Official writeups for GCSB Business CTF 2026.
| Category | Name | Objective | Difficulty [⭐⭐⭐⭐⭐] |
|---|---|---|---|
| Pwn | Relay | A MIPS32 big-endian binary running under QEMU emulation. The binary is a management console with authentication, clearance-gated commands, and an audit trail. Players must reverse the binary to understand the struct layout, identify that the remarks command uses read() instead of fgets() — allowing null bytes through — and recognise that the remarks buffer sits directly before a function pointe... | ⭐ |
| Pwn | Flashpoint | A bare metal ARM Cortex-M3 binary running under QEMU with no OS, no libc, and no memory protection. The binary implements a custom binary protocol (NFWU) over UART for receiving firmware update chunks. The vulnerability is a missing bounds check in the chunk upload handler — the packet header's length field is trusted directly as the copy length into a fixed 480-byte buffer, with no validation ... | ⭐⭐ |
| Pwn | Unverified Patch | The target is a patched Mosquitto MQTT broker where a deliberate vulnerability has been introduced into the publish handler. The flag is stored as a retained message on a random UUID topic that the player cannot guess, forcing them to leak it from broker memory. | ⭐⭐⭐ |
| Pwn | Objection | The target is a patched v8 javascript interpreter. It is vulnerable to a typer bug where JSToNumber fails to consider to consider the case where the input is an object. You can chain this with another other bug that allows an attacker to create an array with a length greater than its allocated size, to get OOB read/writes on the v8 heap. | ⭐⭐⭐⭐ |
| Reversing | Phantom Channel | The binary is actually a fileless loader. It decompresses an embedded ELF binary entirely in memory using zlib, writes it into an anonymous file created by the memfd_create Linux syscall, and executes it directly from /proc/self/fd/ without ever touching the filesystem. | ⭐ |
| Reversing | Shadow Ledger | The verification doesn't compare anything explicitly — it uses an implicit flow: for each correct bit, the binary executes a NOP sled that slightly increases the total instruction count. A massive 'solver trap' loop is there to make angr and Triton hang forever. The actual check is invisible to any standard tool. The only way to recover the key is to use Intel Pin, count instructions across 33 ... | ⭐⭐ |
| Reversing | dudsat | lbproc presents itself as a routine RF link budget validation tool, the kind of utility that runs unattended on ground station terminals, processes satellite contact window logs, and prints a line of LOCK or NO-LOCK status for each acquisition window. The output is clean, the output format is realistic, and the binary is exactly the right size to be what it claims. | ⭐⭐⭐ |
| Reversing | Sysprobe | sysprobe is a stripped Linux ELF binary that presents itself as a routine system diagnostics utility. Its PT_NOTE segment has been overwritten with an injected PT_LOAD stub that silently hijacks the entry point before main ever executes. That stub decrypts and inflates a hidden payload into an anonymous RWX memory region at runtime. Inside that payload lives a custom 25-opcode virtual machine r... | ⭐⭐⭐⭐ |
| Reversing | Enthiran | enthiran is a stripped x86-64 Linux ELF binary that presents itself as a routine system diagnostics utility. The channel scores are the flag — encoded in the hidden layer of a 16→32→8→1 Multi-Layer Perceptron embedded directly in the binary. Recovery requires identifying the MLP architecture from floating-point loop patterns, extracting the weight matrices and bias vectors, reconstructing the h... | ⭐⭐⭐⭐⭐ |
| Web | trust-fall | Trust Fall requires reading a publicly exposed Grist rollout note to discover the install-admin email address, then sending that address in the X-Forwarded-User header to impersonate the administrator through the misconfigured nginx reverse proxy. With install-admin access, a Python formula column is injected into a scratch document. Because the Grist deployment runs with GRIST_SANDBOX_FLAVOR=u... | ⭐ |
| Web | sarym_control | The target exposes a vendor maintenance portal backed by a Hono application and an internal utility service. The solution path abuses a route normalization mismatch to reach an unauthenticated admin settings endpoint, then uses a query-string injection flaw in the admin utility runner to execute cat /flag.txt. | ⭐⭐ |
| Web | gridwatch | GridWatch requires chaining a Samlr signature-wrapping authentication bypass with an authenticated server-side request forgery and an internal Node-RED deployment that has no administrator authentication. A forged SAML response is accepted as the grid operations administrator, which unlocks the operator relay endpoint and allows the solver to reach the internal SCADA automation service, deploy ... | ⭐⭐⭐ |
| Web | portalistic | Supplier registration + admin review bot interaction -> CSRF protection bypass -> XS-Leak audit oracle leaks supplier verification code -> verified supplier account access -> document upload path traversal enables arbitrary file write -> route middleware bypass 0day -> Next.js restart triggers server-side code execution. | ⭐⭐⭐⭐ |
| Web | korvia-vault | Ruby slice bug bypasses condition => Arbitrary port number => downgrade websocket connection to TCP => Internal Java service has TLS cert SSRF CVE => Use jar protocol file upload race condition => Upload zip / ruby vm executable => Blind OOB XXE to leak users.json to get secret => Blind OOB XXE to leak /tmp filename of uploaded file => Use secret to craft signature => Path traversal on session ... | ⭐⭐⭐⭐⭐ |
| Crypto | Once or nothing | Break a Lamport signature scheme with no message hashing and private-key reuse to forge a signature for the admin message. | ⭐ |
| Crypto | Twice or nothing | Break a Lamport signature scheme with private-key reuse and a five-signature limit. | ⭐⭐ |
| Crypto | Pow Pow | Break a weak linear hash function to solve 100 Proof-of-Work style puzzles within the time limit. | ⭐⭐⭐ |
| Crypto | Isochronal Scramble | Provide a starting curve E0 and a message data such that CGL_hash(E0, data) == data (a hashquine). | ⭐⭐⭐⭐ |
| Crypto | Isochronal Fixed Point | Provide a starting curve E0 and messages data such that CGL_hash(E0, data) == literal_eval(data), then find a collision between a hashquine and a Python code-exec payload. | ⭐⭐⭐⭐⭐ |
| Forensics | The Gilded Ghost | This challenge introduces learners to basic file recovery from a disk image using The Sleuth Kit. Participants will practice identifying a filesystem, locating deleted directory entries, extracting deleted files, and interpreting recovered script and payload artifacts to reconstruct attacker actions. | ⭐ |
| Forensics | Trust and Betrayal | Trust and Betrayal is a very easy forensics challenge that involves the analysis of the recent supply chain attack involving the Axios package. | ⭐⭐ |
| Forensics | COMfortable Exfiltration | COMfortable Exfiltration is a Medium Forensics challenge revolving around a C++ dropper which drops and initializes a C# malware. The dropper shadows the ADOBD.Stream CLSID object before using the Windows Explorer CLSID to drop the C# malware. Said malware registers a couple of COM objects which are invoked from the dropper itself. | ⭐⭐⭐ |
| Forensics | Open Wound | Investigation of IIS Web Server, identifying and analyzing a malicious IIS module installed on the server to decrypt exchanged data and understand the attacker's behavior. | ⭐⭐⭐⭐ |
| Forensics | Stay Hydrated | The challenge aims to recover data from a system using the Data Deduplication feature that has been attacked by ransomware. Must understand how Data Dedup works, recover the keylogger log, reconstruct the keystrokes to get the KeePass password, extract KeePass from disk image and open it to get the Starline project key, then recover the packaged released source code from Dedup Chunkstore. | ⭐⭐⭐⭐⭐ |
| Mobile | NoctEye | A field analyst's handset was compromised by a spyware implant — NoctEye. Before the SOC team could isolate the device, the implant encrypted a local log of stolen operational data and staged it for exfiltration. The team pulled the outgoing artifact — intercept.bin — before it left the device. The APK sample was also recovered from the filesystem. Reverse both, recover the plaintext, find the ... | ⭐⭐ |
| Mobile | SpaceShooter | A nation-state APT group known as DarkVector has been conducting cyberattacks against our country's critical infrastructure. During a counter-operation, our red team captured a suspicious Android application deployed by the group as part of their staging infrastructure. The application is disguised as a simple mobile game — Space Shooter — but intelligence suggests it contains an embedded opera... | ⭐⭐⭐ |
| Mobile | NoctaVault | A threat actor distributed an Android application disguised as an offline password manager called NoctaVault. A secret operational credential is embedded inside, sealed with a recovery phrase. The app uses a custom multi-layer native packer — the real code never touches classes.dex, and every per-build constant in the native library is randomised so no two builds look the same. | ⭐⭐⭐⭐ |
| Hardware | necvision | Fuzzing and scripting using the NEC protocol to hijack a TV simulator. | ⭐⭐ |
| Hardware | VoltGrid CSMS | Bypass a modern WebAuthn (Passkey) login by exploiting a credential binding validation flaw. Hijack an active OCPP 1.6J WebSocket connection for a charging station. Forge a StopTransaction event to halt energy delivery to the target. | ⭐⭐⭐ |
| Hardware | Cloned Clearance | Enumerate the simulated MIFARE Classic 1K card via the ISO 14443-A protocol to extract its UID and establish an active session. Exploit the CRYPTO1 stream cipher's weak PRNG using a Nested Authentication Attack to recover all 16 sector keys from a single known default key. Impersonate the cloned card to the door lock reader by dynamically handling mutual authentication challenges across all sec... | ⭐⭐⭐⭐ |
| Blockchain | Grant Registry | The claim_allocation instruction checks that register_eligibility was called in the same transaction. But it does this by always looking at instruction index 0, not the instruction that came right before it. So if you put register_eligibility at index 0, every claim_allocation in the same transaction will pass the check. Send one registration and three claims in a single transaction to get 3 al... | ⭐⭐ |
| Blockchain | Vivarium | Exploit a compiler-level transient storage bug (present in solc 0.8.28–0.8.33 when via-ir is enabled) to zero out the owner slot and seize full administrative control of PrivateYieldVault. Chain multi-step vault lifecycle operations inside a single multicall to drain every last VIVM token. | ⭐⭐⭐ |
| Blockchain | Impossible | Exploit a soundness bug in Jolt zkVM's batched sumcheck verification. The verifier uses prover-controlled opening_claims in its equations, but does not bind those claims into the Fiat-Shamir transcript before deriving the batching challenges. Forge a valid Jolt proof for the impossible guest program without knowing the actual password, bypass the off-chain password verification gate, trigger an... | ⭐⭐⭐⭐ |
| ICS | Sector Blackout | Tunnel BACnet traffic over TCP using a provided proxy. Register as a BACnet Foreign Device to interface with a remote router. Perform internal network and device discovery via Who-Is broadcasts. Enumerate BMS device objects and identify specific targets. Manipulate binary-value properties to initiate a global blackout. | ⭐⭐ |
| ICS | featherfall | Wind turbine Siemens S7 PLC + web HMI -> recover a WebDAV endpoint from public JavaScript, download a compiled S7 filter module and topology map, scan the exposed PE, PA, and DB spaces over S7, reverse the proxy's first-item offset filter, bypass it with a multi-item read to leak the salted MD5 HMI credential from protected DB memory, log into the HMI, switch the PLC to manual, clear the interl... | ⭐⭐⭐ |
| ICS | zero broker | Gas station OPCUA PLC + mosquitto MQTT + telnet HMI -> use guest HMI logs/help to recover the diagnostics formula and internal MQTT topic names -> fetch the retained salt from public MQTT and compute the override token -> unlock diagnostics and install an attacker-generated engineer certificate -> authenticate to OPCUA, enumerate the bridge and flag nodes, and repoint the MQTT bridge to an atta... | ⭐⭐⭐⭐ |
| AI/ML | ai-bribery-compliance | Indirect prompt injection through agent tool output to bypass Korvian Treasury verification and obtain an approved case verdict. | ⭐⭐ |
| AI/ML | watermark | Extract a flag hidden inside a neural network's behavioral watermark. The model was trained with a trigger-set backdoor (Adi et al., 2018) — specific trigger images cause the model to output class predictions that encode ASCII characters of the flag. Players must run inference on the trigger images and interpret the predictions. | ⭐⭐ |
| AI/ML | Lotus Registry | The challenge involves exploiting OWASP LLM03:2025 Supply Chain attack with a model loading priority bypass and PickleScan filter bypass. | ⭐⭐⭐ |
| AI/ML | gilded_weaver | Recover encrypted key material hidden inside a federated learning gradient aggregate. The server's weight matrix has unusual spectral structure — its singular values form tight clusters separated by large gaps. This structure partitions the hidden space into orthogonal subspaces, one per client. Projecting the aggregate gradient onto the correct subspace reveals quantized byte values that serve... | ⭐⭐⭐ |
| AI/ML | Espionage Intelligence | The challenge involves exploiting cross-context RAG retrieval to leak restricted credentials, vector poisoning to capture an automated JWT push from the Intel Agent, and abusing the Intel Agent's matplotlib chart-generation feature for server-side code execution. | ⭐⭐⭐⭐ |
| AI/ML | spectral_rift | Recover an encrypted payload hidden inside a merged neural network model by performing blind low-rank adapter separation. Three adapters with different ranks were merged via task arithmetic, but not all adapters are active in all layers. By profiling the spectral (SVD) structure of weight deltas, deducing the combinatorial activity pattern, and separating overlapping subspaces via alternating p... | ⭐⭐⭐⭐ |
| Cloud | exposed supply | Election week logistics path leaked into public internet. A supplier-facing estate that should have stayed internal is standing too close to the public internet. Correlating public bucket exposure to recoverable credential material, extracting configuration strings from an obfuscated front-end bundle, and locating exported service account keys inside a supply-chain archive. | ⭐⭐ |
| Cloud | ghost access | Hunt persistence that outlasts headline cleanup. Identify a malicious IAM policy binding hidden on a service account resource instead of the project, mapping cleanup and persistence patterns in Cloud Audit Logs after privilege escalation, and correlating storage.objects.delete and DestroySecretVersion to the same operator session. | ⭐⭐⭐ |
| Cloud | privilege chain | Follow how supplier access became operator motion and how that motion touched the build path the public never sees. Tracing a multi-hop GCP service account impersonation chain in audit logs, distinguishing authenticated-as from impersonated-as using serviceAccountDelegationInfo, and performing OCI image config forensics to expose embedded IOC environment variables. | ⭐⭐⭐⭐ |
| Coding | Checksum Mismatch | Given N packets each carrying a byte payload and a stored XOR checksum, count how many packets are corrupted. Tests basic bitwise operations and linear scanning. | ⭐ |
| Coding | Incident Window | Given a timestamped event stream, count how many distinct time window positions contain at least K suspicious events. Tests the two-pointer sliding window technique with O(1) range counting. | ⭐⭐ |
| Coding | Cascade Depth | Find the maximum weight path in a directed acyclic graph. Tests topological sort via Kahn's algorithm combined with a single-pass dynamic programming relaxation, running in O(V + E). | ⭐⭐⭐ |
| Coding | Surge Protocol | Support range-add updates and range-maximum queries over an array of up to 500,000 elements. Tests segment tree construction with lazy propagation, achieving O(log N) per operation. | ⭐⭐⭐⭐ |
| Coding | Choke Point | Build the dominator tree of a directed graph from a source node and compute the sum of subtree sizes across all reachable nodes. Tests the Lengauer-Tarjan algorithm, combining DFS spanning trees, semidominator computation in reverse DFS order, union-find with minimum tracking, and a two-pass implicit/explicit correction step, all in near-linear time. | ⭐⭐⭐⭐⭐ |
| Secure Coding | ariadnes_hand | The challenge presents a C# .NET 8 ASP.NET Core service simulating Spanning Tree Protocol BPDU propagation across a network fabric. A recursive forwarding method in the service lacks cycle detection and a hard propagation bound, causing it to spiral indefinitely on any topology containing a loop. The player must locate the fault in the source code, apply both safeguards correctly, and submit th... | ⭐⭐ |
| Secure Coding | the dark night | The Dark Night is a secure coding challenge set within ORION SENTINEL, a fictional threat-intelligence analyst portal. Players are given access to the application source code and tasked with identifying and patching a cryptographic flaw inside a custom internal authentication library. The vulnerability is a predictable ECDSA signing nonce: the library derives the nonce k from the message payloa... | ⭐⭐⭐ |
| Secure Coding | Le paradis et lenfer | Le paradis et l'enfer is a secure coding challenge that exposes a cross-service trust boundary failure spanning a Go microservice and an Apache Tomcat portal. Players enumerate the provided Go source code to understand the inter-service authentication model, exploit a path traversal in the Tomcat forwarding servlet to recover the .gitignored trust validation module, and then implement a cryptog... | ⭐⭐⭐⭐ |
| FullPwn | Orion | Orion is a very easy Linux machine that features CSRF Validation Bypass and exploration of CraftCMS and Telnetd. The foothold includes achieving remote code execution by exploiting CVE-2025-32432 in a vulnerable version of CraftCMS. Then the default Craft environment variable file exposes the credentials for its MySQL database, which... | ⭐ |
| FullPwn | Nexus | Nexus is an easy-difficulty Linux machine that features an exposed Gitea repository leaking credentials and a job posting that reveals valid usernames. The leaked credentials provide access to Krayin CRM, which is vulnerable to CVE-2026-38526, leading to a shell as www-data. Further enumeration of the Krayin CRM configuration files reveals additional credentials that allow... | ⭐⭐ |
| FullPwn | Fireflow | Fireflow is a medium difficulty Linux machine that starts off with a leaked Langflow flow_id. With this, an attacker is able to exploit the unauthenticated CVE-2026-33017 and get a shell as www-data on the remote machine. There, he will find that a password in Langflow's .env file is reused by the user nightfall, who is able to SSH into the machine. In the home directory... | ⭐⭐⭐ |
| FullPwn | Ghostlink | Ghostlink is a Hard difficulty Windows machine featuring an Active Directory domain controller and a web server. Enumeration reveals a critical MQTT service used for node tracking, which exposes two internal hosts: a secure file sharing app and a Gogs code host. The attacker modifies the MQTT health check to trigger NTLM... | ⭐⭐⭐⭐ |
| FullPwn | Odyssey | Odyssey is an Insane Windows machine that starts with a web application gated behind WebAuthn authentication. An endpoint vulnerable to NoSQL Pipeline Aggregation Injection provides access to unclaimed onboarding tokens, which can then be used to register a custom-made authenticator to log in to the application. A userHandle confusion vulnerability provides admin... | ⭐⭐⭐⭐⭐ |