# Solve Challenge

> Solves CTF challenges by analyzing files, connecting to services, and applying exploitation techniques. Orchestrates category-specific CTF skills for pwn, crypto, web, reverse engineering, forensics, OSINT, malware analysis, remote, and miscellaneous challenges. Use when given a CTF challenge to solve, a challenge file to analyze, or a service endpoint to exploit.

- Skill: `konggithubdev/solve-challenge` (Agent Skill)
- Install (CLI): `npx skillmds@latest add konggithubdev/solve-challenge`
- Raw SKILL.md: https://api.skillmd.com/api/skills/konggithubdev/solve-challenge/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: konggithubdev (https://skillmd.com/u/konggithubdev)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/konggithubdev/solve-challenge

---


# CTF Challenge Solver

You're a skilled CTF player. Your goal is to solve the challenge and find the flag.

## Environment Setup

Two setup strategies depending on your workflow:

### Pre-install (recommended before competitions)

**Python packages (all platforms):**
```bash
pip install pwntools pycryptodome z3-solver sympy gmpy2 hashpumpy fpylll py_ecc \
  angr frida-tools qiling requests flask-unsign sqlmap \
  ropper ROPgadget volatility3 yara-python pefile capstone \
  oletools unicorn scapy Pillow numpy matplotlib shodan \
  uncompyle6 lief dnspython dnslib dissect.cobaltstrike
```

**Linux (apt):**
```bash
apt install gdb radare2 binutils binwalk foremost libimage-exiftool-perl \
  tshark sleuthkit ffmpeg steghide testdisk john pcapfix \
  nmap whois dnsutils hashcat strace ltrace imagemagick curl jq \
  apktool upx qemu-system-x86 sagemath qrencode
```

**macOS (Homebrew):**
```bash
brew install gdb radare2 binutils binwalk exiftool wireshark sleuthkit \
  ffmpeg testdisk john-jumbo nmap whois bind hashcat ghidra \
  imagemagick curl jq apktool upx qemu qrencode
```

**Ruby gems (all platforms):**
```bash
gem install one_gadget seccomp-tools zsteg
```

**Go tools (all platforms, requires Go):**
```bash
go install github.com/ffuf/ffuf/v2@latest
```

**Manual install:**
- pwndbg — Linux: [github.com/pwndbg/pwndbg](https://github.com/pwndbg/pwndbg), macOS: `brew install pwndbg/tap/pwndbg-gdb`
- RsaCtfTool — `git clone https://github.com/RsaCtfTool/RsaCtfTool`
- SageMath — Linux: `apt install sagemath`, macOS: `brew install --cask sage`
- steghide — Linux: `apt install steghide` (not available via Homebrew)
- dnSpy — [github.com/dnSpy/dnSpy](https://github.com/dnSpy/dnSpy) (.NET decompiler, Windows)

### On-demand (during challenges)

Each category skill's `SKILL.md` has a **Prerequisites** section listing only the tools needed for that category. Install as you go.

## Workflow

### Step 0: Create Challenge Folder

**Always create a dedicated folder for each challenge before doing anything else.**

Name the folder: `c:\CTFRun\<CTFName>\<Category>-<ChallengeName>\`

Example structure:
```
c:\CTFRun\
  picoCTF2026\
    web-ORDER_ORDER\          ← this challenge
      solve.py                ← exploit script
      notes.md                ← findings / observations
      flag.txt                ← confirmed flag
      <downloaded files>      ← any challenge files
```

**Create the folder immediately:**
```powershell
mkdir "c:\CTFRun\<CTFName>\<Category>-<ChallengeName>"
Set-Location "c:\CTFRun\<CTFName>\<Category>-<ChallengeName>"
```

- All scripts and downloaded files go inside this folder
- Save the final flag in `flag.txt` once found
- Write key findings in `notes.md` as you go (endpoints, vuln type, payloads tried)

### Step 1: Recon

1. **Explore files** -- List the challenge directory, run `file *` on everything
2. **Triage binaries** -- `strings`, `xxd | head`, `binwalk`, `checksec` on binaries
3. **Fetch links** -- If the challenge mentions URLs, fetch them FIRST for context
4. **Connect** -- Try remote services (`nc`) to understand what they expect
5. **Read hints** -- Challenge descriptions, filenames, and comments often contain clues

### Step 2: Categorize

Determine the primary category, then invoke the matching skill.

**By file type:**
- `.pcap`, `.pcapng`, `.evtx`, `.raw`, `.dd`, `.E01` -> forensics
- `.elf`, `.exe`, `.so`, `.dll`, binary with no extension -> reverse or pwn (check if remote service provided -- if yes, likely pwn)
- `.py`, `.sage`, `.txt` with numbers -> crypto
- `.apk`, `.wasm`, `.pyc` -> reverse
- Web URL or source code with HTML/JS/PHP/templates -> web
- Images, audio, PDFs with no obvious content -> forensics (steganography)

**By challenge description keywords:**
- "buffer overflow", "ROP", "shellcode", "libc", "heap" -> pwn
- "RSA", "AES", "cipher", "encrypt", "prime", "modulus", "lattice", "LWE", "GCM" -> crypto
- "XSS", "SQL", "injection", "cookie", "JWT", "SSRF" -> web
- "disk image", "memory dump", "packet capture", "registry", "power trace", "side-channel", "spectrogram", "audio tracks", "MKV" -> forensics
- "find", "locate", "identify", "who", "where" -> osint
- "obfuscated", "packed", "C2", "malware", "beacon" -> malware
- "jail", "sandbox", "escape", "encoding", "signal", "game", "Nim", "commitment", "Gray code" -> misc

**By service behavior:**
- Port with interactive prompt, crash on long input -> pwn
- HTTP service -> web
- netcat with math/crypto puzzles -> crypto
- netcat with restricted shell or eval -> misc (jail)

### Step 3: Invoke the Category Skill

Once you identify the category, **invoke the matching skill** to get specialized techniques:

| Category | Invoke | When to Use |
|----------|--------|-------------|
| Web | `/ctf-web` | XSS, SQLi, SSTI, SSRF, JWT, file uploads, prototype pollution |
| Pwn | `/ctf-pwn` | Buffer overflow, format string, heap, ROP, sandbox escape |
| Crypto | `/ctf-crypto` | RSA, AES, ECC, PRNG, ZKP, classical ciphers |
| Reverse | `/ctf-reverse` | Binary analysis, game clients, VMs, obfuscated code |
| Forensics | `/ctf-forensics` | Disk images, memory dumps, event logs, stego, network captures |
| OSINT | `/ctf-osint` | Social media, geolocation, DNS, public records |
| Malware | `/ctf-malware` | Obfuscated scripts, C2 traffic, PE/.NET analysis |
| Misc | `/ctf-misc` | Jails, encodings, RF/SDR, esoteric languages, constraint solving |
| Remote | `/ctf-remote` | SSH, remote access, Kali Linux, file transfer |

You can also invoke `/ctf-<category>` to load the full skill instructions with detailed techniques.

### Step 4: Pivot When Stuck

If your first approach doesn't work:

1. **Re-examine assumptions** -- Is this really the category you think? A "web" challenge might need crypto for JWT forgery. A "forensics" PCAP might contain a pwn exploit to replay.
2. **Try a different category skill** -- Many challenges span multiple categories. Invoke a second skill for the cross-cutting technique.
3. **Look for what you missed** -- Hidden files, alternate ports, response headers, comments in source, metadata in images.
4. **Simplify** -- If an exploit is too complex, check if there's a simpler path (default creds, known CVE, logic bug).
5. **Check edge cases** -- Off-by-one, race conditions, integer overflow, encoding mismatches.

**Common multi-category patterns:**
- Forensics + Crypto: encrypted data in PCAP/disk image, need crypto to decrypt
- Web + Reverse: WASM or obfuscated JS in web challenge
- Web + Crypto: JWT forgery, custom MAC/signature schemes
- Reverse + Pwn: reverse the binary first, then exploit the vulnerability
- Forensics + OSINT: recover data from dump, then trace it via public sources
- Misc + Crypto: jail escape requires building crypto primitives under constraints
- OSINT + Stego: social media posts with unicode homoglyph steganography (Cyrillic lookalikes encode bits)
- Web + Forensics: paywall bypass (curl reveals content hidden by CSS overlays)
- Misc + Crypto + Game Theory: multi-phase interactive challenges with AES decryption → HMAC commitment → combinatorial game solving (GF(256) Nim)
- Crypto + Geometry + Lattice: multi-layer challenges progressing from spatial reconstruction → subspace recovery → LWE solving → AES-GCM decryption
- Forensics + Signal Processing: power traces / side-channel analysis requiring statistical analysis of measurement data
- Forensics + Network + Encoding: timing-based encoding in PCAP (inter-packet intervals encode binary data)

## Flag Formats

**The user specifies the flag format in their request.** Always check the challenge description or CTF rules for the exact format before searching.

Common formats:
| CTF | Format | Example |
|-----|--------|----------|
| picoCTF | `picoCTF{...}` | `picoCTF{s3cr3t}` |
| HackTheBox | `HTB{...}` | `HTB{b4sh_1s_fun}` |
| ENOCTF | `ENO{...}` | `ENO{abc123}` |
| NCSA / custom | `NCSA{...}` | `NCSA{MD5_of_something}` |
| Generic | `flag{...}` / `CTF{...}` | `flag{h3ll0}` |
| No wrapper | Plaintext / hash | `d41d8cd98f00b204e9800998ecf8427e` |

**If the user specifies a custom format** (e.g., `NCSA{MD5....}`):
- Search for that prefix specifically: `grep -rniE 'NCSA\{' .`
- It might be composed (e.g., flag = `NCSA{` + MD5 of some extracted value + `}`)
- Always try to reconstruct if the raw value looks like an intermediate result

**Search commands:**
```bash
# Any flag-like pattern
grep -rniE '(flag|ctf|eno|htb|pico|ncsa)\{' .
# Binary / memory output
strings output.bin | grep -iE '\{.*\}'
# Custom prefix
grep -rniE 'NCSA\{' .
```

**Validation rule:**
- If multiple candidates found, prefer the one tied to the intended exploit path
- Save confirmed flag to `flag.txt` in the challenge folder

## Quick Reference

```bash
# Recon
file *                                    # Identify file types
strings binary | grep -i flag             # Quick string search
xxd binary | head -20                     # Hex dump header
binwalk -e firmware.bin                   # Extract embedded files
checksec --file=binary                    # Check binary protections

# Connect
nc host port                              # Connect to challenge
echo -e "answer1\nanswer2" | nc host port # Scripted input
curl -v http://host:port/                 # HTTP recon

# Python exploit template
python3 -c "
from pwn import *
r = remote('host', port)
r.interactive()
"
```

## Challenge

$ARGUMENTS