OmniCTF 2026 Quals Game Writeup: 2 Challenges Solved
OmniCTF 2026 Quals shipped a game track built entirely around Minecraft, but with two challenges from very different sides of the platform. permissiondenied (medium, 78 points, 93 solves) is a live Paper 1.21.11 server whose custom permission plugin exposes a /demote <index> command; the plugin correctly rejects positive indices above the caller’s rank but computes new_index = current_index - supplied_index on the negative path, so /demote -4 from the default rank at index 3 lands at Admin at index 7. Shibiu (medium, 77 points, 94 solves) is a Minecraft Java world derived from the public “Shibuya (sort of…)” map by Noshiaga/Noshychan; a differential analysis against the original world (filtering volatile NBT fields and correctly decoding the Java Edition block-state palette bit packing) surfaces a strip of dirt → redstone_block edits at y=-62 forming a 5x7 pixel-font banner that spells the flag. ...