ctf-misc
Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio puzzles, constraint solving, game theory, unusual sandbox escapes, and hybrid
By ljagiello · 7,345 installs
npx skills add ljagiello/ctf-skills --skill ctf-misc
Source repository · Upstream listing
CTF Miscellaneous
Quick reference for miscellaneous CTF challenges. Each technique has a one liner here; see supporting files for full details.
Prerequisites
Python packages (all platforms):
Linux (apt):
macOS (Homebrew):
Manual install:
SageMath — Linux: apt install sagemath , macOS: brew install cask sage
Additional Resources
[pyjails.md](pyjails.md) Python jail/sandbox escape techniques, quine context detection, restricted character repunit decomposition, func globals module chain traversal, restricted charset number generation, class attribute persistence, f string config injection via stored eval
[bashjails.md](bashjails.md) Bash jail/restricted shell escape techniques, HISTFILE file read trick, bash v verbose mode, ctypes.sh direct C library calls
[encodings.md](encodings.md) Encodings, QR codes, esolangs, UTF 16 tricks, BCD encoding, multi layer auto decoding, indexed directory QR reassembly, multi stage URL encoding chains
[encodings advanced.md](encodings advanced.md) Verilog/HDL, Gray code cyclic encoding, RTF custom tag extraction, SMS PDU decoding, multi encoding sequential solvers, UTF 9, pixel binary encoding, hexadecimal Sudoku + QR assembly, TOPKEK, MaxiCode
[rf sdr.md](rf sdr.md) RF/SDR/IQ signal processing (QAM 16, carrier recovery, timing sync)
[dns.md](dns.md) DNS exploitation (ECS spoofing, NSEC walking, IXFR, rebinding, tunneling)
[games and vms.md](games and vms.md) WASM patching, Roblox place file reversing, PyInstaller, marshal analysis, Python env RCE, Z3 (including boolean logic gate network SAT solving), K8s RBAC, floating point precision exploitation, custom assembly language sandbox escape via Python MRO chain
[games and vms 2.md](games and vms 2.md) Cookie checkpoint game brute forcing, Flask cookie game state leakage, WebSocket game manipulation, server time only validation bypass, De Bruijn sequence, Brainfuck instrumentation, WASM linear memory manipulation
[games and vms 3.md](games and vms 3.md) memfd create packed binaries, multi phase crypto games with HMAC commitment reveal and GF(256) Nim, emulator ROM switching state preservation, Python marshal code injection, Benford's Law bypass, parallel connection oracle relay, nonogram solver pipelines, 100 prisoners problem, C code jail escape via emoji identifiers, BuildKit daemon build secret exploitation, Docker container escape, Levenshtein distance oracle attack, taint analysis bypass via type coercion, shredded document pixel edge reassembly
[games and vms 4.md](games and vms 4.md) Part 4 (2018 era): XSLT as Turing complete VM, JavaScript MAX SAFE INTEGER successor equality, binary search oracle in comparison only DSL, blind SQLi via script engine timeout error, OEIS sequence lookup automation, QR code reassembly from format string constraints, matrix exponentiation for Fibonacci recurrence, Tribonacci for frog jump counting, Selenium + Tesseract dynamic CAPTCHA, Brainfuck→Piet multi layer polyglot, bytebeat synth code recognition
[linux privesc.md](linux privesc.md) Sudo wildcard parameter injection (fnmatch), crafted pcap for sudoers.d, monit confcheck process injection, Apache d override, backup cronjob SUID, PostgreSQL COPY TO PROGRAM RCE, PostgreSQL backup credential extraction, NFS share exploitation, SSH Unix socket tunneling, PaperCut Print Deploy privesc, Squid proxy pivoting, Zabbix admin password reset via MySQL, WinSSHTerm credential decryption
[ctfd navigation.md](ctfd navigation.md) CTFd platform API navigation without browser: detection, token auth, challenge listing, file download, flag submission, scoreboard, hints, notifications, Python client class
When to Pivot
If the puzzle is actually centered on cryptography or number theory, switch to /ctf crypto .
If the challenge is a real binary exploit instead of a jail, toy VM, or encoding problem, switch to /ctf pwn or /ctf reverse .
If the input is mostly files, images, audio, or packet captures that need recovery work first, switch to /ctf forensics .
For ML/AI techniques (model attacks, adversarial examples, LLM jailbreaking), see /ctf ai ml .
If the NodeJS sandbox uses vm2 ( npm ls vm2 ), check for CVE 2023 37466 via Promise[@@species] with nesting:true — the exception handler escapes the context; see ctf web/js sandbox for the full exploit chain. In misc challenges with bundled JS, always run npm ls vm2 to detect vulnerable vm2 before trying other escapes.
Quick Start Commands
General Tips
Read all provided files carefully
Check file metadata, hidden content, encoding
Power Automate scripts may hide API calls
Use binary search when guessing multiple answers
Common Encodings
Identify by charset:
Base64: A Za z0 9+/=
Base32: A Z2 7= (no lowercase)
Hex: 0 9a fA F
See [encodings.md](encodings.md) for Caesar brute force, URL encoding, and full details.
IEEE 754 Float Encoding (Data Hiding)
Pattern (Floating): Numbers are float32 values hiding raw bytes.
Key insight: A 32 bit float is just 4 bytes interpreted as a number. Reinterpret as raw bytes ASCII.
Variations: Double ' d' , little endian '<f' , mixed. See [encodings.md](encodings.md) for CyberChef recipe.
USB Mouse PCAP Reconstruction
Pattern (Hunt and Peck): USB HID mouse traffic captures on screen keyboard typing. Use USB Mouse Pcap Visualizer, extract click coordinates (falling edges), cumsum relative deltas for absolute positions, overlay on OSK image.
File Type Detection
Archive Extraction
Nested Archive Script
QR Codes
MaxiCode barcode: Hexagonal 2D barcode with bullseye center; decode with zxing (Java) since standard QR decoders fail. See [encodings advanced.md](encodings advanced.md maxicode 2d barcode decoding csaw ctf 2016).
TOPKEK encoding: CTF specific binary encoding where KEK=0 , TOP=1 , ! suffix = repeat count. See [encodings advanced.md](encodings advanced.md topkek binary encoding hack the vote 2016).
See [encodings.md](encodings.md) for QR structure, repair techniques, chunk reassembly (structural and indexed directory variants), and multi stage URL encoding chains.
Audio Challenges
RF / SDR / IQ Signal Processing
See [rf sdr.md](rf sdr.md) for full details (IQ formats, QAM 16 demod, carrier/timing recovery).
Quick reference:
cf32 : np.fromfile(path, dtype=np.complex64) cs16 : int16 reshape( 1,2) cu8 : RTL SDR raw
Circles in constellation = constant frequency offset; Spirals = drifting frequency + gain instability
4 fold ambiguity in DD carrier recovery try 0/90/180/270 rotation
pwntools Interaction
Python Jail Quick Reference
Oracle pattern: L() = length, Q(i,x) = compare, S(guess) = submit. Linear or binary search.
Walrus bypass: (abcdef := "new chars") reassigns constraint vars
Decorator bypass: @ import + @func. class . dict [ name . name ]. get for no call, no quotes escape
String join: open(''.join(['fl','ag.txt'])).read() when + is blocked
See [pyjails.md](pyjails.md) for full techniques.
Z3 / Constraint Solving
See [games and vms.md](games and vms.md) for YARA rules, type systems as constraints, boolean logic gate network SAT solving.
Hash Identification
MD5: 0x67452301 SHA 256: 0x6a09e667 MurmurHash64A: 0xC6A4A7935BD1E995
SHA 256 Length Extension Attack
MAC = SHA 256(SECRET msg) with known msg/hash forge valid MAC via hlextend . Vulnerable: SHA 256, MD5, SHA 1. NOT: HMAC, SHA 3.
Technique Quick References
PyInstaller: pyinstxtractor.py packed.exe . See [games and vms.md](games and vms.md) for opcode remapping.
Marshal: marshal.load(f) then dis.dis(code) . See [games and vms.md](games and vms.md).
Python env RCE: PYTHONWARNINGS=ignore::antigravity.Foo::0 + BROWSER="cmd" . See [games and vms.md](games and vms.md).
WASM patching: wasm2wat flip minimax wat2wasm . See [games and vms.md](games and vms.md).
Float precision: Large multipliers amplify FP errors into exploitable fractions. See [games and vms.md](games and vms.md).
K8s RBAC bypass: SA token impersonate hostPath mount read secrets. See [games and vms.md](games and vms.md).
Cookie checkpoint: Save session cookies before guesses, restore on failure to brute force without reset. See [games and vms 2.md](games and vms 2.md).
Flask cookie game state: flask unsign d c '<cookie ' decodes unsigned Flask sessions, leaking game answers. See [games and vms 2.md](games and vms 2.md).
WebSocket teleport: Modify player.x / player.y in console, call verification function. See [games and vms 2.md](games and vms 2.md).
Time only validation: Start session, time.sleep(required seconds) , submit win. See [games and vms 2.md](games and vms 2.md).
Quine context detection: Dual purpose quine that prints itself (passes validation) and runs payload only in server process via globals gate. See [pyjails.md](pyjails.md).
Repunit decomposition: Decompose target integer into sum of repunits (1, 11, 111, ...) using only 2 characters ( 1 and + ) for restricted eval. See [pyjails.md](pyjails.md).
De Bruijn sequence: B(k, n) contains all k^n possible n length strings as substrings; linearize by appending first n 1 chars. See [games and vms 2.md](games and vms 2.md).
Brainfuck instrumentation: Instrument BF interpreter to track tape cells, brute force flag character by character via validation cell. See [games and vms 2.md](games and vms 2.md).
WASM memory manipulation: Patch WASM linear memory at runtime to set game state variables directly, bypassing game logic. See [games and vms 2.md](games and vms 2.md).
Lua sandbox escape: Bypass load() / os.execute() filters via os["execute"] table indexing or loadstring alias. See [games and vms.md](games and vms.md lua sandbox escape via function name injection csaw ctf 2016).
C code jail via emoji + gadget embedding: When only emoji and punctuation are allowed in C, use (😃==😃) as constant 1, build integers, embed gadgets in add eax, imm32 constants, jump to offset+1 for shellcode primitives. See [games and vms 3.md](games and vms 3.md c code jail escape via emoji identifiers and gadget embedding midnight flag 2026).
Emulator ROM switching: /load replaces ROM but preserves CPU state (registers, RAM, PC). Switch ROMs at specific PCs to combine INIT from one ROM with display instructions from another → read protected memory. See [games and vms 3.md](games and vms 3.md emulator rom switching state preservation bsidessf 2026).
BuildKit daemon exploitation: Exposed BuildKit gRPC allows nested buildctl build with mount=type=secret to read build secrets. Two stage Dockerfile: install buildctl → submit nested build mounting flag secret. See [games and vms 3.md](games and vms 3.md buildkit daemon exploitation for build secrets bsidessf 2026).
Docker container escape: Privileged breakout via host device mount, docker.sock socket escape, CAP SYS ADMIN cgroup release agent, container info leakage via /proc and overlayfs. See [games and vms 3.md](games and vms 3.md docker container escape techniques).
Taint analysis bypass via type coercion: In custom ML like languages with secrecy/taint systems, if expression secrecy depends on return type not condition — coerce side effecting functions to private type to leak private data through public mutable refs. See [games and vms 3.md](games and vms 3.md taint analysis bypass in custom language via type coercion plaidctf 2018).
Shredded document pixel edge reassembly: Encode each strip's left/right edge as binary bitmask (dark=1), use XOR + popcount Hamming distance to greedily place strips by minimum edge distance for sub second reassembly. See [games and vms 3.md](games and vms 3.md shredded document pixel edge reassembly under time pressure nuit du hack ctf 2018).
f string config inje