SKELERSECURITY

Greed Challenge — RSA Low-Exponent Write-Up Overview This challenge revolves around a classic RSA weakness: using a small public exponent (e = 3) without proper padding . Under the right conditions, this allows direct recovery of the plaintext by taking an integer cube root of the ciphertext. The task is to identify the real encrypted flag among several decoys and exploit this mathematical flaw. Key Observations RSA Parameters Public exponent: e = 3 (Narratively hinted as the warden’s “three kingdoms”) Modulus size: ~254 bits Candidate ciphertext: 0x1aadb93ce9a5704a83345e00 Critical Hint “Sometimes the treasure is so light that it never touches the vault walls.” This implies the plaintext m is small enough that: m³ < N When this happens, RSA encryption becomes: c = m³ instead of: c = m³ mod N No modular reduction occurs — which is exactly what enables the attack. Cryptographic Background RSA encryption is defined as: c = m^e mod N If m^e < N , then: c = m^e For e = 3 , recove...

CTF Writeup: LUST Fragment (SQL Injection & WAF Bypass) This challenge was a solid demonstration of how blacklist-based WAFs fail under pressure . What initially appeared to be a straightforward login bypass quickly evolved into a nuanced exercise in SQLite-specific SQL injection under extreme filtering . 1. Initial Reconnaissance The application exposed two authentication endpoints: index.php – standard username/password login facebook_login.php – OAuth-style login integration Basic testing (and source inspection) revealed that user-controlled input was directly concatenated into SQL queries —a textbook SQL injection vulnerability. However, exploitation wasn’t trivial. The application was protected by an unusually aggressive Web Application Firewall (WAF) that blocked most conventional payloads outright. 2. Understanding the WAF Constraints This wasn’t a simple ' OR 1=1 -- situation. The WAF employed regex-based filtering that aggressively blocked: Core SQL keywords: SELE...

Writeup: Pride Challenge (Reverse Engineering) Challenge Overview Pride is a multi-layered Windows reverse engineering challenge. It requires the researcher to navigate through a protective "shell" ( UPX ), bypass environmental checks ( Anti-Debugging/Anti-VM ), and eventually reverse-engineer a custom Virtual Machine (VM) architecture to extract the hidden flag fragment. 1. Initial Analysis & Unpacking The binary initially presents a decoy flag. Analysis with PEiD or Detect It Easy (DIE) reveals the executable is compressed with UPX . Manual Unpacking While a standard upx -d pride.exe is the first step, this challenge utilizes a modified UPX header . To unpack manually: Load the binary in x64dbg . Look for the POPAD instruction followed by a large JMP —this is the jump to the Original Entry Point (OEP) . Use Scylla to dump the process and fix the IAT ( Import Address Table ). 2. Anti-Analysis Bypassing Once unpacked, the binary performs several checks to ensure it...