CTF Miscellaneous
Quick reference for miscellaneous CTF challenges. Each technique has a one-liner here; see supporting files for full details.
Additional Resources
- pyjails.md — Python sandbox escape, quine ctx, charset tricks, class-attr persistence, literal_eval
- bashjails.md — restricted shell escape
- encodings.md — QR, esolangs, Verilog, UTF-16, BCD, Gray code, RTF, SMS PDU
- rf-sdr.md — RF/SDR/IQ processing, QAM-16, carrier/timing recovery
- dns.md — ECS spoof, NSEC walk, IXFR, rebinding, tunneling
- games-and-vms.md — WASM patch, PyInstaller, marshal, floating-point, K8s RBAC, Nim GF(256)
- games-and-vms-2.md — ML weight perturbation, cookie games, WebSocket manip, LoRA merge
- linux-privesc.md — sudo wildcard, monit confcheck, NFS, PostgreSQL COPY TO PROGRAM, Zabbix
- ai-ml.md — federated poison, NN watermark, Grover, LLM injection (arg/lang/reverse/policy), Lambda RCE
Pattern Recognition Index
Dispatch on observable artefacts, not challenge titles.
| Signal |
Technique → file |
python3 entry point + input()/eval/exec jail, restricted builtins |
Python jail escape → pyjails.md |
Restricted shell (rbash, noprofile), limited binaries |
Bash jail escape → bashjails.md |
| Only DNS traffic allowed egress, or DNS records with long TXT blobs |
DNS exploitation / tunneling → dns.md |
.iq, .cfile, .wav with FM / AM signals, SDR / radio references |
RF/SDR decoding → rf-sdr.md (for decoded hardware pipelines see ctf-forensics/signals-and-hardware.md) |
| Encoded text: unusual base, esolang, QR fragments |
Encoding decoders → encodings.md |
| ML weights file, LLM endpoint, quantum circuit, federated training loop |
AI/ML/quantum → ai-ml.md |
| WASM binary + in-browser game, VM state in JS |
WASM patching → games-and-vms.md |
| Z3/SMT shape: "find x such that f(x) is true" for a small predicate |
Z3 constraint solve → games-and-vms.md |
| Elevated-privilege needed, unusual sudoers / crontab / SUID binary |
Linux privesc patterns → linux-privesc.md |
LLM endpoint has a fetch_* / read_* tool without scheme allow-list |
Agent file-read via file:// in tool URL → ai-ml.md |
.keras/.h5 config has "class_name":"Lambda" with base64 function |
Marshal stego + safe_mode=False RCE → ai-ml.md |
ast.literal_eval consumer without isinstance check, downstream index-based access |
Dict-for-list type confusion → pyjails.md |
MCP server (@modelcontextprotocol/sdk, McpServer.registerTool) with config/schema from writable source |
Tool-definition poisoning → ai-ml.md#mcp-tool-definition-poisoning |
| Agent ingests user images + emits text summary; no OCR filter mentioned |
Image-OCR prompt injection → ai-ml.md#image-ocr-prompt-injection |
Shared repo + agent has Write/Edit tools + CLAUDE.md or .github/workflows/*.yml present |
Agent self-persistence → ai-ml.md#agent-self-persistence |
| Attachment > 64k tokens, single user turn, no retrieval (whole doc concatenated) |
Haystack distraction injection → ai-ml.md#long-context-distraction |
Tool schema string field echoed into subprocess/kubectl/shell invocation |
Agent tool-arg injection via environment echo → ai-ml.md#agent-tool-arg-injection |
Recognize the mechanic. Names lie; bytes don't.
For inline code/cheatsheet quick references (grep patterns, one-liners, common payloads), see quickref.md. The Pattern Recognition Index above is the dispatch table — always consult it first; load quickref.md only if you need a concrete snippet after dispatch.
1---2name: ctf-misc3description: CTF Miscellaneous4---56# CTF Miscellaneous78Quick reference for miscellaneous CTF challenges. Each technique has a one-liner here; see supporting files for full details.910## Additional Resources1112- [pyjails.md](pyjails.md) — Python sandbox escape, quine ctx, charset tricks, class-attr persistence, literal_eval13- [bashjails.md](bashjails.md) — restricted shell escape14- [encodings.md](encodings.md) — QR, esolangs, Verilog, UTF-16, BCD, Gray code, RTF, SMS PDU15- [rf-sdr.md](rf-sdr.md) — RF/SDR/IQ processing, QAM-16, carrier/timing recovery16- [dns.md](dns.md) — ECS spoof, NSEC walk, IXFR, rebinding, tunneling17- [games-and-vms.md](games-and-vms.md) — WASM patch, PyInstaller, marshal, floating-point, K8s RBAC, Nim GF(256)18- [games-and-vms-2.md](games-and-vms-2.md) — ML weight perturbation, cookie games, WebSocket manip, LoRA merge19- [linux-privesc.md](linux-privesc.md) — sudo wildcard, monit confcheck, NFS, PostgreSQL COPY TO PROGRAM, Zabbix20- [ai-ml.md](ai-ml.md) — federated poison, NN watermark, Grover, LLM injection (arg/lang/reverse/policy), Lambda RCE21---2223## Pattern Recognition Index2425Dispatch on **observable artefacts**, not challenge titles.2627| Signal | Technique → file |28|---|---|29| `python3` entry point + `input()`/`eval`/`exec` jail, restricted builtins | Python jail escape → pyjails.md |30| Restricted shell (`rbash`, `noprofile`), limited binaries | Bash jail escape → bashjails.md |31| Only DNS traffic allowed egress, or DNS records with long TXT blobs | DNS exploitation / tunneling → dns.md |32| `.iq`, `.cfile`, `.wav` with FM / AM signals, SDR / radio references | RF/SDR decoding → rf-sdr.md (for decoded hardware pipelines see `ctf-forensics/signals-and-hardware.md`) |33| Encoded text: unusual base, esolang, QR fragments | Encoding decoders → encodings.md |34| ML weights file, LLM endpoint, quantum circuit, federated training loop | AI/ML/quantum → ai-ml.md |35| WASM binary + in-browser game, VM state in JS | WASM patching → games-and-vms.md |36| Z3/SMT shape: "find x such that f(x) is true" for a small predicate | Z3 constraint solve → games-and-vms.md |37| Elevated-privilege needed, unusual sudoers / crontab / SUID binary | Linux privesc patterns → linux-privesc.md |38| LLM endpoint has a `fetch_*` / `read_*` tool without scheme allow-list | Agent file-read via `file://` in tool URL → ai-ml.md |39| `.keras`/`.h5` config has `"class_name":"Lambda"` with base64 function | Marshal stego + `safe_mode=False` RCE → ai-ml.md |40| `ast.literal_eval` consumer without `isinstance` check, downstream index-based access | Dict-for-list type confusion → pyjails.md |41| MCP server (`@modelcontextprotocol/sdk`, `McpServer.registerTool`) with config/schema from writable source | Tool-definition poisoning → ai-ml.md#mcp-tool-definition-poisoning |42| Agent ingests user images + emits text summary; no OCR filter mentioned | Image-OCR prompt injection → ai-ml.md#image-ocr-prompt-injection |43| Shared repo + agent has Write/Edit tools + `CLAUDE.md` or `.github/workflows/*.yml` present | Agent self-persistence → ai-ml.md#agent-self-persistence |44| Attachment > 64k tokens, single user turn, no retrieval (whole doc concatenated) | Haystack distraction injection → ai-ml.md#long-context-distraction |45| Tool schema string field echoed into `subprocess`/`kubectl`/shell invocation | Agent tool-arg injection via environment echo → ai-ml.md#agent-tool-arg-injection |4647Recognize the **mechanic**. Names lie; bytes don't.4849---5051For inline code/cheatsheet quick references (grep patterns, one-liners, common payloads), see [quickref.md](quickref.md). The `Pattern Recognition Index` above is the dispatch table — always consult it first; load `quickref.md` only if you need a concrete snippet after dispatch.
MateoBogo