DalCTF 2026 writeup — 9 challenges solved across Crypto, Reverse, Web, and Android

DalCTF 2026 Writeup: All 9 Challenges Solved

Platform DalCTF 2026 (dalctf2026.com) Difficulty Mixed (Easy → Medium) OS Jeopardy — Crypto, Reverse Engineering, Web, Android Tags RSA modulus with small prime factor recovered by trial division, Bellcore CRT fault attack as the verification path, Playfair decryption against an un-keyed alphabet square, Huffman tree decode with inverted tiebreaker convention, LCG state recovery from one known plaintext byte, IEEE-754 bit-pattern reinterpretation via Quake-style float pointer cast, UPX-packed ELF unpacked into 44 per-byte check functions, Android APK static-string mining across MainActivity + strings.xml + ColorKt, HTML hidden attribute as a flag-hiding sink DalCTF 2026 is the DalCTF Jeopardy event with challenges spread across Crypto, Reverse Engineering, Web, and Android. The 2026 edition leans heavily into classical cryptography mistakes wrapped in misdirection — six of the nine challenges are crypto, and almost every one of them tries to push you toward a harder attack than the one that actually works. The flag format is dalctf{...} (occasionally DalCTF{...}), and the challenge names are explicit hints once you’ve solved them. ...

June 8, 2026 · 22 min · 4613 words · CyberSecurity Elite Team
GPN CTF 2026 Justfollowtherecipe writeup — gcc -O3 -mavx2 lane swap and Kannan-embedding BKZ-58 SIS lattice attack

GPN CTF 2026 — Justfollowtherecipe: AVX2 Miscompile + SIS Lattice

Platform GPN CTF 2026 (kitctf) Difficulty Hard OS Crypto — SIS hash, Kannan embedding, BKZ lattice reduction Tags reading AVX2 disassembly to identify vpermd lane interchange, repairing the per-batch lane swap in oracle output, building a q-ary kernel lattice with Kannan embedding, fpylll BKZ-58 with default.json preprocessing+pruning strategies, fpylll heartbeat to keep the SSL proxy alive Justfollowtherecipe is the GPN CTF 2026 challenge that asks a textbook SIS (Short Integer Solution) hash recovery question — except the Linux binary’s mat_mul is miscompiled. gcc -O3 -funroll-loops -mavx2 swaps AVX2 lanes 1 and 2 in every 4-wide block of the inner-product loop, so every column of the public matrix the oracle hands back is permuted. Repair the swap, run a Kannan embedding against the q-ary kernel lattice, finish with BKZ-58 under fplll’s default.json strategies in 45 seconds. The flag — GPNCTF{coMP1L3rS_aRe_Y0UR_fr1End_7HEY_w0ULd_never} — names the lesson. ...

June 7, 2026 · 10 min · 1923 words · CyberSecurity Elite Team
Educational content for authorized testing only. · Disclaimer · Editorial Policy · Sitemap