Omnictf 2026

OmniCTF 2026 Quals Misc Writeup: 4 Challenges Solved

OmniCTF 2026 Quals shipped a misc track that runs the full skill spectrum: baccarat (game theory / Kelly criterion + reconnect loop), Node (Node-RED unauth RCE chained to a SUID DT_RUNPATH shared-library hijack for root), nostalgia (nested container parsing from Scratch .sb3 to a RISC-V Linux kernel to a newc cpio to a text file), and Sanity P0zzl3 (computer vision + constraint programming: 100 transparent PNG jigsaw pieces of a shuffled QR code solved as a 10x10 assignment problem, then morphological repair to decode). What ties them together is a single discipline: the handout is the oracle. baccarat’s game.py simulates its own agents. Node’s /entrypoint.sh names the misconfiguration. nostalgia’s .sb3 is a ZIP. Sanity P0zzl3’s PNG alpha channels give piece geometry cleanly. Every challenge hands you enough to reconstruct the exploit from first principles. ...

OmniCTF 2026 Quals game writeup — two Minecraft challenges solved covering permissiondenied where a custom Paper server plugin's /demote command guards positive indices against promotion but computes new_index = current_index - supplied_index for negative input so /demote -4 from Default at index 3 lands at Admin at index 7 and unlocks /flag, and Shibiu where the handout is a Minecraft Java world derived from the public Shibuya sort of map by Noshiaga/Noshychan and a differential analysis against the original world filtering volatile NBT fields and decoding block-state palettes with the Java Edition no-cross-64-bit-boundary bit packing surfaces a strip of dirt-to-redstone edits at y=-62 forming a 5x7 pixel-font banner

OmniCTF 2026 Quals Game Writeup: 2 Challenges Solved

OmniCTF 2026 Quals shipped a game track built entirely around Minecraft, but with two challenges from very different sides of the platform. permissiondenied (medium, 78 points, 93 solves) is a live Paper 1.21.11 server whose custom permission plugin exposes a /demote <index> command; the plugin correctly rejects positive indices above the caller’s rank but computes new_index = current_index - supplied_index on the negative path, so /demote -4 from the default rank at index 3 lands at Admin at index 7. Shibiu (medium, 77 points, 94 solves) is a Minecraft Java world derived from the public “Shibuya (sort of…)” map by Noshiaga/Noshychan; a differential analysis against the original world (filtering volatile NBT fields and correctly decoding the Java Edition block-state palette bit packing) surfaces a strip of dirt → redstone_block edits at y=-62 forming a 5x7 pixel-font banner that spells the flag. ...

OmniCTF 2026 Quals crypto writeup — three challenges solved covering dual_linera two-modulus LWE where the same small e is used across both moduli so CRT collapse to a single equation Y equals A s plus e mod q1 q2 followed by LLL on a 20-dimensional lattice recovers the 96-bit secret, Whiskerfield-Meowtin CuteSecure DH whose modulus is 65537 raised to the 16th power and whose public value is hand-crafted as one byte flip away from a multiple of 65537 so a single-byte patch drives the shared secret to zero and the flag decrypts under a glibc-rand LCG stream cipher, and Orbital-Strike-Cannon octonion state with a broken LCG whose output stream is published and 7 satellites 5 real 2 fake where non-associative Cayley-Dickson multiplication collapses to 8x8 matrix multiplication once association order is fixed leaving 9 unknowns against 75 linear equations per real satellite solved by per-satellite RREF

OmniCTF 2026 Quals Crypto Writeup: 3 Challenges Solved

OmniCTF 2026 Quals shipped a crypto track built around one recurring lesson: the algebra is scarier than the actual attack surface. Three challenges, all rated medium, and every one dresses a mundane linear-algebra collapse in a costume the reader is expected to spend hours investigating. dual_linera uses two-modulus LWE where the error e is shared across both moduli. CRT is a linear map, so e survives the reconstruction and 18 samples plus LLL on a 20x20 lattice recover the 96-bit secret. Whiskerfield-Meowtin offers a “CuteSecure-DH” whose modulus is 65537^16 (Fermat prime to the 16th power) and whose public value is hand-crafted as one byte-flip away from a multiple of 65537. Patch the byte, drive the shared secret to zero, decrypt under the LCG stream cipher. Orbital-Strike-Cannon wraps a 9-unknown affine state in non-associative octonion multiplication, a published-stream “broken RNG”, and 7 satellites (5 real, 2 fake), but once you fix the association order it becomes 8x8 matrix multiplication, and once you write the samples as linear equations a per-satellite RREF sorts real from fake without needing the private real_ids. ...

OmniCTF 2026 Quals reverse writeup — four challenges solved covering CredVault Parcel migration mismatch where the forwarding validator only checks a legacy dword the strict validator's checksum can't authenticate, Gatekeep FPGA-style combinational byte circuit solved as a constraint satisfaction problem, Kant stripped Rust binary whose check pipeline stacks XOR, AES-style S-boxes, MixColumns, power maps mod 257, two 16-round Feistel transforms, byte permutations and a bit permutation all inverted from the embedded compare target, and Pusher 32-bit i386 signal-driven VM with SIGSEGV/SIGILL as branch instructions and a scanf %d vs %c input-format trap solved by 50 laps of the slot state machine to build the target string byte by byte

OmniCTF 2026 Quals Reverse Writeup: 4 Challenges Solved

OmniCTF 2026 Quals shipped a reverse-engineering track that runs the full spectrum from beginner constraint-solving to a signal-driven VM that uses SIGSEGV and SIGILL as branch instructions. Four challenges: CredVault (medium, 85 solves) is a Parcel-format migration mismatch between two validators over a binary TCP protocol; Gatekeep (medium, 62 solves) is a PNG-only FPGA schematic solved as a byte-level constraint satisfaction problem; Kant (medium, 92 solves) is a stripped Rust binary whose hidden check <hex> mode stacks XOR / S-boxes / MixColumns / power-maps mod 257 / two 16-round Feistels / byte and bit permutations, all reversible from the embedded compare target; Pusher (hard, 500 points, 0 solves at release) is a 32-bit i386 ELF whose control flow is smuggled through installed signal handlers and whose %d vs %c format-string trap costs an entire remote instance to figure out from the wrong side. ...

OmniCTF 2026 Quals pwn writeup — two challenges solved covering nullshui glibc 2.39 heap exploitation via a heap-relative zero-write primitive that unlocks tcache poisoning over _IO_2_1_stdout_ with a fake wide-file vtable calling setcontext to pivot to a heap ROP open/read/write chain, and WinCapture Windows kernel-driver TOCTOU race between two reads of slot_lengths inside the COPY IOCTL exploited via named-pipe partial sends to interleave a LOAD that flips 8 bytes into a 4 KB overflow into an adjacent key object

OmniCTF 2026 Quals Pwn Writeup: 2 Challenges Solved

OmniCTF 2026 Quals shipped a pwn track with two challenges from very different worlds. nullshui (hard, 500 points, 0 solves at release) is glibc 2.39 heap exploitation on Ubuntu 24.04 with every modern mitigation turned on (Full RELRO, canary, NX, PIE, SHSTK, IBT). WinCapture (medium, 111 points, 39 solves) is a Windows kernel-driver TOCTOU race exposed through a named pipe. What they share is a design shape worth noticing: neither one lets you spawn a shell (Ubuntu 24.04 hardening on one side, kernel-mode context on the other both make direct shellcode impractical), neither relies on a stack smash, and the winning primitive in both is a narrow write into carefully-shaped adjacent state that a defender would look at and say “too small to exploit in practice.” ...

OmniCTF 2026 Quals web writeup — two challenges solved covering Ganzir server-side template injection via a Jinja2 read_file helper reached through a debug field that leaked the one-time password-reset token for the plot-hinted Cassie account, and StayWild GNU tar --checkpoint-action option injection through upload filenames on a beta endpoint whose frontend disable was not paired with a backend check

OmniCTF 2026 Quals Web Writeup: 2 Challenges Solved

OmniCTF 2026 Quals shipped a web track built around two recurring lessons: the “debug” field that made it to production, and the disabled-beta button that isn’t actually disabled server-side. Both challenges also come with a loud misdirection designed to burn most of the CTF window (Ganzir advertises HTTP request smuggling via response headers around /employee; StayWild dangles a client-side innerHTML sink at the visitor-notes widget). The intended chains are mundane by comparison, which is the point: trained triage means checking the boring-looking helper before chasing the noisy channel. ...