

Task: Decrypt the message. The entire decrypted string is your flag (it's already in flag format).

Our intelligence agency intercepted an encrypted transmission. Analysis suggests the message was XOR-encrypted with a single repeating byte key.

Here are the encrypted bytes (hex-encoded):

0f05080e1211061b361e001d013606070c360b101d0c36001a36070c1f0c1b361a080f0c365b595b5f14

A decoded intercepted radio chatter mentions:

"The key is just one byte... brute force should be child's play."

Task: Find the single-byte XOR key, decrypt the message, and submit the full decrypted flag.

The flag format is: flag{...}

An intelligence agency sent the same secret number to three different recipients, each using RSA encryption with the same small public exponent e = 3 but different moduli.

You intercepted all three ciphertexts:

e  = 3

n1 = 1022117
c1 = 576594

n2 = 1040399
c2 = 639663

n3 = 1065023
c3 = 922227

Task:

1. Use the Chinese Remainder Theorem (CRT) to combine the three ciphertexts
2. Compute the cube root of the combined result to recover the plaintext number m
3. Submit the flag in the format: CTF{m_value_here}

Hint: When the same message is encrypted with e=3 and three different moduli, the combined ciphertext (via CRT) equals m³ exactly (no modular reduction needed), so a simple integer cube root reveals m.

Welcome to Cookie Monster's bakery website! The site has a simple login page, but the developer took a... creative approach to access control.

Rumor has it the admin panel has a tasty flag hidden inside. Can you figure out how the site decides who's an admin?

Test credentials: guest / guest123

Challenge URL: http://pacise26.badgerctf.com/chall/1/

Hint: Sometimes the answer is right there in your browser. Check what the server is feeding you.

A company deployed a simple file viewer tool for employees to read shared documents. The developer assured management that only files in the /docs directory are accessible.

But is that really the case? The flag is stored in /flag.txt on the server. Can you read it?

Challenge URL: http://pacise26.badgerctf.com/chall/2/

Hint: What happens if you go up a few directories?

A university built a student grades portal. Each student can log in and view their own grades at /profile?id=<their_id>.

You've been given a test account (student ID: 5). But there's a rumor that one very special student account holds the flag in its "notes" field...

Can you find it?

Test credentials: ID=5, Password=test123

Challenge URL: http://pacise26.badgerctf.com/chall/4/

Hint: Your student ID is 5. But what about the other students? Maybe try counting from the beginning.

The IT department built a handy web-based network diagnostic tool. Enter an IP address and it pings it for you!

But rumor has it the developer forgot to sanitize the input. The flag is in /flag.txt. Can you make the server do more than just ping?

Challenge URL: http://pacise26.badgerctf.com/chall/3/

Hint: What if the server is running your input as part of a shell command? Think about how you can chain commands together.