From 880d8698d6e0a52d1bcb42afba4bfa3882334d42 Mon Sep 17 00:00:00 2001 From: Caplag <> Date: Thu, 17 Sep 2026 00:50:07 +0300 Subject: [PATCH] Init. Commit --- .gitignore | 5 + README.md | 28 + assets/banner.jpeg | Bin 0 -> 820819 bytes assets/caplag-logo.svg | 48 + finals/README.md | 101 ++ .../WRITEUP.md | 46 + .../solve/solve.py | 115 +++ finals/caplagcombat-web-hard/WRITEUP.md | 99 ++ finals/caplagcombat-web-hard/solve/solve.py | 147 +++ finals/difflane-web-easy/WRITEUP.md | 39 + finals/difflane-web-easy/solve/solve.py | 36 + .../grant-residue-forensic-medium/WRITEUP.md | 45 + .../solve/solve.py | 116 +++ finals/kot1/WRITEUP.md | 66 ++ finals/kot1/solve/solve.py | 173 ++++ finals/kot2/WRITEUP.md | 59 ++ finals/kot2/solve/solve.py | 467 +++++++++ finals/kot4/WRITEUP.md | 47 + finals/kot4/solve/solve.py | 277 +++++ finals/kot5/WRITEUP.md | 82 ++ finals/kot5/solve/solve.py | 961 ++++++++++++++++++ finals/mongo-pages/WRITEUP.md | 47 + finals/mongo-pages/solve/solve.py | 120 +++ finals/nullroute-kem-crypto-easy/WRITEUP.md | 63 ++ .../nullroute-kem-crypto-easy/solve/solve.py | 31 + .../WRITEUP.md | 41 + .../solve/solve.py | 24 + finals/proxyrewrite-pwn-medium/WRITEUP.md | 41 + finals/proxyrewrite-pwn-medium/solve/solve.py | 60 ++ finals/pulsewidth-pwn-easy/WRITEUP.md | 40 + finals/pulsewidth-pwn-easy/solve/solve.py | 91 ++ .../pyzsidecar-python-reverse-easy/WRITEUP.md | 41 + .../solve/solve.py | 21 + finals/railannot-pwn-medium/WRITEUP.md | 42 + finals/railannot-pwn-medium/solve/solve.py | 61 ++ finals/rawforge-x3f-pwn-hard/WRITEUP.md | 42 + finals/rawforge-x3f-pwn-hard/solve/solve.py | 61 ++ finals/regexscope-pwn-easy/WRITEUP.md | 43 + finals/regexscope-pwn-easy/solve/solve.py | 82 ++ finals/scalaralias-crypto-easy/WRITEUP.md | 82 ++ finals/scalaralias-crypto-easy/solve/solve.py | 75 ++ finals/sortkey-station-pwn-easy/WRITEUP.md | 35 + .../sortkey-station-pwn-easy/solve/solve.py | 73 ++ finals/syktyvkar/WRITEUP.md | 126 +++ finals/syktyvkar/solve/payload/Pwned.jar | Bin 0 -> 1226 bytes finals/syktyvkar/solve/payload/Pwned.java | 20 + finals/syktyvkar/solve/payload/plugin.yml | 4 + .../payload/stubs/org/bukkit/Bukkit.java | 7 + .../org/bukkit/plugin/java/JavaPlugin.java | 12 + finals/syktyvkar/solve/requirements.txt | 1 + finals/syktyvkar/solve/solve.py | 275 +++++ finals/task11_flowbase/WRITEUP.md | 49 + finals/task11_flowbase/solve/solve.py | 101 ++ finals/task12_docmerge/WRITEUP.md | 64 ++ finals/task12_docmerge/solve/solve.py | 119 +++ finals/task13_gatekeeper/WRITEUP.md | 59 ++ finals/task13_gatekeeper/solve/solve.py | 123 +++ .../WRITEUP.md | 37 + .../solve/solve.py | 25 + .../WRITEUP.md | 71 ++ .../solve/solve.py | 41 + .../WRITEUP.md | 49 + .../solve/solve.py | 26 + finals/zcrx-broker-pwn-hard/WRITEUP.md | 41 + finals/zcrx-broker-pwn-hard/solve/solve.py | 135 +++ qualifiers/README.md | 84 ++ qualifiers/banani/WRITEUP.md | 52 + qualifiers/banani/assets/baltic-spirit.png | Bin 0 -> 239787 bytes qualifiers/banani/assets/banana-amoeba.jpg | Bin 0 -> 181665 bytes qualifiers/banani/assets/container.png | Bin 0 -> 835148 bytes qualifiers/banani/assets/muuga-map.png | Bin 0 -> 394658 bytes qualifiers/banani/assets/port.png | Bin 0 -> 2519396 bytes .../biosignal-relay-pwn-hard/WRITEUP.md | 56 + .../biosignal-relay-pwn-hard/solve/solve.py | 60 ++ .../WRITEUP.md | 37 + .../solve/solve.py | 28 + qualifiers/commbridge-pwn-medium/WRITEUP.md | 47 + .../commbridge-pwn-medium/solve/solve.py | 60 ++ .../copycache-runner-pwn-hard/WRITEUP.md | 45 + .../copycache-runner-pwn-hard/solve/solve.py | 60 ++ .../WRITEUP.md | 50 + .../solve/solve.py | 20 + .../fvnclite-android-reverse-easy/WRITEUP.md | 41 + .../solve/solve.py | 23 + qualifiers/gumbogate-pwn-easy/WRITEUP.md | 43 + qualifiers/gumbogate-pwn-easy/solve/solve.py | 71 ++ qualifiers/heiftrack-pwn-medium/WRITEUP.md | 47 + .../heiftrack-pwn-medium/solve/solve.py | 60 ++ qualifiers/launchlet-web-medium/WRITEUP.md | 76 ++ .../launchlet-web-medium/solve/solve.py | 90 ++ qualifiers/lease-mesh-pwn-medium/WRITEUP.md | 52 + .../lease-mesh-pwn-medium/solve/solve.py | 131 +++ .../mileage-mdm-ios-reverse-hard/WRITEUP.md | 49 + .../solve/solve.py | 24 + .../WRITEUP.md | 41 + .../solve/solve.py | 20 + qualifiers/prizrachniy-samolet/WRITEUP.md | 86 ++ .../assets/aircraft-wreck.png | Bin 0 -> 346108 bytes .../assets/banana-aircraft.png | Bin 0 -> 2416895 bytes .../assets/baron-identification.png | Bin 0 -> 44606 bytes .../assets/coordinates-map.png | Bin 0 -> 1003097 bytes .../assets/higuerote-satellite.png | Bin 0 -> 6867573 bytes .../assets/higuerote-search.png | Bin 0 -> 280404 bytes .../prizrachniy-samolet/assets/higuerote.png | Bin 0 -> 1379160 bytes .../assets/last-position.png | Bin 0 -> 267286 bytes .../prizrachniy-samolet/assets/news-posts.png | Bin 0 -> 83787 bytes .../assets/yv3338-record.png | Bin 0 -> 67979 bytes .../runner-ashfall-forensic-hard/WRITEUP.md | 91 ++ .../solve/solve.py | 177 ++++ qualifiers/sealtail-crypto-easy/WRITEUP.md | 54 + .../sealtail-crypto-easy/solve/solve.py | 80 ++ qualifiers/shardslope-crypto-easy/WRITEUP.md | 52 + .../shardslope-crypto-easy/solve/solve.py | 51 + qualifiers/tagpreview-crypto-easy/WRITEUP.md | 52 + .../tagpreview-crypto-easy/solve/solve.py | 43 + 115 files changed, 7611 insertions(+) create mode 100644 .gitignore create mode 100644 README.md create mode 100644 assets/banner.jpeg create mode 100644 assets/caplag-logo.svg create mode 100644 finals/README.md create mode 100644 finals/admission-drift-forensic-medium/WRITEUP.md create mode 100644 finals/admission-drift-forensic-medium/solve/solve.py create mode 100644 finals/caplagcombat-web-hard/WRITEUP.md create mode 100644 finals/caplagcombat-web-hard/solve/solve.py create mode 100644 finals/difflane-web-easy/WRITEUP.md create mode 100644 finals/difflane-web-easy/solve/solve.py create mode 100644 finals/grant-residue-forensic-medium/WRITEUP.md create mode 100644 finals/grant-residue-forensic-medium/solve/solve.py create mode 100644 finals/kot1/WRITEUP.md create mode 100644 finals/kot1/solve/solve.py create mode 100644 finals/kot2/WRITEUP.md create mode 100644 finals/kot2/solve/solve.py create mode 100644 finals/kot4/WRITEUP.md create mode 100644 finals/kot4/solve/solve.py create mode 100644 finals/kot5/WRITEUP.md create mode 100644 finals/kot5/solve/solve.py create mode 100644 finals/mongo-pages/WRITEUP.md create mode 100644 finals/mongo-pages/solve/solve.py create mode 100644 finals/nullroute-kem-crypto-easy/WRITEUP.md create mode 100644 finals/nullroute-kem-crypto-easy/solve/solve.py create mode 100644 finals/orchid-wallet-ios-reverse-medium/WRITEUP.md create mode 100644 finals/orchid-wallet-ios-reverse-medium/solve/solve.py create mode 100644 finals/proxyrewrite-pwn-medium/WRITEUP.md create mode 100644 finals/proxyrewrite-pwn-medium/solve/solve.py create mode 100644 finals/pulsewidth-pwn-easy/WRITEUP.md create mode 100644 finals/pulsewidth-pwn-easy/solve/solve.py create mode 100644 finals/pyzsidecar-python-reverse-easy/WRITEUP.md create mode 100644 finals/pyzsidecar-python-reverse-easy/solve/solve.py create mode 100644 finals/railannot-pwn-medium/WRITEUP.md create mode 100644 finals/railannot-pwn-medium/solve/solve.py create mode 100644 finals/rawforge-x3f-pwn-hard/WRITEUP.md create mode 100644 finals/rawforge-x3f-pwn-hard/solve/solve.py create mode 100644 finals/regexscope-pwn-easy/WRITEUP.md create mode 100644 finals/regexscope-pwn-easy/solve/solve.py create mode 100644 finals/scalaralias-crypto-easy/WRITEUP.md create mode 100644 finals/scalaralias-crypto-easy/solve/solve.py create mode 100644 finals/sortkey-station-pwn-easy/WRITEUP.md create mode 100644 finals/sortkey-station-pwn-easy/solve/solve.py create mode 100644 finals/syktyvkar/WRITEUP.md create mode 100644 finals/syktyvkar/solve/payload/Pwned.jar create mode 100644 finals/syktyvkar/solve/payload/Pwned.java create mode 100644 finals/syktyvkar/solve/payload/plugin.yml create mode 100644 finals/syktyvkar/solve/payload/stubs/org/bukkit/Bukkit.java create mode 100644 finals/syktyvkar/solve/payload/stubs/org/bukkit/plugin/java/JavaPlugin.java create mode 100644 finals/syktyvkar/solve/requirements.txt create mode 100644 finals/syktyvkar/solve/solve.py create mode 100644 finals/task11_flowbase/WRITEUP.md create mode 100644 finals/task11_flowbase/solve/solve.py create mode 100644 finals/task12_docmerge/WRITEUP.md create mode 100644 finals/task12_docmerge/solve/solve.py create mode 100644 finals/task13_gatekeeper/WRITEUP.md create mode 100644 finals/task13_gatekeeper/solve/solve.py create mode 100644 finals/tollgate-iis-dotnet-reverse-medium/WRITEUP.md create mode 100644 finals/tollgate-iis-dotnet-reverse-medium/solve/solve.py create mode 100644 finals/wasmcoat-android-reverse-medium/WRITEUP.md create mode 100644 finals/wasmcoat-android-reverse-medium/solve/solve.py create mode 100644 finals/wheelhouse-beacon-python-reverse-hard/WRITEUP.md create mode 100644 finals/wheelhouse-beacon-python-reverse-hard/solve/solve.py create mode 100644 finals/zcrx-broker-pwn-hard/WRITEUP.md create mode 100644 finals/zcrx-broker-pwn-hard/solve/solve.py create mode 100644 qualifiers/README.md create mode 100644 qualifiers/banani/WRITEUP.md create mode 100644 qualifiers/banani/assets/baltic-spirit.png create mode 100644 qualifiers/banani/assets/banana-amoeba.jpg create mode 100644 qualifiers/banani/assets/container.png create mode 100644 qualifiers/banani/assets/muuga-map.png create mode 100644 qualifiers/banani/assets/port.png create mode 100644 qualifiers/biosignal-relay-pwn-hard/WRITEUP.md create mode 100644 qualifiers/biosignal-relay-pwn-hard/solve/solve.py create mode 100644 qualifiers/chameleon-line-dotnet-reverse-easy/WRITEUP.md create mode 100644 qualifiers/chameleon-line-dotnet-reverse-easy/solve/solve.py create mode 100644 qualifiers/commbridge-pwn-medium/WRITEUP.md create mode 100644 qualifiers/commbridge-pwn-medium/solve/solve.py create mode 100644 qualifiers/copycache-runner-pwn-hard/WRITEUP.md create mode 100644 qualifiers/copycache-runner-pwn-hard/solve/solve.py create mode 100644 qualifiers/cratewatch-native-rust-reverse-hard/WRITEUP.md create mode 100644 qualifiers/cratewatch-native-rust-reverse-hard/solve/solve.py create mode 100644 qualifiers/fvnclite-android-reverse-easy/WRITEUP.md create mode 100644 qualifiers/fvnclite-android-reverse-easy/solve/solve.py create mode 100644 qualifiers/gumbogate-pwn-easy/WRITEUP.md create mode 100644 qualifiers/gumbogate-pwn-easy/solve/solve.py create mode 100644 qualifiers/heiftrack-pwn-medium/WRITEUP.md create mode 100644 qualifiers/heiftrack-pwn-medium/solve/solve.py create mode 100644 qualifiers/launchlet-web-medium/WRITEUP.md create mode 100644 qualifiers/launchlet-web-medium/solve/solve.py create mode 100644 qualifiers/lease-mesh-pwn-medium/WRITEUP.md create mode 100644 qualifiers/lease-mesh-pwn-medium/solve/solve.py create mode 100644 qualifiers/mileage-mdm-ios-reverse-hard/WRITEUP.md create mode 100644 qualifiers/mileage-mdm-ios-reverse-hard/solve/solve.py create mode 100644 qualifiers/modbus-mirror-native-c-reverse-medium/WRITEUP.md create mode 100644 qualifiers/modbus-mirror-native-c-reverse-medium/solve/solve.py create mode 100644 qualifiers/prizrachniy-samolet/WRITEUP.md create mode 100644 qualifiers/prizrachniy-samolet/assets/aircraft-wreck.png create mode 100644 qualifiers/prizrachniy-samolet/assets/banana-aircraft.png create mode 100644 qualifiers/prizrachniy-samolet/assets/baron-identification.png create mode 100644 qualifiers/prizrachniy-samolet/assets/coordinates-map.png create mode 100644 qualifiers/prizrachniy-samolet/assets/higuerote-satellite.png create mode 100644 qualifiers/prizrachniy-samolet/assets/higuerote-search.png create mode 100644 qualifiers/prizrachniy-samolet/assets/higuerote.png create mode 100644 qualifiers/prizrachniy-samolet/assets/last-position.png create mode 100644 qualifiers/prizrachniy-samolet/assets/news-posts.png create mode 100644 qualifiers/prizrachniy-samolet/assets/yv3338-record.png create mode 100644 qualifiers/runner-ashfall-forensic-hard/WRITEUP.md create mode 100644 qualifiers/runner-ashfall-forensic-hard/solve/solve.py create mode 100644 qualifiers/sealtail-crypto-easy/WRITEUP.md create mode 100644 qualifiers/sealtail-crypto-easy/solve/solve.py create mode 100644 qualifiers/shardslope-crypto-easy/WRITEUP.md create mode 100644 qualifiers/shardslope-crypto-easy/solve/solve.py create mode 100644 qualifiers/tagpreview-crypto-easy/WRITEUP.md create mode 100644 qualifiers/tagpreview-crypto-easy/solve/solve.py diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..7324f1b --- /dev/null +++ b/.gitignore @@ -0,0 +1,5 @@ +.DS_Store +__pycache__/ +*.py[cod] +.pytest_cache/ +.venv/ diff --git a/README.md b/README.md new file mode 100644 index 0000000..689c488 --- /dev/null +++ b/README.md @@ -0,0 +1,28 @@ +
+
+
отборочный и финальный этапы · writeups
+ +
+
+
+
+
Eu& pyT4+$eL6TKrq~TJ+&SA(
zaqVeoH+#(6hRaO!S@9wbObKQ#2R-AA=80H_i7#1N*gp?bu$>eVYpJ#H3)}l_S`juW
z L_R>44ekb#CZ0Vc;VN9z+#J%`Ip)4^Od20-S&
z%X(qFV`6bm?wj}1Uc}1t=}(lve(IVNRXuxOvD)l3CK#5D0-HR4m3`asKepuqBi5*E
z^=D7!jSREB1iYL#AaEdU2smXjN{zfFZsMu7xIOuSO`F8ZZ0Agt021vsC91*hk)RLL
z_yTXB(BMe|3~iN^?k?^>(oj5MGzLDzmm~p&?#AX7kol9fM=rdxvi15w;eqyKAz~^h{mL(n}AMW%@{){#VvC)B*
zDmjMZi~NgUtg9yG0PCH(e$bVL-N_noGtPl0C=3PbSfU@=U7BSX%}w*46h4r9Bk;>u
zL-;jD>HPL`EFj)-JhR5=jo!MJrud)>M{6x1AC$KGy?U0hThr70vuBZ1cexJ!*)BB-
z$dV&(>C{foRh=Jt++4(wkhq=$ybl$7F*5?|#YoG8=y%N=^N~V-%8%Y70W4K;uNruw
zegGD?o=zF1VM$K(iv`qOR?>+
5SlM4c=6T}pNjVJfm2F1N^{&KGIBSpdg79MPBWN9Nl6w85M
zN|q0-=-A7y4b1eVrRxf%m)mu6lpj(EFke-B=o?Bd^xshUHS^SP
Ws;II3FqJ
z{GG*09Qzw1R#L4c3}ZVjzb6m!x5bJy!IDj~jrImDEH91UrXHZhgm%+ejNwL%)3cG!
zV>);t#iIW9t>=8oyjG|FGkc7#bc4W8sES8+6-XTlg
6d5qBB(u+3rxp?l9c$iDp*T+Z_Q
zmf?=NV;~XdD9fo?1Biq0vj+nAj|x9o=9vk+c;xEXX`B6PpnRLwz-QMJ(F1*-IIKJK
zO2HCl(MK~%`VlBL%L;oJ+j;R@b*B#%>xxpSjo|=xUg$6`RxZfGg(CfNqeggBM@b*a
z;%oLZ+T33}Poua<9r80NeyU$
z0FtJ6-`q3rDGasNAS?m6C!jcPhE;CnpF&)g=kek%=auDXxi#dssm(6>m(Jl99bm@~
z7`)-Nnmu1V86J5?5`cKWr~{XZva3)zniR1$X#zx$IvEa!{wJ@Eurkb-BX#DxPzGUs
z@{$w&Gd`{;WP^+Px7N?>@b&kTMSPt(tJ-S@G=E*kF1H!lQO3;`=Jrz|+WM5HT}@R&
z@2M2Zlp!V+O&mQDB4yHZ;_ICHqWpBA&E_X5OF*Dk8~e;;*7vRggki5w?%IWdHje$F
zgP>Yl$T)kNPP~9N-^Q5xHr4Q2AD+j;Bqx79lbK74L7<*tJFo_R1#87~2Hv^gH{TM(}cvnW$?h05Ay<
h2=p;((oZ>Nj&Pk}Zt#Yo!11^LT_DR(e=HYxuE&SKjMq
z8dneNR`C>21)%ydYnD!N`XJmDXYTN_TBpnFC|IH-?=FWANvEd~62f02Q1_5UU&BeN
zL=zCJkVK;qYJ@oKjl$Z?)Z3UUzBvu%d<_Mze0tBptFKS(-q<3|4SDmQvTH(5xg*8+
zVZH1%YrvmylB(p*to}r9m1(-X_=1qTAWvHSkql5`YbiE>tBQb3V17n}8rLVJ7ms;5
zy~hyj-6l$=6l2QmTmD-#R9H*~!qO0&tOC~n(!@is@8B!dmKC$e;!MvmDot-T@H@_s
zOu~mi8Vg0Ecd^J6O9P8PiHJzo%Uiasp=5qa$Z-#uQT}n-hpg-h@X>Ly1|X(1p|L7U
zdg0><;tpp4#fq7}FDEO(s@qeADU7=S6h9$BP6emC=jNpeZl=!{LZQJGe6O{NzF14;
zLA}&O!jvH1*^aHDHX%^Izk;b;REOmejHLjT*?WXS((=++>QAI|EJI`+mkcy5K9ok~
z@$672jE4aJhBS1P$w#LBHCu5mRrv=83Nnhr0VU57mV7EhkDb{0a6zhvu+
d@?
z^n0;?0x4|X=V%Q{d+_aE;Pm>i2y@7b@=QYyl9?Gr0kGXD|1dfxZoor!NmPKZny&fE
z&XmdL72aS_-W6&k!z+vkGPQYl@xiT?(b;5hJpb6&_2C>tmZ8P#g#fY750-SE54VIS
zsV(ciom>8id@1)!nlt1dsP)^lfaL4bWv`nm*-Lqrl+G8+>g^iAA!VBpru#RBO|Krr
zep}ue8B<)*QGhci{Wcu=vy&HWi1v_h8nA7K{!s{K)+@;rEt%flG1@a)YonJO{T$^w
z5rkG=$NE11JH{N(1gPW0uF+?8E|dC0lVb{hFV0V_hTo;4&cK%wS2?2EhZ-w>UuQo$
z{vtndvJ>A^9$cqZ*4{}7=z`|l>#6>|r8vC*?v4B^ycG3HOg1;6ns<~#L_eIt)#w6B
z_&%&$hPN~O@c!*10Ih2cNM!z^7tC+QqG=py7Vt@CC23c>8)$`NRruB*^;4Q79OHuz
zAJA5RvQ2Fi8*t+`J2J9k1Bxx3(FawWkO~K*0VjO$KhT%$Bk}b+|3D(&Xh?`t9Y=6|
zT`+}wxyE3NQ_svw)uaWNs|JToTaEJ7?=KgO2Fydo_Zcrlla?5pj2Rgz4>cKxQy`d$
zN9c1AqC{(IfBYhKqIa#nTo%@P+JF8gN$>Sj>SFw8=c=S(
a&CG7{ahf`G
zPFL$GzucY>Ul|UdwZf8!{X4#9%f6F}HJMm=CpkVT_B>bXbO65e@#$an+>{`JF+7gW
z8e6&!E%@6i5!T99vPOm?VzWN3#_Hx&w05t9X(VmsW`a0ApAIbfx4)^7_3AvYM73!a^gm_iZjJayQ#t--v3nvRYX_^%6pp1iBp=pK1UeLXszm1;Z+
zgXU!HQIOw1$5tWHxy;evh56