General Skills on picoCTF Writeup

Tab, Tab, Attack

Wed, 15 Jul 2026 02:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/189

題目解法

下載並解壓縮後，可以看到是一個有很多層的目錄，~~然後就可以直接複製整個路徑~~。

$ unzip Addadshashanammu.zip
Archive: Addadshashanammu.zip
creating: Addadshashanammu/
creating: Addadshashanammu/Almurbalarammi/
creating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/
creating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/
creating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/
creating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/Onnissiralis/
creating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/Onnissiralis/Ularradallaku/
extracting: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/Onnissiralis/Ularradallaku/fang-of-haynekhtnamet.c
inflating: Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/Onnissiralis/Ularradallaku/fang-of-haynekhtnamet

題目希望使用者只用 TAB 進行補全，所以可以輸入 cat 之後不斷按下 TAB 補全目錄或檔案名稱，最後就可以順讀取利包含 flag 的檔案。

$ cat Addadshashanammu/Almurbalarammi/Ashalmimilkala/Assurnabitashpi/Maelkashishi/Onnissiralis/Ularradallaku/fang-of-haynekhtnamet.c
#include <stdio.h>
int main(){
printf("*ZAP!* picoCTF{l3v-------------------------427}\n");
}

Magikarp Ground Mission

Mon, 13 Jul 2026 04:25:00 +0800

題目連結

https://learn.cylabacademy.org/library/189

題目解法

啟動後題目會提供目標主機名稱、使用者名稱、密碼、port 等資訊，類似下方字串： Login via ssh as ctf-player with the password, 8c606eb1 on the host wily-courier.picoctf.net and port 64506. 我們要使用 ssh 指令來連線到目標主機

ssh -p <port> <username>@<host>
ssh -p 64506 ctf-player@wily-courier.picoctf

連線後會提示確認 fingerprint 是否正確，輸入 yes 之後輸入密碼 (密碼不會顯示出來)

The authenticity of host '[wily-courier.picoctf.net]:64506 ([18.189.99.27]:64506)' can't be established.
ED25519 key fingerprint is: SHA256:ErlUUvYlrAxfSW1tIdzfOnGTBSr5OFkZvz0nMN4Vodw
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[wily-courier.picoctf.net]:64506' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
ctf-player@wily-courier.picoctf.net's password:

連線到主機後，使用 ls 指令查看當前目錄下有甚麼檔案

Codebook

Mon, 13 Jul 2026 04:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/238

題目解法

將 codebook.txt 與 code.py 下載到同個目錄中。執行 code.py 即可得到 flag。

$ python code.py
picoCTF{c0d------------------82c}

題目原始碼

codebook.txt

1

azbycxdwevfugthsirjqkplomn

code.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43



import random
import sys



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x13) + chr(0x01) + chr(0x17) + chr(0x07) + chr(0x2c) + chr(0x3a) + chr(0x2f) + chr(0x1a) + chr(0x0d) + chr(0x53) + chr(0x0c) + chr(0x47) + chr(0x0a) + chr(0x5f) + chr(0x5e) + chr(0x02) + chr(0x3e) + chr(0x5a) + chr(0x56) + chr(0x5d) + chr(0x45) + chr(0x5d) + chr(0x58) + chr(0x31) + chr(0x58) + chr(0x58) + chr(0x59) + chr(0x02) + chr(0x51) + chr(0x4c) + chr(0x5a) + chr(0x0c) + chr(0x13)



def print_flag():
 try:
 codebook = open('codebook.txt', 'r').read()

 password = codebook[4] + codebook[14] + codebook[13] + codebook[14] +\
 codebook[23]+ codebook[25] + codebook[16] + codebook[0] +\
 codebook[25]

 flag = str_xor(flag_enc, password)
 print(flag)
 except FileNotFoundError:
 print('Couldn\'t find codebook.txt. Did you download that file into the same directory as this script?')



def main():
 print_flag()



if __name__ == "__main__":
 main()

convertme.py

Mon, 13 Jul 2026 04:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/239

題目解法

使用 wget 指令下載檔案。

wget https://artifacts.picoctf.net/c/24/convertme.py

使用 python 執行腳本，腳本惠要求將一個十進位數字轉為二進位，輸入後即可得到 flag。

$ python convertme.py
If 16 is in decimal base, what is it in binary base?
Answer: 10000
That is correct! Here's your flag: picoCTF{4ll-----------------b39}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35



import random



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x15) + chr(0x07) + chr(0x08) + chr(0x06) + chr(0x27) + chr(0x21) + chr(0x23) + chr(0x15) + chr(0x5f) + chr(0x05) + chr(0x08) + chr(0x2a) + chr(0x1c) + chr(0x5e) + chr(0x1e) + chr(0x1b) + chr(0x3b) + chr(0x17) + chr(0x51) + chr(0x5b) + chr(0x58) + chr(0x5c) + chr(0x3b) + chr(0x42) + chr(0x57) + chr(0x5c) + chr(0x0d) + chr(0x5f) + chr(0x06) + chr(0x46) + chr(0x5c) + chr(0x13)


num = random.choice(range(10,101))

print('If ' + str(num) + ' is in decimal base, what is it in binary base?')

ans = input('Answer: ')

try:
 ans_num = int(ans, base=2)

 if ans_num == num:
 flag = str_xor(flag_enc, 'enkidu')
 print('That is correct! Here\'s your flag: ' + flag)
 else:
 print(str(ans_num) + ' and ' + str(num) + ' are not equal.')

except ValueError:
 print('That isn\'t a binary number. Binary numbers contain only 1\'s and 0\'s')

fixme1.py

Mon, 13 Jul 2026 03:50:00 +0800

題目連結

https://learn.cylabacademy.org/library/240

題目解法

下載腳本並執行後可以發現在第 20 行的地方報錯。

1
2
3
4


$ python fixme1.py
 File "/home/kali/workspace/fixme1.py", line 20
 print('That is correct! Here\'s your flag: ' + flag)
IndentationError: unexpected indent

使用 nano 或其他習慣的文字編輯器編輯檔案，將第 20 行最開頭的兩個空格刪除。

nano fixme2.py

要退出 nano 要按下 Ctrl + X，接著按下 Y，再按下 Enter 即可退出。退出後再次執行 python 腳本即可得到 flag。

$ python fixme1.py
That is correct! Here's your flag: picoCTF{1nd-------------------c8f}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21



import random



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x15) + chr(0x07) + chr(0x08) + chr(0x06) + chr(0x27) + chr(0x21) + chr(0x23) + chr(0x15) + chr(0x5a) + chr(0x07) + chr(0x00) + chr(0x46) + chr(0x0b) + chr(0x1a) + chr(0x5a) + chr(0x1d) + chr(0x1d) + chr(0x2a) + chr(0x06) + chr(0x1c) + chr(0x5a) + chr(0x5c) + chr(0x55) + chr(0x40) + chr(0x3a) + chr(0x58) + chr(0x0a) + chr(0x5d) + chr(0x53) + chr(0x43) + chr(0x06) + chr(0x56) + chr(0x0d) + chr(0x14)


flag = str_xor(flag_enc, 'enkidu')
 print('That is correct! Here\'s your flag: ' + flag)

fixme2.py

Mon, 13 Jul 2026 03:40:00 +0800

題目連結

https://learn.cylabacademy.org/library/241

題目解法

下載腳本並執行後可以發現在第 22 行的地方報錯。

1
2
3
4
5


$ python fixme2.py
 File "/home/kali/workspace/fixme2.py", line 22
 if flag = "":
 ^^^^^^^^^
SyntaxError: invalid syntax. Maybe you meant '==' or ':=' instead of '='?

使用 nano 或其他習慣的文字編輯器編輯檔案，將第 22 行的 = 改成 ==。

nano fixme2.py

要退出 nano 要按下 Ctrl + X，接著按下 Y，再按下 Enter 即可退出。退出後再次執行 python 腳本即可得到 flag。

$ python fixme2.py
That is correct! Here's your flag: picoCTF{3qu--------------------------efc}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27



import random



def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])


flag_enc = chr(0x15) + chr(0x07) + chr(0x08) + chr(0x06) + chr(0x27) + chr(0x21) + chr(0x23) + chr(0x15) + chr(0x58) + chr(0x18) + chr(0x11) + chr(0x41) + chr(0x09) + chr(0x5f) + chr(0x1f) + chr(0x10) + chr(0x3b) + chr(0x1b) + chr(0x55) + chr(0x1a) + chr(0x34) + chr(0x5d) + chr(0x51) + chr(0x40) + chr(0x54) + chr(0x09) + chr(0x05) + chr(0x04) + chr(0x57) + chr(0x1b) + chr(0x11) + chr(0x31) + chr(0x0d) + chr(0x5f) + chr(0x05) + chr(0x40) + chr(0x04) + chr(0x0b) + chr(0x0d) + chr(0x0a) + chr(0x19)


flag = str_xor(flag_enc, 'enkidu')

# Check that flag is not empty
if flag = "":
 print('String XOR encountered a problem, quitting.')
else:
 print('That is correct! Here\'s your flag: ' + flag)

Glitch Cat

Mon, 13 Jul 2026 03:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/242

題目解法

啟動題目並使用 nc 連線後，會得到一個包含 chr(0x61) 的字串。

$ nc saturn.picoctf.net 65005
'picoCTF{gl17ch_m3_n07_' + chr(0x61) + chr(0x34) + chr(0x33) + chr(0x39) + chr(0x32) + chr(0x64) + chr(0x32) + chr(0x65) + '}'

要解讀該字串有幾種方法，可以手動對照 ASCII 16 進為，或是直接使用 python 印出字串，就會自動轉成原始字元。使用 python 指令啟動 python 環境，用 print 將字串印出。

>>> print('picoCTF{gl17ch_m3_n07_' + chr(0x61) + chr(0x34) + chr(0x33) + chr(0x39) + chr(0x32) + chr(0x64) + chr(0x32) + chr(0x65) + '}')
picoCTF{gl1----------------d2e}

HashingJobApp

Mon, 13 Jul 2026 03:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/243

題目解法

啟動題目後，使用 nc 指令連線後，題目會提供一個字串，要求使用 md5 雜湊後的值，輸入正確三次即可得到 flag。可以搜尋 md5 雜湊工具、cyberchek、或是使用 md5sum 指令。 md5sum 使用方式：

$ echo -n "caffeine" | md5sum
e724f8b8a8349afb5beaeaa300323933 -

實際連線：

$ nc saturn.picoctf.net 56275
Please md5 hash the text between quotes, excluding the quotes: 'caffeine'
Answer:
e724f8b8a8349afb5beaeaa300323933
e724f8b8a8349afb5beaeaa300323933
Correct.
Please md5 hash the text between quotes, excluding the quotes: 'Japan'
Answer:
53a577bb3bc587b0c28ab808390f1c9b
53a577bb3bc587b0c28ab808390f1c9b
Correct.
Please md5 hash the text between quotes, excluding the quotes: 'hangnails'
Answer:
7e3193d5ef5d764bfd8874dda4b5253a
7e3193d5ef5d764bfd8874dda4b5253a
Correct.
picoCTF{4pp-----------------------de2}

PW Crack 1

Mon, 13 Jul 2026 02:45:00 +0800

題目連結

https://learn.cylabacademy.org/library/245

題目解法

將 level1.py 以及 level1.flag.txt.enc 兩個檔案放在同個目錄下。可以看到 level1.py 第 19 行有寫出密碼

user_pw == "1e1a"

執行腳本後輸入密碼 1e1a 即可得到 flag。

$ python level1.py
Please enter correct password for flag: 1e1a
Welcome back... your flag, user:
picoCTF{545---------------060}

題目原始碼

level1.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


### THIS FUNCTION WILL NOT HELP YOU FIND THE FLAG --LT ########################
def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])
###############################################################################


flag_enc = open('level1.flag.txt.enc', 'rb').read()



def level_1_pw_check():
 user_pw = input("Please enter correct password for flag: ")
 if( user_pw == "1e1a"):
 print("Welcome back... your flag, user:")
 decryption = str_xor(flag_enc.decode(), user_pw)
 print(decryption)
 return
 print("That password is incorrect")



level_1_pw_check()

PW Crack 2

Mon, 13 Jul 2026 02:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/246

題目解法

將 level2.py 以及 level2.flag.txt.enc 兩個檔案放在同個目錄下。查看題目原始碼，可以看到第 18 行，有寫出 user_pw 的值在等於多少的情況下，會通過。將 user_pw 的 16 進位 ASCII 轉成字元是 39ce。

user_pw == chr(0x33) + chr(0x39) + chr(0x63) + chr(0x65)

執行腳本後輸入 39ce 密碼即可得到 flag。

$ python3 level2.py
Please enter correct password for flag: 39ce
Welcome back... your flag, user:
picoCTF{tr4----------------42e}

題目原始碼

level2.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


### THIS FUNCTION WILL NOT HELP YOU FIND THE FLAG --LT ########################
def str_xor(secret, key):
 #extend key to secret length
 new_key = key
 i = 0
 while len(new_key) < len(secret):
 new_key = new_key + key[i]
 i = (i + 1) % len(key)
 return "".join([chr(ord(secret_c) ^ ord(new_key_c)) for (secret_c,new_key_c) in zip(secret,new_key)])
###############################################################################

flag_enc = open('level2.flag.txt.enc', 'rb').read()



def level_2_pw_check():
 user_pw = input("Please enter correct password for flag: ")
 if( user_pw == chr(0x33) + chr(0x39) + chr(0x63) + chr(0x65) ):
 print("Welcome back... your flag, user:")
 decryption = str_xor(flag_enc.decode(), user_pw)
 print(decryption)
 return
 print("That password is incorrect")



level_2_pw_check()

runme.py

Mon, 13 Jul 2026 02:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/250

題目解法

這題題目官方希望可以學習使用 wget 和 python 執行指令。假設只是要拿到 flag，可以直接下載後打開查看。以下是官方希望的做法：

從網站複製檔案連結，到 webshell 或是自己的 linux 主機使用 wget 指令下載檔案。

wget https://artifacts.picoctf.net/c/34/runme.py

下載後得到一個 runme.py 檔案，使用 python3 指令執行，即可得到 flag。

$ python3 runme.py
picoCTF{run--------run}

First Find

Sun, 12 Jul 2026 23:50:00 +0800

題目連結

https://learn.cylabacademy.org/library/320

題目解法

題目目標是找到 uber-secret.txt 這個檔案，在 linux 找檔案可以使用 find 這個指令，下載並解壓縮檔案後，使用以下指令尋找 uber-secret.txt 檔案。

$ find -name uber-secret.txt
./adequate_books/more_books/.secret/deeper_secrets/deepest_secrets/uber-secret.txt

找到檔案後使用 cat 讀取

$ cat ./adequate_books/more_books/.secret/deeper_secrets/deepest_secrets/uber-secret.txt
picoCTF{f1n---------------fd1}

Big Zip

Sun, 12 Jul 2026 23:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/322

題目解法

解壓縮後會得到非常多 .txt 檔案以及許多子目錄，根據提示知道要使用 grep 指令，grep 指令加上 -r 參數會遞迴的尋找目錄中以及所有子目錄中的所有檔案中是否有目標。

$ grep -r "pico"
folder_pmbymkjcya/folder_cawigcwvgv/folder_ltdayfmktr/folder_fnpfclfyee/whzxrpivpqld.txt:information on the record will last a billion years. Genes and brains and books encode picoCTF{gr3----------------0dc}

repetitions

Wed, 01 Jul 2026 22:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/371

題目解法

下載後得到以下字串

VmpGU1EyRXlUWGxTYmxKVVYwZFNWbGxyV21GV1JteDBUbFpPYWxKdFVsaFpWVlUxWVZaS1ZWWnVh
RmRXZWtab1dWWmtSMk5yTlZWWApiVVpUVm10d1VWZFdVa2RpYlZaWFZtNVdVZ3BpU0VKeldWUkNk
MlZXVlhoWGJYQk9VbFJXU0ZkcVRuTldaM0JZVWpGS2VWWkdaSGRXCk1sWnpWV3hhVm1KRk5XOVVW
VkpEVGxaYVdFMVhSbFZrTTBKVVZXcE9VazFXV2toT1dHUllDbUY2UWpSWk1GWlhWa2RHZEdWRlZs
aGkKYlRrelZERldUMkpzUWxWTlJYTkxDZz09Cg==

看到用兩個等於結尾且內容皆為字母及數字，推測使用 base64 編碼，解碼後得到以下字串

VjFSQ2EyTXlSblJUV0dSVllrWmFWRmx0TlZOalJtUlhZVVU1YVZKVVZuaFdWekZoWVZkR2NrNVVX
bUZTVmtwUVdWUkdibVZXVm5WUgpiSEJzWVRCd2VWVXhXbXBOUlRWSFdqTnNWZ3BYUjFKeVZGZHdW
MlZzVWxaVmJFNW9UVVJDTlZaWE1XRlVkM0JUVWpOUk1WWkhOWGRYCmF6QjRZMFZXVkdGdGVFVlhi
bTkzVDFWT2JsQlVNRXNLCg==

在解碼一次得到

V1RCa2MyRnRTWGRVYkZaVFltNVNjRmRXYUU5aVJUVnhWVzFhYVdGck5UWmFSVkpQWVRGbmVWVnVR
bHBsYTBweVUxWmpNRTVHWjNsVgpXR1JyVFdwV2VsUlZVbE5oTURCNVZXMWFUd3BTUjNRMVZHNXdX
azB4Y0VWVGFteEVXbm93T1VOblBUMEsK

在解碼一次得到

WTBkc2FtSXdUbFZTYm5ScFdWaE9iRTVxVW1aaWFrNTZaRVJPYTFneVVuQlpla0pyU1ZjME5GZ3lV
WGRrTWpWelRVUlNhMDB5VW1aTwpSR3Q1VG5wWk0xcEVTamxEWnowOUNnPT0K

在解碼一次得到

Y0dsamIwTlVSbnRpWVhObE5qUmZiak56ZEROa1gyUnBZekJrSVc0NFgyUXdkMjVzTURSa00yUmZO
RGt5TnpZM1pESjlDZz09Cg==

在解碼一次得到

cGljb0NURntiYXNlNjRfbjNzdDNkX2RpYzBkIW44X2Qwd25sMDRkM2RfNDkyNzY3ZDJ9Cg==

在解碼一次得到 flag

picoCTF{bas------------------------------------7d2}

binhexa

Wed, 01 Jul 2026 22:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/404

題目解法

依照問的問題計算答案

Welcome to the Binary Challenge!"
Your task is to perform the unique operations in the given order and find the final result in hexadecimal that yields the flag.
Binary Number 1: 11111110
Binary Number 2: 11100001

Number 1 和 Number 2 &(and) 計算

Question 1/6:
Operation 1: '&'
Perform the operation on Binary Number 1&2.
Enter the binary result: 11100000
Correct!

Number 1 和 Number 2 相加

Question 2/6:
Operation 2: '+'
Perform the operation on Binary Number 1&2.
Enter the binary result: 111011111
Correct!

Number 1 左移一位

Question 3/6:
Operation 3: '<<'
Perform a left shift of Binary Number 1 by 1 bits.
Enter the binary result: 111111100
Correct!

Number 2 右移一位

Question 4/6:
Operation 4: '>>'
Perform a right shift of Binary Number 2 by 1 bits .
Enter the binary result: 1110000
Correct!

Number 1 和 Number 2 相乘

Question 5/6:
Operation 5: '*'
Perform the operation on Binary Number 1&2.
Enter the binary result: 1101111100111110
Correct!

Number 1 和 Number 2 |(or) 計算

Question 6/6:
Operation 6: '|'
Perform the operation on Binary Number 1&2.
Enter the binary result: 11111111
Correct!

將 | 的結果轉成 16 進位

Enter the results of the last operation in hexadecimal: ff
Correct answer!
The flag is: picoCTF{b1t---------------------------------47e}

Blame Game

Wed, 01 Jul 2026 17:43:00 +0800

題目連結

https://learn.cylabacademy.org/library/405

題目解法

根據提示知道要查看誰更動過 message.py，所以要使用 git blame 指令

$ git blame message.py
23e9d4ce (picoCTF{@sk-----------------6ff} 2024-03-12 00:07:15 +0000 1) print("Hello, World!"

Collaborative Development

Wed, 01 Jul 2026 16:50:00 +0800

題目連結

https://learn.cylabacademy.org/library/410

題目解法

將題目檔案下載並解壓縮後，讀取 flag.py 發現並未包含 flag，git log 也沒有任何紀錄。不過可以發現有多個 branch。
```
$ git branch
feature/part-1
feature/part-2
feature/part-3
* main
```

使用 git checkout 切到不同分支查看，發現每個分支有包含部分 flag。

$ git checkout feature/part-1
Switched to branch 'feature/part-1'
$ cat flag.py
print("Printing the flag...")
print("picoCTF{t3@mw0rk_", end='')

重複相同步驟，將三部分的 flag 組合起來即可得到完整 flag。
```
picoCTF{t3@--------------------------------ec1}
```

Commitment Issues

Wed, 01 Jul 2026 16:43:00 +0800

題目連結

https://learn.cylabacademy.org/library/411

題目解法

將題目檔案下載並解壓縮後，讀取 message.txt 發現並未包含 flag，使用 git 指令查看 log 發現有兩個 log，其中 ea859bf 可能包含 flag。
```
$ git log --oneline
ef0b7cc (HEAD -> master) remove sensitive info
ea859bf create flag
```
使用 git checkout 指令來回到指定 log。
```
git checkout ea859bf
```
再次讀取 message.txt 發現有包含 flag 了。
```
$ cat message.txt
picoCTF{s@n-----------485}
```

endianness

Fri, 08 May 2026 22:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/414

題目解法

啟動並連線後，會提供一個長度為5的隨機字串。
第一個問題 Enter the Little Endian representation: 要將字串顛道並轉成 16 進位後輸入。
第二個問題 Enter the Big Endian representation: 直接將字串轉乘 16 進位輸入。

$ nc titan.picoctf.net 56752
Welcome to the Endian CTF!
You need to find both the little endian and big endian representations of a word.
If you get both correct, you will receive the flag.
Word: gobyv
Enter the Little Endian representation: 7679626F67
Correct Little Endian representation!
Enter the Big Endian representation: 676F627976
Correct Big Endian representation!
Congratulations! You found both endian representations correctly!
Your Flag is: picoCTF{3nd----------------------f0a}

ASCII 對照表

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdbool.h>
#include <ctype.h>
#include <time.h>

char *find_little_endian(const char *word)
{
 size_t word_len = strlen(word);
 char *little_endian = (char *)malloc((2 * word_len + 1) * sizeof(char));

 for (size_t i = word_len; i-- > 0;)
 {
 snprintf(&little_endian[(word_len - 1 - i) * 2], 3, "%02X", (unsigned char)word[i]);
 }

 little_endian[2 * word_len] = '\0';
 return little_endian;
}

char *find_big_endian(const char *word)
{
 size_t length = strlen(word);
 char *big_endian = (char *)malloc((2 * length + 1) * sizeof(char));

 for (size_t i = 0; i < length; i++)
 {
 snprintf(&big_endian[i * 2], 3, "%02X", (unsigned char)word[i]);
 }

 big_endian[2 * length] = '\0';
 return big_endian;
}

char *generate_random_word()
{
 printf("Welcome to the Endian CTF!\n");
 printf("You need to find both the little endian and big endian representations of a word.\n");
 printf("If you get both correct, you will receive the flag.\n");
 srand(time(NULL));

 int word_length = 5;
 char *word = (char *)malloc((word_length + 1) * sizeof(char));

 for (int i = 0; i < word_length; i++)
 {
 word[i] = (rand() % 26) + 'a';
 }

 word[word_length] = '\0';
 return word;
}

int main()
{
 char *challenge_word = generate_random_word();
 printf("Word: %s\n", challenge_word);
 fflush(stdout);

 char *little_endian = find_little_endian(challenge_word);
 size_t user_little_endian_size = strlen(little_endian);
 char user_little_endian[user_little_endian_size + 1];
 bool correct_flag = false;

 while (!correct_flag)
 {
 printf("Enter the Little Endian representation: ");
 fflush(stdout);
 scanf("%10s", user_little_endian);
 for (size_t i = 0; i < strlen(user_little_endian); i++)
 {
 user_little_endian[i] = toupper(user_little_endian[i]);
 }

 if (strncmp(user_little_endian, little_endian, user_little_endian_size) == 0)
 {
 printf("Correct Little Endian representation!\n");
 fflush(stdout);
 correct_flag = true;
 }
 else
 {
 printf("Incorrect Little Endian representation. Try again!\n");
 fflush(stdout);
 }
 }

 char *big_endian = find_big_endian(challenge_word);
 size_t user_big_endian_size = strlen(big_endian);
 char user_big_endian[user_big_endian_size + 1];

 bool final_flag = false;
 while (!final_flag)
 {
 printf("Enter the Big Endian representation: ");
 fflush(stdout);
 scanf("%10s", user_big_endian);
 for (size_t i = 0; i < strlen(user_big_endian); i++)
 {
 user_big_endian[i] = toupper(user_big_endian[i]);
 }

 if (strncmp(user_big_endian, big_endian, user_big_endian_size) == 0)
 {
 printf("Correct Big Endian representation!\n");
 fflush(stdout);
 final_flag = true;
 }
 else
 {
 printf("Incorrect Big Endian representation. Try again!\n");
 fflush(stdout);
 }
 }

 FILE *flag = fopen("flag.txt", "r");
 if (flag == NULL)
 {
 printf("Flag not found. Please run this on the server\n");
 fflush(stdout);
 exit(0);
 }

 char flag_content[100];
 fgets(flag_content, sizeof(flag_content), flag);
 printf("Congratulations! You found both endian representations correctly!\n");
 fflush(stdout);
 printf("Your Flag is: %s\n", flag_content);
 fflush(stdout);
 exit(0);

 return 0;
}

Super SSH

Fri, 08 May 2026 20:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/424

題目解法

這題題目是 ssh 的基礎教學，指令用法如下

ssh -p <port> <username>@<host>
ssh -p 52938 ctf-player@titan.picoctf.net

第一次連接後為了避免中間人攻擊，會確認 fingerprint，要輸入 yes 確認。
接著輸入密碼，輸入密碼時不會顯示任何內容，輸入完畢後按下 enter 即可連線。

$ ssh -p 52938 ctf-player@titan.picoctf.net
The authenticity of host '[titan.picoctf.net]:52938 ([3.139.174.234]:52938)' can't be established.
ED25519 key fingerprint is SHA256:4S9EbTSSRZm32I+cdM5TyzthpQryv5kudRP9PIKT7XQ.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[titan.picoctf.net]:52938' (ED25519) to the list of known hosts.
ctf-player@titan.picoctf.net's password:
Welcome ctf-player, here's your flag: picoCTF{s3c--------------------462}
Connection to titan.picoctf.net closed.

Time Machine

Fri, 08 May 2026 20:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/425

題目解法

下載並解壓縮後進入該目錄。
使用 git log 指令可以查看 commit 紀錄，而 flag 就寫在最新的 commit message 中。

$ git log --oneline
712314f (HEAD -> master) picoCTF{t1m--------------b3a}

Password Profiler

Wed, 06 May 2026 23:45:00 +0800

題目連結

https://learn.cylabacademy.org/library/712

題目解法

這題題目提示中有提到 CUPP 這個 python 工具，這是一個可以根據使用者提供的資訊生成密碼字典的工具。
從 github 將 CUPP clone 下來並執行。

git clone https://github.com/Mebus/cupp.git
cd cupp
python cupp.py -i

跟著指示一步一步輸入資料，即可生成密碼字典。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


$ python .\cupp.py -i
 ___________
 cupp.py! # Common
 \  # User
 \  ,__, # Passwords
 \  (oo)____ # Profiler
 (__) )\
 ||--|| * [ Muris Kurgas | j0rgan@remote-exploit.org ]
 [ Mebus | https://github.com/Mebus/]


[+] Insert the information about the victim to make a dictionary
[+] If you don't know all the info, just hit enter when asked! ;)

> First Name: Alice
> Surname: Johnson
> Nickname: AJ
> Birthdate (DDMMYYYY): 15071990


> Partners) name: Bob
> Partners) nickname:
> Partners) birthdate (DDMMYYYY):


> Child's name: Charlie
> Child's nickname:
> Child's birthdate (DDMMYYYY):


> Pet's name:
> Company name:


> Do you want to add some key words about the victim? Y/[N]:
> Do you want to add special chars at the end of words? Y/[N]:
> Do you want to add some random numbers at the end of words? Y/[N]:
> Leet mode? (i.e. leet = 1337) Y/[N]:

[+] Now making a dictionary...
[+] Sorting list and removing duplicates...
[+] Saving dictionary to alice.txt, counting 10359 words.
> Hyperspeed Print? (Y/n) :
[+] Now load your pistolero with alice.txt and shoot! Good luck!

以下是生成的密碼字典
passwords.txt

Binary Search

Mon, 04 May 2026 01:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/442

題目解法

使用 ssh 連線進去，不斷猜範圍內的鄭中間一定可以在 10 次內猜到。

webshell:~$ ssh -p 58451 ctf-player@atlas.picoctf.net
The authenticity of host '[atlas.picoctf.net]:58451 ([18.217.83.136]:58451)' can't be established.
ED25519 key fingerprint is SHA256:M8hXanE8l/Yzfs8iuxNsuFL4vCzCKEIlM/3hpO13tfQ.
This host key is known by the following other names/addresses:
~/.ssh/known_hosts:3: [hashed name]
~/.ssh/known_hosts:5: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[atlas.picoctf.net]:58451' (ED25519) to the list of known hosts.
ctf-player@atlas.picoctf.net's password:
Welcome to the Binary Search Game!
I'm thinking of a number between 1 and 1000.
Enter your guess: 500
Lower! Try again.
Enter your guess: 250
Higher! Try again.
Enter your guess: 375
Higher! Try again.
Enter your guess: 438
Higher! Try again.
Enter your guess: 469
Higher! Try again.
Enter your guess: 485
Higher! Try again.
Enter your guess: 493
Higher! Try again.
Enter your guess: 497
Higher! Try again.
Enter your guess: 499
Congratulations! You guessed the correct number: 499
Here's your flag: picoCTF{g00-------------07f}
Connection to atlas.picoctf.net closed.

Printer Shares

Mon, 04 May 2026 00:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/759

題目解法

列出共享目錄 (Enumeration)
首先我們使用 smbclient，嘗試匿名登入查看伺服器上有那些共享資料夾，輸入密碼處直接按 enter。

smbclient -L <host> -p <port> -U ""
smbclient -L mysterious-sea.picoctf.net -p 53486 -U ""

-L: 列出（List）所有的共享資源。
-p 53486: 指定題目給的連接埠。
-U "": 使用空用戶名（匿名）。

webshell:~$ smbclient -L mysterious-sea.picoctf.net -p 53486 -U ""
Password for [WORKGROUP\]:
Sharename Type Comment
--------- ---- -------
shares Disk Public Share With Guests
IPC$ IPC IPC Service (Samba 4.19.5-Ubuntu)
SMB1 disabled -- no workgroup available

根據上方輸出內容，看到一個名為 shares 的共享資料夾，使用以下指令進入：
```
smbclient //mysterious-sea.picoctf.net/shares -p 53486 -U ""
```
看到 smb: \> 代表成功進入

FANTASY CTF

Sat, 02 May 2026 23:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/471

題目解法

使用 nc 連線後不斷 enter，第一次遇到選項選 c，第二次選 a，即可得到 flag。

webshell:~$ nc verbal-sleep.picoctf.net 55371
FANTASY CTF SIMULATION
The simulation begins in the private room of Eibhilin, a bright, young student.
The room is dimly lit, with the glow of her multiple monitors casting an
electric blue hue on the walls. Around the room are posters of vintage movies
from the MCU — ancient guardians from another age staring down like digital
sentinels.
---
(Press Enter to continue...)
---
Eibhilin stretches back in her chair, adjusting the holo-display of her
keyboard. A soft hum of a nearby server fills the air as her AI companion,
`Nyx`, comes to life.
---
(Press Enter to continue...)
---
"Good evening, Ei," Nyx chirps, "The 3025 edition of picoCTF registration is
open. You asked me to remind so you could try out the competition for the first
time. Do you wish to proceed?"
---
(Press Enter to continue...)
---
Outside, the city of Nexalus glimmers under the stars, but Eibhilin's focus
remains entirely on the screen in front of her.
---
(Press Enter to continue...)
---
"Yes, Nyx. Let's do it!"
---
(Press Enter to continue...)
---
Nyx brings up the registration page.
Options:
A) *Register multiple accounts*
B) *Share an account with a friend*
C) *Register a single, private account*
[a/b/c] > c
Nyx nods, "Good choice, Ei. Let's proceed with a single, private account. It
can be tempting to try and do something 'clever', but registering multiple
accounts or sharing an account with a friend can lead to disqualification."
---
(Press Enter to continue...)
---
"Ok," Nyx says, "Registering you for the competition... There's an introductory
audio message, piping to your speakers."
---
(Press Enter to continue...)
---
"Welcome hacker! You're about to embark on a journey that will teach you many
esoteric and valuable skills. Our mission is to guide you in the right path,
that you may use these skills to protect and defend and never for selfish gain
or deceit. We hope you enjoy the challenges that our authors have devised this
year. Always remember: 'With great power, comes great responsibility!'"
---
(Press Enter to continue...)
---
Nyx continues, "I've gleaned from the Ether that in CTF competitions, it's
always good to start with the 'sanity' challenge. It should be the challenge
worth the least amount of points. I'll pull it up. You're looking for something
called the flag. You should know it when you see it."
---
(Press Enter to continue...)
---
"Oh interesting," Eibhilin says, "It seems like the sanity challenge is an old
school interactive fiction game."
---
(Press Enter to continue...)
---
Options:
A) *Play the game*
B) *Search the Ether for the flag*
[a/b] > a
"Good choice, Ei," Nyx says, "You never want to share flags or artifact
downloads."
---
(Press Enter to continue...)
---
Playing the Game
Playing the Game: 100%|██████████████████████████████████████ [time left: 00:00]
Playing the Game completed successfully!
---
(Press Enter to continue...)
---
"That was fun!" Eibhilin exclaims, "I found the flag!"
---
(Press Enter to continue...)
---
Nyx says, "Great job, Ei! I've read that a lot of players create writeups of
interesting challenges they solve during the competition. Just be sure to wait
to publish them until after the winners have been announced. We can work on
that together if you'd like."
---
(Press Enter to continue...)
---
"Thanks, Nyx! Here's the flag I found: picoCTF{m11--------------------7f5}"
---
(Press Enter to continue...)
---
"Great, you just got 10 points!" Nyx exclaims.
---
(Press Enter to continue...)
---
Eibhilin smiles, "I'm off to a good start!"
---
(Press Enter to continue...)
---

Log Hunt

Sat, 02 May 2026 04:50:00 +0800

題目連結

https://learn.cylabacademy.org/library/527

題目解法

下載得到 server.log 後，使用 cat 查看發現是很長的檔案，加上 grep 指令嘗試尋找 flag 開頭 "pico" 文字。

webshell:~$ cat server.log | grep "pico"
[1990-08-09 10:00:10] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:04:27] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:04:29] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:04:37] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:19:23] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:19:29] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:19:32] INFO FLAGPART: picoCTF{us3_

發現 flag 都是以 FLAGPART 開頭，因此再次使用 grep 指令尋找

webshell:~$ cat server.log | grep "FLAGPART"
[1990-08-09 10:00:10] INFO FLAGPART: picoCTF{us3_
[1990-08-09 10:02:55] INFO FLAGPART: y0urlinux_
[1990-08-09 10:05:54] INFO FLAGPART: sk1lls_
[1990-08-09 10:05:55] INFO FLAGPART: sk1lls_
[1990-08-09 10:10:54] INFO FLAGPART: cedfa5fb}
[1990-08-09 10:10:58] INFO FLAGPART: cedfa5fb}
[1990-08-09 10:11:06] INFO FLAGPART: cedfa5fb}
[1990-08-09 11:04:27] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:04:29] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:04:37] INFO FLAGPART: picoCTF{us3_
[1990-08-09 11:09:16] INFO FLAGPART: y0urlinux_
[1990-08-09 11:09:19] INFO FLAGPART: y0urlinux_
[1990-08-09 11:12:40] INFO FLAGPART: sk1lls_
[1990-08-09 11:12:45] INFO FLAGPART: sk1lls_
[1990-08-09 11:16:58] INFO FLAGPART: cedfa5fb}
[1990-08-09 11:16:59] INFO FLAGPART: cedfa5fb}
[1990-08-09 11:17:00] INFO FLAGPART: cedfa5fb}
[1990-08-09 12:19:23] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:19:29] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:19:32] INFO FLAGPART: picoCTF{us3_
[1990-08-09 12:23:43] INFO FLAGPART: y0urlinux_
[1990-08-09 12:23:45] INFO FLAGPART: y0urlinux_
[1990-08-09 12:23:53] INFO FLAGPART: y0urlinux_
[1990-08-09 12:25:32] INFO FLAGPART: sk1lls_
[1990-08-09 12:28:45] INFO FLAGPART: cedfa5fb}
[1990-08-09 12:28:49] INFO FLAGPART: cedfa5fb}
[1990-08-09 12:28:52] INFO FLAGPART: cedfa5fb}

將 flag 以合理的順序組合。

picoCTF{us3-----------------------5fb}

MultiCode

Sat, 02 May 2026 03:25:00 +0800

題目連結

https://learn.cylabacademy.org/library/710

題目解法

下載 message.txt，內容如下。

1

NjM3NjcwNjI1MDQ3NTMyNTM3NDI2MTcyNjY2NzcyNzE1ZjcyNjE3MDMwNzE3NjYxNzQ1ZjczNzM2ZjZmNmY3MzM1MzcyNTM3NDQ=

目前字串由大小寫字母及數字組成，且結尾是 =，可推測是使用 base64 編碼，解碼後如下。
```
637670625047532537426172666772715f72617030717661745f73736f6f6f733537253744
```
接著字串由多個數字以及 a 到 f 字母組成，可推測是使用 hex 編碼，解碼後如下。
```
cvpbPGS%7Barfgrq_rap0qvat_ssooos57%7D
```
字串中有 % 符號，且後面跟著兩個十六進位數字，這是 URL encoding 的特徵，解碼後如下。
```
cvpbPGS{arfgrq_rap0qvat_ssooos57}
```
字串開頭應該是 picoCTF，但是目前字串開頭是 cvpbPGS，使用 ROT13 進行解密，得到 flag。
```
picoCTF{nes-----------------b57}
```

提示

建議可以使用 cyberchef 這個線上工具來進行解碼，以下是解碼的步驟：

Piece by Piece

Fri, 01 May 2026 18:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/740

題目解法

使用題目提供的 ssh 連線進去後，可以看到 instructions.txt。根據提示內容可以知道要將所有部分接在一起後解壓縮，才能獲得 flag。

1
2
3
4
5
6


Hint:

- The flag is split into multiple parts as a zipped file.
- Use Linux commands to combine the parts into one file.
- The zip file is password protected. Use this "supersecret" password to extract the zip file.
- After unzipping, check the extracted text file for the flag.

SUDO MAKE ME A SANDWICH

Fri, 01 May 2026 17:40:00 +0800

題目連結

https://learn.cylabacademy.org/library/735

題目解法

使用題目提供的 ssh 連線進去後，可以看到家目錄中有 flag.txt，但沒有權限讀取。

ctf-player@challenge:~$ ls
flag.txt
ctf-player@challenge:~$ cat flag.txt
cat: flag.txt: Permission denied
ctf-player@challenge:~$ sudo cat flag.txt
[sudo] password for ctf-player:
Sorry, user ctf-player is not allowed to execute '/usr/bin/cat flag.txt' as root on challenge.

使用 sudo 加上 -l 參數可以查看當前使用者使用 sudo 的權限，發現可以使用 sudo 執行 emacs 指令。

ctf-player@challenge:~$ sudo -l
Matching Defaults entries for ctf-player on challenge:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User ctf-player may run the following commands on challenge:
(ALL) NOPASSWD: /bin/emacs

emacs 是一個文字編輯器，可以使用 emacs 開啟 flag.txt，就可以看到裡面的內容了。

Bytemancy 0

Wed, 22 Apr 2026 02:46:08 +0800

題目連結

https://learn.cylabacademy.org/library/742

題目解法

下載題目提供的原始碼後，，可以看到第11行顯示當使用者輸入 3 個連續 e 時，就會印出 flag。
app.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


while(True):
 try:
 print('⊹──────[ BYTEMANCY-0 ]──────⊹')
 print("☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐")
 print()
 print('Send me ASCII DECIMAL 101, 101, 101, side-by-side, no space.')
 print()
 print("☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐")
 print('⊹─────────────⟡─────────────⊹')
 user_input = input('==> ')
 if user_input == "\x65\x65\x65":
 print(open("./flag.txt", "r").read())
 break
 else:
 print("That wasn't it. I got: " + str(user_input))
 print()
 print()
 print()
 except Exception as e:
 print(e)
 break

ping-cmd

Wed, 22 Apr 2026 01:55:48 +0800

題目連結

https://learn.cylabacademy.org/library/757

題目解法

啟動後透過 nc 指令連線，連線後內容大致如下，可以輸入一個 IP 位址（題目為了安全性只允許8.8.8.8）。

$ nc mysterious-sea.picoctf.net 54500
Enter an IP address to ping! (We have tight security because we only allow '8.8.8.8'): 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=115 time=8.44 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=115 time=8.43 ms
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 8.433/8.438/8.444/0.005 m

根據提示及猜測，題目極有可能是使用 ping 指令後面加上使用者輸入的內容，因此可能存在指令注入（Command Injection）。因此可以嘗試在 IP 位址後面加上 ; 再加上其他指令來執行，以下為嘗試的指令。可以看到執行後列出當前目錄下有兩個檔案，分別是 flag.txt 和 script.sh。

Bytemancy 1

Fri, 17 Apr 2026 22:43:28 +0800

題目連結

https://learn.cylabacademy.org/library/762

題目解法

將題目提供的原始碼下載後，可以看到第11行顯示當使用者輸入 1751 個 e 時，就會印出 flag。
app.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


while(True):
 try:
 print('⊹──────[ BYTEMANCY-1 ]──────⊹')
 print("☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐")
 print()
 print('Send me ASCII DECIMAL 101 1751 times, side-by-side, no space.')
 print()
 print("☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐☉⟊☽☈⟁⧋⟡☍⟐")
 print('⊹─────────────⟡─────────────⊹')
 user_input = input('==> ')
 if user_input == "\x65"*1751:
 print(open("./flag.txt", "r").read())
 break
 else:
 print("That wasn't it. I got: " + str(user_input))
 print()
 print()
 print()
 except Exception as e:
 print(e)
 break

My Git

Fri, 17 Apr 2026 21:18:48 +0800

題目連結

https://learn.cylabacademy.org/library/764

題目解法

輸入 ssh 指令以及密碼來 clone 下專案到本地。

查看 README.md 內容，得知要使用使用者名稱 root、電子郵件 root@picoctf 來推送 flag.txt 到遠端。

1
2
3
4
5
6
7
8


$ cat README.md
# MyGit

### If you want the flag, make sure to push the flag!

Only flag.txt pushed by ```root:root@picoctf``` will be updated with the flag.

GOOD LUCK!

使用 git config 來設定使用者名稱和電子郵件

Undo

Thu, 16 Apr 2026 22:00:24 +0800

題目連結

https://learn.cylabacademy.org/library/766

題目解法

透過 nc 指令連線

步驟一：

--- Step 1 ---
Current flag: KTBxcDI0bnIwLWZhMDFnQHplMHNmYTRlRy1nazNnLXRhMWZlcmlyRShTR1BicHZj
Hint: Base64 encoded the string.
Enter the Linux command to reverse it:

要求使用 base64 解密，使用以下指令來解密

base64 -d

步驟二：

--- Step 2 ---
Current flag: )0qp24nr0-fa01g@ze0sfa4eG-gk3g-ta1ferirE(SGPbpvc
Hint: Reversed the text.
Enter the Linux command to reverse it:

要求使用將字串反轉，使用以下指令來反轉

rev

步驟三：

--- Step 3 ---
Current flag: cvpbPGS(Eriref1at-g3kg-Ge4afs0ez@g10af-0rn42pq0)
Hint: Replaced underscores with dashes.
Enter the Linux command to reverse it:

要求將字串的 ‘-’ 換成 ‘_’, 使用以下指令來替換

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a