OmniCTF 2026 Quals Misc Writeup: 4 Challenges Solved
OmniCTF 2026 Quals shipped a misc track that runs the full skill spectrum: baccarat (game theory / Kelly criterion + reconnect loop), Node (Node-RED unauth RCE chained to a SUID DT_RUNPATH shared-library hijack for root), nostalgia (nested container parsing from Scratch .sb3 to a RISC-V Linux kernel to a newc cpio to a text file), and Sanity P0zzl3 (computer vision + constraint programming: 100 transparent PNG jigsaw pieces of a shuffled QR code solved as a 10x10 assignment problem, then morphological repair to decode). What ties them together is a single discipline: the handout is the oracle. baccarat’s game.py simulates its own agents. Node’s /entrypoint.sh names the misconfiguration. nostalgia’s .sb3 is a ZIP. Sanity P0zzl3’s PNG alpha channels give piece geometry cleanly. Every challenge hands you enough to reconstruct the exploit from first principles. ...