picoCTF gamifies learning hacking with capture-the-flag puzzles created by trusted computer security and privacy experts at Carnegie Mellon University (picoCTF - CMU Cybersecurity Competition, n.d.).
The challenges are categorised into 6 categories: Web Exploitation, Cryptography, Reverse Engineering, Forensics, General Skills and Binary Exploitation. Every picoCTF writeup on this site is searchable and filterable below.
Showing 106 of 106 writeups
This is a straightforward(but tedious) one time pad challenge. The downloaded file, table.txt looks like this: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z +---------------------------------------------------- A | A B C D E F G H I J K L M N O P Q R S T U V W X Y Z B | B C D E F G H I J K L M N O P Q R S T U V W X Y Z A C | C D E F G H I J K L M N O P Q R S T U V W X Y Z A B D | D E F G H I J K L M N O P Q R S T U V W X Y Z A B C E | E F G H I J K L M N O P Q R S T U V W X Y Z A B C D F | F G H I J K L M N O P Q R S T U V W X Y Z A B C D E G | G H I J K L M N O P Q R S T U V W X Y Z A B C D E F H | H I J K L M N O P Q R S T U V W X Y Z A B C D E F G I | I J K L M N O P Q R S T U V W X Y Z A B C D E F G H J | J K L M N O P Q R S T U V W X Y Z A B C D E F G H I K | K L M N O P Q R S T U V W X Y Z A B C D E F G H I J L | L M N O P Q R S T U V W X Y Z A B C D E F G H I J K M | M N O P Q R S T U V W X Y Z A B C D E F G H I J K L N | N O P Q R S T U V W X Y Z A B C D E F G H I J K L M O | O P Q R S T U V W X Y Z A B C D E F G H I J K L M N P | P Q R S T U V W X Y Z A B C D E F G H I J K L M N O Q | Q R S T U V W X Y Z A B C D E F G H I J K L M N O P R | R S T U V W X Y Z A B C D E F G H I J K L M N O P Q S | S T U V W X Y Z A B C D E F G H I J K L M N O P Q R T | T U V W X Y Z A B C D E F G H I J K L M N O P Q R S U | U V W X Y Z A B C D E F G H I J K L M N O P Q R S T V | V W X Y Z A B C D E F G H I J K L M N O P Q R S T U W | W X Y Z A B C D E F G H I J K L M N O P Q R S T U V X | X Y Z A B C D E F G H I J K L M N O P Q R S T U V W Y | Y Z A B C D E F G H I J K L M N O P Q R S T U V W X Z | Z A B C D E F G H I J K L M N O P Q R S T U V W X Y With the encrypted flag UFJKXQZQUNB and the key SOLVECRYPTO, we have all we need to decrypt the flag.
The challenge description implies that we will probably have to extract the contents of the provided tar file repeatedly until we finally find a flag ...
From the description and hint provided, we can infer that this challenge will likely use a variety of decoding processes. We shall begin by downloading the file using wget <link>.
As the challenge name and hint suggest, the flag is probably encrypted using a caesar cipher. We first download the file using wget to see how the encrypted flag looks like to understand how we should obtain the flag.
After downloading the file, we realise that it is a pcap file, as the challenge name already suggests. Using strings Acquiring the flag using strings We can run strings <file-name> | grep pico to get the flag immediately.
We shall start off by following the instructions. I ran wget <link> to download the file. I also opened the file in GUI, but as the challenge name suggests, this is a Steganography challenge, so there was no useful information there.
We are provided with a flag.zip file and a dump.pcap file. The flag.zip file is password protected, as displayed below. PicoCTF Hint: Download the pcap and look for the password or flag.
The hideme challenge name already suggests that the flag is hidden from plain sight. We shall try to explore. Trying binwalk Running binwalk reveals that there are embedded files that we need to take note of.
For this challenge, not much clue was given in the description. However, a hint was provided. PicoCTF Hint: All we know is that this packet capture includes a chat conversation and a file transfer.
As the challenge description suggests, we must be equipped with basic knowledge of different data encodings in order to solve this challenge ...
The challenge description basically told us exactly what we have to do to get the flag. We can just follow the instructions. The main challenge is to come up with the SSH command to connect to their server.
This challenge requires us to first connect to their SSH server as picoplayer on port 59574. We can do this by running ssh -p 59574 picoplayer@saturn.picoctf.net.
In this challenge, we will attempt to decode the contents of the given file that has been encrypted with a Python script. We first begin by downloading the 2 files, enc_flag and custom_encryption.py, by running wget <link1> <link2>.
Based on the description, we will be dealing with certificate requests in this challenge. Before starting this challenge, I actually had little knowledge about certificate requests.
Welcome to another challenge about endianness. I have done a challenge related to Big-Endian and Little-Endian systems before, which you can check out here: endianness Without further ado, let’s dive into this challenge.
Honestly, I did not have much knowledge about endianness and what exactly is Big-Endian and Little-Endian before this challenge.
Honestly, I have put off this challenge for the longest time because I feared that I wouldn’t be able to solve it since I had no prior experience with apk files ...
Another forensics challenge! As usual, we first download the suspicious file. File type We notice that the file is supposedly a pdf file.
This is the final challenge of the “PW Crack” challenge series. What a journey it has been! In this challenge, we will be cracking a password using a dictionary attack, which is a brute-force approach.
This challenge approach is really similar to that of the PW Crack 1 challenge. We just have to input the correct password and we get our flag.
Currently, all we know is that we are provided with a password checker file and an encrypted flag file which we can download with wget <link> ...
Another challenge in the “PW Crack” series! Check out the previous 2 challenges in this series too: PW Crack 1 PW Crack 2 We first download the 3 challenge files ...
The 4th addition to the “PW Crack” challenge series! How exciting! Check out the previous challenges if you’re interested: PW Crack 1 PW Crack 2 PW Crack 3 Downloaded ...
As usual, we begin by downloading the file using wget <link>. For this challenge, the downloaded file is a zip file, so I proceeded to unzip it.
When I saw the challenge name, my first instinct was that I’ll be required to use pipe (“|”) for this challenge. Of course, it will be pointless guessing without more clues.
This is a challenge involving a Python script. We will likely have to manipulate the script to display the flag in this challenge.
We are given a string of hexadecimal values, where each value corresponds to an ASCII character. PicoCTF Hint: CyberChef is a great tool for any encoding but especially ASCII.
This challenge is similar to previous warmup challenges(Warmed Up and 2Warm). For this challenge, we only have to convert hexadecimal(0x70) to decimal, then to an ASCII character.
This is an easy challenge where we are tasked to convert 0x3D (hexadecimal representation) to base10 (decimal representation). This can be done in many ways, such as using an online conversion tool or writing a script.
This challenge is a very basic challenge where we just have to connect to jupiter.challenges.picoctf.org at port 25103 to get the flag, by running nc jupiter.challenges.picoctf.org ...
For this challenge, we will be tasked to move between directories after we SSH into a server, according to clues we pick up along the way ...
Let’s first download the 2 files provided using wget <link1> <link2>. With reference to the challenge description, we are supposed to follow instructions given and run the script code.py in the same directory as the codebook.txt file.
Alright, our task is to convert a number from decimal to binary, pretty simple! There are many ways to do this. First, we download the Python script convertme.py (using wget), and ran nano immediately to examine the code.
Another challenge about version control using Git. This time, the description suggests that it’s about commits made by someone. To begin, download the file using wget and unzip it.
From the challenge description, it is hinted that the “team” is facing some version control difficulties, possibly with Git. Other than this, we are not provided with any more clues.
Yep, as the challenge description suggests, we just need to pipe the contents of the downloaded file through grep with the search term “pico” or “picoCTF” to ...
In this challenge, we are tasked to fix a single syntax error in the provided Python script. This challenge is highly similar to fixme1.py.
Alright, it looks like we just have to fix 1 simple syntax error to allow the flag to be printed successfully. Let’s download the challenge file using wget <link> and check for the syntax error.
We begin by connecting to the server by running nc titan.picoctf.net 61359. Binary operations We are greeted with a barrage of questions related to binary operations.
The challenge description instructs us to convert the number 42 to binary. We can use any online base 10 to base 2 conversion tool to do this.
I don’t think much elaboration is required for this challenge. The challenge name and the description gave it away, just download the challenge file using wget <link> and run cat to display the flag in the terminal.
I’ll begin by running the command given in the description to understand how I can proceed. After connecting to the server, I was greeted with an overwhelming number of numbers, as shown below.
This challenge is similar to strings it and Wave a flag. After downloading the files using wget, I ran file static to check the file type of this file.
We first download the 3 challenge files, ende.py, pw.txt and flag.txt.en by running wget. I also tried to display the contents of pw.txt and flag.txt.en.
Well, the description gave us a very useful clue. We’ll have to use strings for this challenge. strings command strings prints the strings of printable characters in files.
This challenge is basically identical to a previous challenge I’ve completed (strings it). We first download the challenge file using wget <link>, check the file type using file <file-name> (optional), and display printable characters in the file using strings <file-name>.
Aha, a challenge dealing with bases! We have this string, with no other clue about how it has been encoded: bDNhcm5fdGgzX3IwcDM1 For my past CTF challenges, ...
The description tells us that we are recommended to use tabcomplete in this challenge while finding the flag. What is tabcomplete? Tabcomplete basically helps you finish words or commands while typing by pressing the Tab key in the terminal.
Hmm… the challenge name and description is quite vague. Let’s run the command given when I launched an instance to understand what exactly is going on.
Alright, seems like we are given instructions on how we can solve this challenge. We shall check it out. Acquiring the Flag First, we download the python script using wget <link>.
From the challenge description and name, we can tell that the challenge’s about cryptographic hash functions. But we don’t know which.
In this challenge, we will be playing with Git and Git commands. There’s a word play on Git commits in the challenge name. The hints given also hinted that this challenge is associated with version control, specifically using Git.
Hmmm… the challenge name “repetitions” implies that we will be doing something repeatedly. PicoCTF Hint: Multiple decoding is always good.
Well, from the description, it seems like we can first download the given zip file using wget <link>, unzip the file, and then find the full path to the ...
Hmmmm… the challenge description hints that we will be following a Forensics approach. However, this challenge is categorised under General Skills.
As the name suggests, this challenge will be about binary search. What is binary search? From the GeeksforGeeks Binary Search Algorithm page, the Binary Search Algorithm is a searching algorithm used in a sorted array by repeatedly dividing the search interval in half.
This is an interesting challenge, as we are trying to crack the WPA password of a wireless network, by using a common password list rockyou.txt ...
We shall start our journey by downloading the file using wget <link>. The downloaded file is a .pcap file. Hence we will continue by using Wireshark.
We shall begin by using wget <link> to download the file provided. Running file flag.txt shows that flag.txt is a .png file instead of a .txt file.
We begin our quest for the flag by downloading the file using wget. Running file advanced-potion-making and exiftool advanced-potion-making did not provide us with any clue about the file type of this file.
Aha, a Wireshark challenge. First we download the .pcapng file using wget <link>. Wireshark Wireshark is a network analysis tool.
As the challenge name suggests, we will be dealing with Microsoft PowerPoint files in this challenge. We begin our journey by downloading the .pptm file using wget <link>.
A straightforward challenge. First, we download the file using wget <link>. Trying Strings At first, running strings <file-name> does not seem to reveal any important information.
From the description, it looks like we will have to download the disk image and retrieve an ssh key to connect to an ssh server afterwards, in order to obtain our ...
We begin by downloading the file using wget. We realise that the file provided is a text file. Based on the description, this text file is likely to be text-heavy.
PicoCTF Hint: Look at the details of the file That may be a clue for us to check the metadata of the file downloaded, we shall see! Metadata of the file Spot on! We ...
This is a straightforward challenge. Following the directions given, we just have to connect to the server via SSH: ssh -p 60821 ctf-player@rhea.picoctf.net SSH There is a files directory after we use the ls command.
This challenge was pretty interesting when I tried it, as I’ve never encountered a “blank” .txt file before. As per normal, we first download the provided file by using wget <link> to understand what we’re dealing with.
Hmmmm… vague description. We first download the file using wget <link> and see what type of file it is. The downloaded file is called tftp.pcapng.
Right off the bat, the description seems interesting. “Hide and seek” implies that the flag may be hidden and may not be easily seen.
Since this challenge provides a compressed disk image, we will probably have to use The Sleuth Kit (TSK) tools to assist us. We first download the file using wget, then run gunzip <file-name> to expand the compressed disk image file.
A straightforward challenge. All we have to do is follow the instructions and connect to the server via SSH, where we will be greeted with a QR Code: QR Code From here, we can just use a QR Code scanner to retrieve the flag.
PicoCTF Hint: What is a hex editor? The hint references a hex editor, but strings is a faster approach here. The flag is not visually embedded in the image.
PicoCTF Hint:What kind of encoding uses dashes and dots? Both the description and the hint imply that the flag we are looking for in this challenge is most likely ...
For this challenge, we are required to decode morse code in an audio format. We begin by downloading the file provided, which is a .wav file.
In this challenge, we will be dealing with RSA certificates. Downloaded certificate The contents of the downloaded certificate is as follows: -----BEGIN CERTIFICATE----- MIIB6zCB1AICMDkwDQYJKoZIhvcNAQECBQAwEjEQMA4GA1UEAxMHUGljb0NURjAe Fw0xOTA3MDgwNzIxMThaFw0xOTA2MjYxNzM0MzhaMGcxEDAOBgNVBAsTB1BpY29D VEYxEDAOBgNVBAoTB1BpY29DVEYxEDAOBgNVBAcTB1BpY29DVEYxEDAOBgNVBAgT B1BpY29DVEYxCzAJBgNVBAYTAlVTMRAwDgYDVQQDEwdQaWNvQ1RGMCIwDQYJKoZI hvcNAQEBBQADEQAwDgIHEaTUUhKxfwIDAQABMA0GCSqGSIb3DQEBAgUAA4IBAQAH al1hMsGeBb3rd/Oq+7uDguueopOvDC864hrpdGubgtjv/hrIsph7FtxM2B4rkkyA eIV708y31HIplCLruxFdspqvfGvLsCynkYfsY70i6I/dOA6l4Qq/NdmkPDx7edqO T/zK4jhnRafebqJucXFH8Ak+G6ASNRWhKfFZJTWj5CoyTMIutLU9lDiTXng3rDU1 BhXg04ei1jvAf0UrtpeOA6jUyeCLaKDFRbrOm35xI79r28yO8ng1UAzTRclvkORt b8LMxw7e+vdIntBGqf7T25PLn/MycGPPvNXyIsTzvvY/MXXJHnAqpI5DlqwzbRHz q16/S1WLvzg4PsElmv1f -----END CERTIFICATE----- Certificate Decoder Since the challenge wants us to break the certificate, I used the CertLogik Certificate Decoder website to gain a better understanding of the certificate.
Looks like an interesting challenge with a seemingly helpful description. Let’s see. We first download the file using wget <link>.
This challenge, as both the name and hint suggest, is all about the Caesar cipher. Encrypted flag We first download the provided file using wget, and running cat on it displays the following string: picoCTF{ynkooejcpdanqxeykjrbdofgkq} This looks like a possible flag that we can submit…right? Nope.
Seems like an interesting challenge. We first download the file and display its contents using wget <link> and cat <file-name> respectively.
We first begin by downloading the file using wget <link>. Contents of the Downloaded file The file provided for this challenge is a .tar file.
As the name suggests, this challenge revolves around the concept of the caesar cipher. The downloaded file, new_caesar.py is used to encrypt the flag, and the encrypted flag is given in the challenge description: mlnklfnknljflfjljnjijjmmjkmljnjhmhjgjnjjjmmkjjmijhmkjhjpmkmkmljkjijnjpmhmjjgjj Script used to encrypt the flag The following is how the encryption script, new_caesar.py looks like.
This is a challenge involving Vigenère cipher. After we run this command nc jupiter.challenges.picoctf.org 58295, we are greeted with a block of text: Encrypted message: Ne iy nytkwpsznyg nth it mtsztcy vjzprj zfzjy rkhpibj nrkitt ltc tnnygy ysee itd tte cxjltk Ifrosr tnj noawde uk siyyzre, yse Bnretèwp Cousex mls hjpn xjtnbjytki xatd eisjd Iz bls lfwskqj azycihzeej yz Brftsk ip Volpnèxj ls oy hay tcimnyarqj dkxnrogpd os 1553 my Mnzvgs Mazytszf Merqlsu ny hox moup Wa inqrg ipl.
This is, once again, a challenge involving substitution ciphers. We begin by downloading the given file and seeing its contents. Contents of the file After downloading the file using wget <link>, we realise that it is a zip file.
This challenge is similar to the previous challenge, basic-mod1, but instead of calculating the modulus of each number, we need to calculate the modular inverse ...
The approach for this challenge was already provided in the description, so we can just follow that. The contents of message.txt After downloading the file using wget, and running cat message.txt, we get this string of numbers: 165 248 94 346 299 73 198 221 313 137 205 87 336 110 186 69 223 213 216 216 177 138 Decrypting the Message Decryption Script I used a python script to decrypt the message above in order to get the flag.
This was an interesting challenge that involves a message encoded using the rail fence cipher. Rail Fence Cipher Essentially, the plaintext is written diagonally in a zig-zag format, according the number of “rails” in the “fence”.
For this challenge, we will basically repeat the same steps we did to retrieve the flag for the substitution0 challenge. First, we download the file using wget, and then run cat to see the message.
For this challenge, we will basically repeat the same steps we did to retrieve the flag for the substitution0 challenge. We first download the file using wget, and then run cat to see the message.
As the description suggests, we will likely have to decode a message which was encrypted using substitution cipher. We first download the file using wget, and then run cat to see the message.
Seems like an interesting challenge. The downloaded file looks like this. The numbers PicoCTF Hint: The flag is in the format PICOCTF{} Now, this is surprising.
This is a transposition cipher challenge. We first download the corrupted message by using wget. Scrambled message After running cat message.txt, we can see a scrambled message.
From the description, it seems like this challenge will be using both Forensics and Cryptography concepts. As usual, we start off by downloading the image using wget <link>.
For this challenge, we only have to download the provided file, check its contents and decode it using a Vigenere cipher decoder, with the key given ...
What is ROT13? ROT13 (“rotate by 13 places”) is a simple letter substitution cipher that replaces each letter with the letter 13 positions after it in the alphabet ...
As the description suggests, this is an RSA cryptography challenge. Contents of values file After downloading the file provided using wget <link>, we can run cat values.
Why "Mod 26"? ROT13 shifts each letter by 13 positions in the alphabet. Since the English alphabet has 26 letters, this shift wraps around modularly (hence “Mod 26”).
This seems like an interesting challenge. The name suggests that we will probably have to recursively extract embedded files from the file provided, since this source explains what Matryoshka Dolls are.
We will first download and extract the compressed disk image using wget <link> and gunzip <file-name> respectively. We will then need to use The Sleuth Kit (TSK) commands for disk image analysis.
Another disk forensics challenge! As usual, we first download the file using wget <link>. We will have to run gunzip <file-name> as well to expand the file.
After downloading the file using wget, we can run exiftool <file-name> to retrieve the flag, as both the description and the hint indicate that we have ...
Let’s begin by downloading the file using wget <link>. buildings.png The downloaded file, buildings.png looks like this. Doesn’t seem helpful in any way.
After downloading the file, we can simply use the GUI to open the pdf file. In this case, I opened it with Atril Document Viewer.
This seems like a straightforward The Sleuth Kit (TSK) challenge. As per normal, we begin by downloading the compressed disk image using wget, and then expand the file using gunzip.
This challenge requires us to use binwalk and decompress many file types to eventually obtain our flag… and there’s a reason why it’s only 26% liked ...
Seems like a typical network forensics challenge. After downloading the pcap file using wget, we can use Wireshark to get the flag.
Based on the directions given, we will just have to wget <link to file> then run mmls and enter the value of the size of Linux partition in the nc server ...
No writeups match your filters.