PicoCTF 2024 on picoCTF Writeup

binhexa

Wed, 01 Jul 2026 22:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/404

題目解法

依照問的問題計算答案

Welcome to the Binary Challenge!"
Your task is to perform the unique operations in the given order and find the final result in hexadecimal that yields the flag.
Binary Number 1: 11111110
Binary Number 2: 11100001

Number 1 和 Number 2 &(and) 計算

Question 1/6:
Operation 1: '&'
Perform the operation on Binary Number 1&2.
Enter the binary result: 11100000
Correct!

Number 1 和 Number 2 相加

Question 2/6:
Operation 2: '+'
Perform the operation on Binary Number 1&2.
Enter the binary result: 111011111
Correct!

Number 1 左移一位

Question 3/6:
Operation 3: '<<'
Perform a left shift of Binary Number 1 by 1 bits.
Enter the binary result: 111111100
Correct!

Number 2 右移一位

Question 4/6:
Operation 4: '>>'
Perform a right shift of Binary Number 2 by 1 bits .
Enter the binary result: 1110000
Correct!

Number 1 和 Number 2 相乘

Question 5/6:
Operation 5: '*'
Perform the operation on Binary Number 1&2.
Enter the binary result: 1101111100111110
Correct!

Number 1 和 Number 2 |(or) 計算

Question 6/6:
Operation 6: '|'
Perform the operation on Binary Number 1&2.
Enter the binary result: 11111111
Correct!

將 | 的結果轉成 16 進位

Enter the results of the last operation in hexadecimal: ff
Correct answer!
The flag is: picoCTF{b1t---------------------------------47e}

Blame Game

Wed, 01 Jul 2026 17:43:00 +0800

題目連結

https://learn.cylabacademy.org/library/405

題目解法

根據提示知道要查看誰更動過 message.py，所以要使用 git blame 指令

$ git blame message.py
23e9d4ce (picoCTF{@sk-----------------6ff} 2024-03-12 00:07:15 +0000 1) print("Hello, World!"

Bookmarklet

Wed, 01 Jul 2026 17:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/406

題目解法

進入網站後點選畫面上的程式碼，可以複製一段 JavaScript 腳本，按下 F12 開啟開發者工具，選取 console 並且貼上剛剛的程式碼，即可得到 flag。

CanYouSee

Wed, 01 Jul 2026 17:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/408

題目解法

下載並解壓縮後得到一張 .jpg 檔，使用 exiftool 檢查發現一串可疑的資料

$ exiftool ukn_reality.jpg
ExifTool Version Number : 13.50
File Name : ukn_reality.jpg
Directory : .
File Size : 2.3 MB
File Modification Date/Time : 2024:02:15 17:40:17-05:00
File Access Date/Time : 2026:07:01 05:16:50-04:00
File Inode Change Date/Time : 2026:07:01 05:16:41-04:00
File Permissions : -rw-r--r--
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.01
Resolution Unit : inches
X Resolution : 72
Y Resolution : 72
XMP Toolkit : Image::ExifTool 11.88
Attribution URL : cGljb0NURntNRTc0RDQ3QV9ISUREM05fNGRhYmRkY2J9Cg==
Image Width : 4308
Image Height : 2875
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 4308x2875
Megapixels : 12.4

Attribution URL 的資料很可疑，像是使用 base64 編碼後的內容，解碼後即可得到 flag。

Collaborative Development

Wed, 01 Jul 2026 16:50:00 +0800

題目連結

https://learn.cylabacademy.org/library/410

題目解法

將題目檔案下載並解壓縮後，讀取 flag.py 發現並未包含 flag，git log 也沒有任何紀錄。不過可以發現有多個 branch。
```
$ git branch
feature/part-1
feature/part-2
feature/part-3
* main
```

使用 git checkout 切到不同分支查看，發現每個分支有包含部分 flag。

$ git checkout feature/part-1
Switched to branch 'feature/part-1'
$ cat flag.py
print("Printing the flag...")
print("picoCTF{t3@mw0rk_", end='')

重複相同步驟，將三部分的 flag 組合起來即可得到完整 flag。
```
picoCTF{t3@--------------------------------ec1}
```

Commitment Issues

Wed, 01 Jul 2026 16:43:00 +0800

題目連結

https://learn.cylabacademy.org/library/411

題目解法

將題目檔案下載並解壓縮後，讀取 message.txt 發現並未包含 flag，使用 git 指令查看 log 發現有兩個 log，其中 ea859bf 可能包含 flag。
```
$ git log --oneline
ef0b7cc (HEAD -> master) remove sensitive info
ea859bf create flag
```
使用 git checkout 指令來回到指定 log。
```
git checkout ea859bf
```
再次讀取 message.txt 發現有包含 flag 了。
```
$ cat message.txt
picoCTF{s@n-----------485}
```

endianness

Fri, 08 May 2026 22:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/414

題目解法

啟動並連線後，會提供一個長度為5的隨機字串。
第一個問題 Enter the Little Endian representation: 要將字串顛道並轉成 16 進位後輸入。
第二個問題 Enter the Big Endian representation: 直接將字串轉乘 16 進位輸入。

$ nc titan.picoctf.net 56752
Welcome to the Endian CTF!
You need to find both the little endian and big endian representations of a word.
If you get both correct, you will receive the flag.
Word: gobyv
Enter the Little Endian representation: 7679626F67
Correct Little Endian representation!
Enter the Big Endian representation: 676F627976
Correct Big Endian representation!
Congratulations! You found both endian representations correctly!
Your Flag is: picoCTF{3nd----------------------f0a}

ASCII 對照表

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdbool.h>
#include <ctype.h>
#include <time.h>

char *find_little_endian(const char *word)
{
 size_t word_len = strlen(word);
 char *little_endian = (char *)malloc((2 * word_len + 1) * sizeof(char));

 for (size_t i = word_len; i-- > 0;)
 {
 snprintf(&little_endian[(word_len - 1 - i) * 2], 3, "%02X", (unsigned char)word[i]);
 }

 little_endian[2 * word_len] = '\0';
 return little_endian;
}

char *find_big_endian(const char *word)
{
 size_t length = strlen(word);
 char *big_endian = (char *)malloc((2 * length + 1) * sizeof(char));

 for (size_t i = 0; i < length; i++)
 {
 snprintf(&big_endian[i * 2], 3, "%02X", (unsigned char)word[i]);
 }

 big_endian[2 * length] = '\0';
 return big_endian;
}

char *generate_random_word()
{
 printf("Welcome to the Endian CTF!\n");
 printf("You need to find both the little endian and big endian representations of a word.\n");
 printf("If you get both correct, you will receive the flag.\n");
 srand(time(NULL));

 int word_length = 5;
 char *word = (char *)malloc((word_length + 1) * sizeof(char));

 for (int i = 0; i < word_length; i++)
 {
 word[i] = (rand() % 26) + 'a';
 }

 word[word_length] = '\0';
 return word;
}

int main()
{
 char *challenge_word = generate_random_word();
 printf("Word: %s\n", challenge_word);
 fflush(stdout);

 char *little_endian = find_little_endian(challenge_word);
 size_t user_little_endian_size = strlen(little_endian);
 char user_little_endian[user_little_endian_size + 1];
 bool correct_flag = false;

 while (!correct_flag)
 {
 printf("Enter the Little Endian representation: ");
 fflush(stdout);
 scanf("%10s", user_little_endian);
 for (size_t i = 0; i < strlen(user_little_endian); i++)
 {
 user_little_endian[i] = toupper(user_little_endian[i]);
 }

 if (strncmp(user_little_endian, little_endian, user_little_endian_size) == 0)
 {
 printf("Correct Little Endian representation!\n");
 fflush(stdout);
 correct_flag = true;
 }
 else
 {
 printf("Incorrect Little Endian representation. Try again!\n");
 fflush(stdout);
 }
 }

 char *big_endian = find_big_endian(challenge_word);
 size_t user_big_endian_size = strlen(big_endian);
 char user_big_endian[user_big_endian_size + 1];

 bool final_flag = false;
 while (!final_flag)
 {
 printf("Enter the Big Endian representation: ");
 fflush(stdout);
 scanf("%10s", user_big_endian);
 for (size_t i = 0; i < strlen(user_big_endian); i++)
 {
 user_big_endian[i] = toupper(user_big_endian[i]);
 }

 if (strncmp(user_big_endian, big_endian, user_big_endian_size) == 0)
 {
 printf("Correct Big Endian representation!\n");
 fflush(stdout);
 final_flag = true;
 }
 else
 {
 printf("Incorrect Big Endian representation. Try again!\n");
 fflush(stdout);
 }
 }

 FILE *flag = fopen("flag.txt", "r");
 if (flag == NULL)
 {
 printf("Flag not found. Please run this on the server\n");
 fflush(stdout);
 exit(0);
 }

 char flag_content[100];
 fgets(flag_content, sizeof(flag_content), flag);
 printf("Congratulations! You found both endian representations correctly!\n");
 fflush(stdout);
 printf("Your Flag is: %s\n", flag_content);
 fflush(stdout);
 exit(0);

 return 0;
}

IntroToBurp

Fri, 08 May 2026 21:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/419

題目解法

啟動題目後開啟 Burp Suite 並開啟他的瀏覽器，隨意註冊帳號並送出，題目會要求輸入 OTP，開啟 Brup Suite 的 Proxy 頁面並啟動 intercept。隨意送出一個 otp 後查看攔截到的請求，會有一段 Cookie: session。

Cookie: session=.eJxVjMsOwiAURP-FtYtWHuX6Ee5dEeBCbCzQ8EhjjP_udWPibs6ZzLyYX_uTXdj1xk7MtxpNL4-QyQBKLzg6LQSESS_CInoHs7JcOsetBFh0VEC7OLbNZJsCzSymNZMrfSfSILWQhLtt7SgVyf0i2XvJweSRXKjUTPOZC6kW_T0dLdS_z_cHspM0ng.af3ngw.AmwUYp3JlxixMAMPGGJxaFRDeos

這個是 Flask Session Cookie 的格式，主要分成三段資料，依序是內容物 (Payload)、時間戳 (Timestamp)、簽章 (Signature)，假設是 e 開頭的可以直接使用 base64 解碼，假設是使用 .e 開頭代表有壓縮過，要透過 flask-unsign 才可以解碼。

$ flask-unsign --decode --cookie ".eJxVjMsOwiAURP-FtYtWHuX6Ee5dEeBCbCzQ8EhjjP_udWPibs6ZzLyYX_uTXdj1xk7MtxpNL4-QyQBKLzg6LQSESS_CInoHs7JcOsetBFh0VEC7OLbNZJsCzSymNZMrfSfSILWQhLtt7SgVyf0i2XvJweSRXKjUTPOZC6kW_T0dLdS_z_cHspM0ng.af3ngw.AmwUYp3JlxixMAMPGGJxaFRDeos"
{'city': 'NY', 'csrf_token': '9d5c43db8449e0874addcb916a35bb3a59978f69', 'full_name': 'admin', 'otp': '895845', 'password': 'password', 'phone_number': '0123456789', 'username': 'admin'}

解碼後可以發現 'otp': '895845'，將請求修改成 otp=895845 送出即可得到 flag。

picoCTF{#0T----------------------d21}

Secret of the Polyglot

Fri, 08 May 2026 20:35:00 +0800

題目連結

https://learn.cylabacademy.org/library/423

題目解法

下載題目的檔案後發現是一個 .pdf 檔，打開後有後半段 flag

1n_---------------5c0}

根據提示可以知道要以不同方式打開檔案，用十六進位編輯器打開可以發現開頭是 PNG。

00000000: 8950 4e47 0d0a 1a0a 0000 000d 4948 4452 .PNG........IHDR
00000010: 0000 0032 0000 0032 0806 0000 001e 3f88 ...2...2......?.
00000020: b100 0001 8569 4343 5049 4343 2070 726f .....iCCPICC pro
00000030: 6669 6c65 0000 2891 7d91 3d48 c340 1cc5 file..(.}.=H.@..
00000040: 5f53 a5a2 1511 3b88 0866 a80e 6241 54c4 _S....;..f..bAT.

將附檔名改成 .png 即可以圖片方式打開，得到前半段 flag。

picoCTF{f1u3n7_

picoCTF{f1u----------------------5c0}

Super SSH

Fri, 08 May 2026 20:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/424

題目解法

這題題目是 ssh 的基礎教學，指令用法如下

ssh -p <port> <username>@<host>
ssh -p 52938 ctf-player@titan.picoctf.net

第一次連接後為了避免中間人攻擊，會確認 fingerprint，要輸入 yes 確認。
接著輸入密碼，輸入密碼時不會顯示任何內容，輸入完畢後按下 enter 即可連線。

$ ssh -p 52938 ctf-player@titan.picoctf.net
The authenticity of host '[titan.picoctf.net]:52938 ([3.139.174.234]:52938)' can't be established.
ED25519 key fingerprint is SHA256:4S9EbTSSRZm32I+cdM5TyzthpQryv5kudRP9PIKT7XQ.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[titan.picoctf.net]:52938' (ED25519) to the list of known hosts.
ctf-player@titan.picoctf.net's password:
Welcome ctf-player, here's your flag: picoCTF{s3c--------------------462}
Connection to titan.picoctf.net closed.

Time Machine

Fri, 08 May 2026 20:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/425

題目解法

下載並解壓縮後進入該目錄。
使用 git log 指令可以查看 commit 紀錄，而 flag 就寫在最新的 commit message 中。

$ git log --oneline
712314f (HEAD -> master) picoCTF{t1m--------------b3a}

Unminify

Fri, 08 May 2026 19:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/427

題目解法

開啟網站後，按下 Ctrl + u 即可查看網頁原始碼，內容如下

1
2

<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>picoCTF - picoGym | Unminify Challenge</title><link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png"><style>body{font-family:"Lucida Console",Monaco,monospace}h1,p{color:#000}</style></head><body class="picoctf{}" style="margin:0"><div class="picoctf{}" style="margin:0;padding:0;background-color:#757575;display:auto;height:40%"><a class="picoctf{}" href="/"><img src="picoctf-logo-horizontal-white.svg" alt="picoCTF logo" style="display:inline-block;width:160px;height:90px;padding-left:30px"></a></div><center><br class="picoctf{}"><br class="picoctf{}"><div class="picoctf{}" style="padding-top:30px;border-radius:3%;box-shadow:0 5px 10px #0000004d;width:50%;align-self:center"><img class="picoctf{}" src="hero.svg" alt="flag art" style="width:150px;height:150px"><div class="picoctf{}" style="width:85%"><h2 class="picoctf{}">Welcome to my flag distribution website!</h2><div class="picoctf{}" style="width:70%"><p class="picoctf{}">If you're reading this, your browser has succesfully received the flag.</p><p class="picoCTF{pr3--------------82e}"></p><p class="picoctf{}">I just deliver flags, I don't know how to read them...</p></div></div><br class="picoctf{}"></div></center></body></html>

即可找到 flag。

picoCTF{pr3--------------82e}

format string 0

Mon, 04 May 2026 02:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/433

題目解法

這題題目是有關於格式化字串攻擊 (Format String Attack)，要從選項中選出潛在風險的字串。
第一題的三個字串中，Gr%114d_Cheese 包含 %ll。

"Breakf@st_Burger", "Gr%114d_Cheese", "Bac0n_D3luxe"

第二題的三個字串中，Cla%sic_Che%s%steak 包含 %s。

Pe%to_Portobello, $outhwest_Burger, Cla%sic_Che%s%steak

webshell:~$ nc mimas.picoctf.net 49550
Welcome to our newly-opened burger place Pico 'n Patty! Can you help the picky customers find their favorite burger?
Here comes the first customer Patrick who wants a giant bite.
Please choose from the following burgers: Breakf@st_Burger, Gr%114d_Cheese, Bac0n_D3luxe
Enter your recommendation: Gr%114d_Cheese
Gr 4202954_Cheese
Good job! Patrick is happy! Now can you serve the second customer?
Sponge Bob wants something outrageous that would break the shop (better be served quick before the shop owner kicks you out!)
Please choose from the following burgers: Pe%to_Portobello, $outhwest_Burger, Cla%sic_Che%s%steak
Enter your recommendation: Cla%sic_Che%s%steak
ClaCla%sic_Che%s%steakic_Che(null)
picoCTF{7h3---------------------------------405}

heap 0

Mon, 04 May 2026 02:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/438

題目解法

分析原始碼可以在第 16 行看到當 safe_var 不等於 "bico" 時就能順利印出 flag。按下 1. Print Heap 會印出 Heap Data 的位址。
使用 2. Write to buffer 可以將資料寫入上面的位址 (0x5aec6d8702b0)，上面與下面的位址相差 0x20，只要輸入的內容長度超過 32 位元就會造成 buffer overflow，會覆蓋掉 bico，之後使用 4. Print Flag 就會順利印出 flag 了。

webshell:~$ nc tethys.picoctf.net 50333
Welcome to heap0!
I put my data on the heap so it should be safe from any tampering.
Since my data isn't on the stack I'll even let you write whatever info you want to the heap, I already took care of using malloc for you.
Heap State:
+-------------+----------------+
[*] Address -> Heap Data
+-------------+----------------+
[*] 0x6242e49372b0 -> pico
+-------------+----------------+
[*] 0x6242e49372d0 -> bico
+-------------+----------------+
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 1
Heap State:
+-------------+----------------+
[*] Address -> Heap Data
+-------------+----------------+
[*] 0x6242e49372b0 -> pico
+-------------+----------------+
[*] 0x6242e49372d0 -> bico
+-------------+----------------+
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 2
Data for buffer: 00000000000000000000000000000000overflow
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 1
Heap State:
+-------------+----------------+
[*] Address -> Heap Data
+-------------+----------------+
[*] 0x6242e49372b0 -> 00000000000000000000000000000000overflow
+-------------+----------------+
[*] 0x6242e49372d0 -> overflow
+-------------+----------------+
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 3
Take a look at my variable: safe_var = overflow
1. Print Heap: (print the current state of the heap)
2. Write to buffer: (write to your own personal block of data on the heap)
3. Print safe_var: (I'll even let you look at my variable on the heap, I'm confident it can't be modified)
4. Print Flag: (Try to print the flag, good luck)
5. Exit
Enter your choice: 4
YOU WIN
picoCTF{my_-------------------------1a6}

題目原始碼

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127


#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define FLAGSIZE_MAX 64
// amount of memory allocated for input_data
#define INPUT_DATA_SIZE 5
// amount of memory allocated for safe_var
#define SAFE_VAR_SIZE 5

int num_allocs;
char *safe_var;
char *input_data;

void check_win() {
 if (strcmp(safe_var, "bico") != 0) {
 printf("\nYOU WIN\n");

 // Print flag
 char buf[FLAGSIZE_MAX];
 FILE *fd = fopen("flag.txt", "r");
 fgets(buf, FLAGSIZE_MAX, fd);
 printf("%s\n", buf);
 fflush(stdout);

 exit(0);
 } else {
 printf("Looks like everything is still secure!\n");
 printf("\nNo flage for you :(\n");
 fflush(stdout);
 }
}

void print_menu() {
 printf("\n1. Print Heap:\t\t(print the current state of the heap)"
 "\n2. Write to buffer:\t(write to your own personal block of data "
 "on the heap)"
 "\n3. Print safe_var:\t(I'll even let you look at my variable on "
 "the heap, "
 "I'm confident it can't be modified)"
 "\n4. Print Flag:\t\t(Try to print the flag, good luck)"
 "\n5. Exit\n\nEnter your choice: ");
 fflush(stdout);
}

void init() {
 printf("\nWelcome to heap0!\n");
 printf(
 "I put my data on the heap so it should be safe from any tampering.\n");
 printf("Since my data isn't on the stack I'll even let you write whatever "
 "info you want to the heap, I already took care of using malloc for "
 "you.\n\n");
 fflush(stdout);
 input_data = malloc(INPUT_DATA_SIZE);
 strncpy(input_data, "pico", INPUT_DATA_SIZE);
 safe_var = malloc(SAFE_VAR_SIZE);
 strncpy(safe_var, "bico", SAFE_VAR_SIZE);
}

void write_buffer() {
 printf("Data for buffer: ");
 fflush(stdout);
 scanf("%s", input_data);
}

void print_heap() {
 printf("Heap State:\n");
 printf("+-------------+----------------+\n");
 printf("[*] Address -> Heap Data \n");
 printf("+-------------+----------------+\n");
 printf("[*] %p -> %s\n", input_data, input_data);
 printf("+-------------+----------------+\n");
 printf("[*] %p -> %s\n", safe_var, safe_var);
 printf("+-------------+----------------+\n");
 fflush(stdout);
}

int main(void) {

 // Setup
 init();
 print_heap();

 int choice;

 while (1) {
 print_menu();
 int rval = scanf("%d", &choice);
 if (rval == EOF){
 exit(0);
 }
 if (rval != 1) {
 //printf("Invalid input. Please enter a valid choice.\n");
 //fflush(stdout);
 // Clear input buffer
 //while (getchar() != '\n');
 //continue;
 exit(0);
 }

 switch (choice) {
 case 1:
 // print heap
 print_heap();
 break;
 case 2:
 write_buffer();
 break;
 case 3:
 // print safe_var
 printf("\n\nTake a look at my variable: safe_var = %s\n\n",
 safe_var);
 fflush(stdout);
 break;
 case 4:
 // Check for win condition
 check_win();
 break;
 case 5:
 // exit
 return 0;
 default:
 printf("Invalid choice\n");
 fflush(stdout);
 }
 }
}

Binary Search

Mon, 04 May 2026 01:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/442

題目解法

使用 ssh 連線進去，不斷猜範圍內的鄭中間一定可以在 10 次內猜到。

webshell:~$ ssh -p 58451 ctf-player@atlas.picoctf.net
The authenticity of host '[atlas.picoctf.net]:58451 ([18.217.83.136]:58451)' can't be established.
ED25519 key fingerprint is SHA256:M8hXanE8l/Yzfs8iuxNsuFL4vCzCKEIlM/3hpO13tfQ.
This host key is known by the following other names/addresses:
~/.ssh/known_hosts:3: [hashed name]
~/.ssh/known_hosts:5: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[atlas.picoctf.net]:58451' (ED25519) to the list of known hosts.
ctf-player@atlas.picoctf.net's password:
Welcome to the Binary Search Game!
I'm thinking of a number between 1 and 1000.
Enter your guess: 500
Lower! Try again.
Enter your guess: 250
Higher! Try again.
Enter your guess: 375
Higher! Try again.
Enter your guess: 438
Higher! Try again.
Enter your guess: 469
Higher! Try again.
Enter your guess: 485
Higher! Try again.
Enter your guess: 493
Higher! Try again.
Enter your guess: 497
Higher! Try again.
Enter your guess: 499
Congratulations! You guessed the correct number: 499
Here's your flag: picoCTF{g00-------------07f}
Connection to atlas.picoctf.net closed.

Scan Surprise

Mon, 04 May 2026 01:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/444

題目解法

下載並解壓縮後得到一張 QR code，掃描即可得到 flag。可以拿手機掃描，或是線上掃描工具也可以。

picoCTF{p33-------------77c}

Verify

Mon, 04 May 2026 01:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/450

題目解法

根據題目敘述可以得知要從 file 中找到使用 sha256 雜湊之後指定值的檔案。

使用 ssh 連線進去後，使用 sha256sum 指令來查看檔案經過 sha256 雜湊之後的值，加上 grep 指令可以過濾指定的內容。

ctf-player@pico-chall$ sha256sum files/* | grep "fba9f49bf22aa7188a155768ab0dfdc1f9b86c47976cd0f7c9003af2e20598f7"
fba9f49bf22aa7188a155768ab0dfdc1f9b86c47976cd0f7c9003af2e20598f7 files/87590c24

使用 ./decrypt.sh 腳本加上找到的檔案即可得到 flag。

ctf-player@pico-chall$ ./decrypt.sh files/87590c24
picoCTF{tru-------------------c24}

interencdec

Sun, 03 May 2026 01:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/418

題目解法

下載檔案後得到一個字串，字串的組成以及結尾的 == 極可能是 base64 編碼。
```
YidkM0JxZGtwQlRYdHFhR3g2YUhsZmF6TnFlVGwzWVROclgyMHdNakV5TnpVNGZRPT0nCg==
```

解碼後得到以下字串

b'd3BqdkpBTXtqaGx6aHlfazNqeTl3YTNrX20wMjEyNzU4fQ=='

將單引號中的內容再次使用 base64 解碼後得到
```
wpjvJAM{jhlzhy_k3jy9wa3k_m0212758}
```
使用凱撒加密偏移量 19 進行解密即可得到 flag。
```
picoCTF{cae-------------------758}
```

WebDecode

Sun, 03 May 2026 00:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/427

題目解法

前往網站後，發現 about 頁面寫著 “Try inspecting the page!! You might find it there”，使用 Ctrl + U 查看頁面原始碼。
原始碼頁面中有其中一行很可疑，使用 base64 解碼即可得到 flag。

<section class="about" notify_true="cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRfMDdiOTFjNzl9">

picoCTF{web---------------------------c79}

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a

字母	Hex	字母	Hex
a	61	n	6E
b	62	o	6F
c	63	p	70
d	64	q	71
e	65	r	72
f	66	s	73
g	67	t	74
h	68	u	75
i	69	v	76
j	6A	w	77
k	6B	x	78
l	6C	y	79
m	6D	z	7a