Bdsec Ctf 2026

BDSec CTF 2026 Web Writeup: 2 Challenges Solved

BDSec CTF 2026’s web track shipped two challenges that sit at opposite ends of the difficulty scale but share the same root failure: the server trusts a client-controlled field to govern a security decision. Admin Portal (50 pts) trusts the alg field inside the client-supplied JWT header to decide which signature algorithm to enforce — the client says alg: none, the server skips signature verification entirely, and a payload with role=admin walks through the front door. Ticketly (425 pts) trusts a client-controlled ticket body after applying a blacklist sanitiser — the sanitiser blocks <script>, <iframe>, <img>, javascript:, and onload, but allows SVG SMIL animation elements including the onbegin event attribute, which executes JavaScript automatically in any browser that renders the page. An admin bot opens the reported ticket, the animation fires, and document.cookie (which holds the flag) is exfiltrated to a webhook in chunked POST bodies. ...

BDSec CTF 2026 pwn writeup — two challenges solved covering Phantom Device a stripped x86-64 ELF menu-driven driver simulator whose duplicate-handle operation copies the descriptor without incrementing the object refcount so releasing one descriptor frees the chunk while the duplicate remains a valid read-write handle giving a use-after-free primitive that after a seven-device tcache-fill grooming sequence overlaps the freed device chunk with a newly-created session then leaks uid and nonce recovers the per-process cookie from checksum1 = rol64(uid ^ cookie, 17) ^ nonce ^ 0xa55aa55aa55aa55a and patches the session role to 0x1337133713371337 with the corrected checksum2, and Muktir Shongket a stripped x86-64 ELF that both verifies and JIT-translates a custom five-opcode bytecode (WAIT SIGNAL ROUTE END FREEDOM) where the verifier walks ROUTE targets only for in-bounds checks while the executor lowers ROUTE to an x86 jmp rel32 allowing a 12-byte hex payload 300220b8b01b4000ffd0c340 to jump into the 8-byte literal of a following SIGNAL order whose bytes decode to mov eax 0x401bb0 call rax ret invoking the internal flag-printing function of the non-PIE binary

BDSec CTF 2026 Pwn Writeup: 2 Challenges Solved

BDSec CTF 2026’s pwn track shipped two 100-point challenges that both hinge on the same class of bug — two components of the same program disagree about the meaning of one operation — but at completely different levels of the stack. Phantom Device is a menu-driven device-driver simulator where the duplicate handle operation copies the descriptor but does not update the object refcount, so release and duplicate disagree about how many live pointers exist. That mismatch drops a stale device handle over a session-object allocation and gives a read/write primitive that leaks the process cookie and forges the privileged role. Muktir Shongket is a custom-bytecode terminal where the verifier and the executor disagree about what a ROUTE order does: the verifier walks past it as metadata, the executor translates it into an x86 jmp rel32. That jump lands inside a later SIGNAL literal, whose bytes were never inspected as instructions, and calls the internal flag.txt printer at a fixed address in the non-PIE binary. ...

BDSec CTF 2026 reverse writeup — three challenges solved covering Easy RE Challenge an unstripped x86-64 ELF with four length-gated input paths where only the 41-byte BDSEC branch is real and its per-byte transform stacks a two-key XOR a rotate-left by (i mod 7)+1 an additive term (11i)^0x23 and a 13i mod 41 output permutation all trivially inverted from the embedded expected buffer, Night Shift a stripped x86-64 ELF that spawns five pthread workers dispatched by the user's eight-token shift code where a 5^8 brute-force over the shared 128-bit state hash accumulator plus round counter finds the unique schedule 2 0 4 1 3 0 2 4 that unlocks the .rodata table decryption printer, and Borrowed Memory a stripped x86-64 PIE that generates a 0x800-byte xorshift-seeded memory table patches specific offsets to encode a 12-step VM opcode tape where each user offset input decodes an opcode and derives the next offset through a checksum-gated transition producing the final 40-byte .rodata blob decryption via a four-source XOR loop combining encrypted bytes validator outputs state words and user inputs

BDSec CTF 2026 Reverse Writeup: 3 Challenges Solved

BDSec CTF 2026 shipped a three-challenge reverse-engineering track that runs the classic escalator: Easy RE Challenge (80 pts) is an unstripped ELF with four input paths, three of them decoys with convincing AFLAG/BFLAG/CFLAG{...} returns, and one real 41-byte BDSEC{...} branch guarded by a per-byte XOR + rotate-left + additive-term + output-permutation transform that inverts cleanly from the embedded expected buffer. Night Shift (100 pts) is a stripped ELF that spawns five pthread workers and dispatches them from the user’s eight-token “shift code”; only 5^8 = 390 625 orderings exist, and exactly one matches the four 32-bit state targets plus the FNV-shaped hash accumulator, unlocking a .rodata printer that emits the flag byte by byte. Borrowed Memory (460 pts) is a stripped PIE that generates a 0x800-byte xorshift-seeded memory table, patches specific offsets to encode a 12-step VM opcode tape, and asks the user for twelve 16-bit offsets that walk that tape with checksum-gated transitions — after the twelfth step drops off the end of the table (next-offset = 0xFFFF), a four-source XOR loop decrypts a 40-byte .rodata blob into the real flag. ...