OmniCTF 2026 Quals Misc + Forensics Writeup: 5 Solved
OmniCTF 2026 Quals shipped a misc track that runs the full skill spectrum, plus a rich forensics challenge that pairs naturally with it: baccarat (game theory / Kelly criterion + reconnect loop), Node (Node-RED unauth RCE chained to a SUID DT_RUNPATH shared-library hijack for root), nostalgia (nested container parsing from Scratch .sb3 to a RISC-V Linux kernel to a newc cpio to a text file), Sanity P0zzl3 (computer vision + constraint programming: 100 transparent PNG jigsaw pieces of a shuffled QR code solved as a 10x10 assignment problem, then morphological repair to decode), and QuackQuackDiriDiriDuck (forensics: a 2023-05-24 Qakbot/OBAMA264 infection PCAP with 10 sub-question flags reconstructed from tshark HTTP object export, JA3/JA4 no-SNI fingerprints identifying the four TLS C2 endpoints, and UTC timestamp reconciliation against Brad Duncan’s malware-traffic-analysis.net ground-truth notes). What ties them together is a single discipline: the handout is the oracle. baccarat’s game.py simulates its own agents. Node’s /entrypoint.sh names the misconfiguration. nostalgia’s .sb3 is a ZIP. Sanity P0zzl3’s PNG alpha channels give piece geometry cleanly. QuackQuackDiriDiriDuck’s PCAP filename literally names the malware-traffic-analysis.net corpus entry to cross-reference. Every challenge hands you enough to reconstruct the exploit from first principles. ...