Write-ups

RedTrails

Analyzing a multi-stage attack through Redis exploitation, reverse shell deployment and AES-256-CBC decryption.

Rebuilding

Snakecode

Extracting layered Python bytecode obfuscation through base64 decoding, zlib decompression, and marshal deserialization.

Rebuilding

Reversing an ELF binary to recover a hidden XOR-encrypted password.

Find The Easy Pass

Using Wine and GDB to dynamically recover the password from a Windows executable.

UTCN Cyber Security Seminars

2026 UTCN Google Cyber Security Seminars competition challenges write-ups

MBCoin

Analysis of a malicious Word document and PCAP revealing a multi-stage VBA, PowerShell, and XOR-decrypted DLL attack chain.

Silentium

Exploiting Flowise and Gogs vulnerabilities.

Sp00ky Theme

Analyzing a malicious KDE Plasma theme that hides a backdoor inside a widget.

shigehira

HTTP traffic analysis to extract malware downloads, user agents, and network indicators of compromise.

bdlp

A simple discrete logarithm challenge with a weak 16-bit prime

timeout

A Python regex challenge involving ReDoS and a signal-based timeout leak

social-god

An OSINT investigation that follows a chain of social media clues.

social-scraper

Following a trail of social media accounts.

sky-moose

XWorm malware communicating with berlin101.com C2 server.

roblox

Packet analysis of a Roblox cheat, social media domains, and a malicious .rar payload.

ret2win

A classic ret2win challenge involving a buffer overflow

aero sponge

Identifying an aircraft flying over an unlikely location by leveraging image metadata and historical flight tracking data.

webd-art

Reverse engineering a Dart-compiled WebAssembly module to recover the secret output without brute force.

Unholy Land

Mining a Suricata eve.json log with jq to recover protocol counts, totals, and the most common DNS hosts.

ufo-sightings

Geolocating a roadside UFO advertisement with Google Lens, then mapping the coordinates for the answer.

toxicwaste

Breaking a KZG-style commitment setup by reconstructing the shuffled powers of alpha and forging valid proofs.

svfgp

A timing side-channel against an admin-bot workflow that stores the flag in localStorage.

substrate

A Windows driver challenge solved by emulating the IOCTL handler and reconstructing the required 69-byte input.

Riga Crypto

Reverse engineering a native Node.js library to recover a custom transform and decrypt a file-encrypted flag.

Relay in the Noise

Decoding a noisy PCAP by stripping KISS framing, recovering APRS bulletins, and decrypting the final payload.

RAM Vault Beacon Malware

Memory forensics on a Linux dump to recover malware parameters, reconstruct the crypto flow, and decrypt the vault.

nday-1

An Apache Airflow example DAG turns a JSON field into shell command injection, yielding direct flag execution.

minegamble

A race condition is used to buy the privileged role, then XSS is used to steal the admin cookie through a webhook redirect.

jumpy

A stripped ELF that rewrites an encrypted file through a custom transform and hidden debug path.

Icarus

Bypassing a Python bytecode sandbox by abusing LOAD_FAST and leaking the exception output.

demolition

A filter bypass that turns a Unicode-normalized tag into a working script injection against the admin bot.

Control

A Windows event investigation that reconstructs persistence, execution, privilege escalation, and the final credential-theft chain.

Atypical Heap

Bypassing musl allocator security by corrupting internal heap structures to redirect execution flow to system().

Atypical Heap Revenge

Abusing an arbitrary 8-byte write and an out-of-bounds read to corrupt musl allocator metadata and hijack atexit handlers for code execut...