2025 PACISE CTF Contest

You've encountered a mysterious binary running on a remote server. It asks for your input—but beware, your input may overflow its boundaries.

Your task is to exploit a classic buffer overflow vulnerability and redirect program execution to a hidden function called hacked(). If successful, the function will reveal the flag.

You'll be given the source code (overflow.c) and the compiled binary to analyze locally.

🧩 Goal:

Call the hacked() function remotely using buffer overflow.

🌐 Remote Server (ubuntu:20.04):
You can connect to the challenge remotely using:

Host: 143.244.149.32

Port: 8000

You are expected to use pwntools or another suitable tool to interact with the service.

This is not a typical buffer overflow—you’ll need to think like a return-oriented programmer!

You're given a binary running on a remote server (ubuntu:20.04). The program has a vulnerable buffer overflow entry point. Your task is to craft a payload that invokes a series of functions using return addresses and carefully placed arguments:

1. Call add_bin(0xdeadbeef)
2. Call add_bash(0xcafebabe, 0x0badf00d)
3. Call exec_string() to execute the constructed /bin/bash

You will get a shell if all goes well—and from there, retrieve your prize: flag.txt.

This is your final binary challenge, combining everything you’ve learned about exploitation, reverse engineering, and remote interaction with vulnerable programs.

You are given access to a remote binary service that contains a vulnerability. Your task is to exploit it to retrieve the contents of the flag.txt file. Successfully doing so requires bypassing modern protections like ASLR, NX, and StackGuard, with the knowledge that PIE is disabled.

💡 Objectives
Your exploitation must:

1. Connect to the remote server (Ubuntu 24.10)
2. Interact with the vulnerable binary: calendar
3. Bypass enabled security features: ASLR, NX, Stack Canary
4. Exploit the vulnerability to ultimately read the contents of flag.txt

Hint: You can download and analysis the calendar and libc.so.6 (these are the one used on the remote server)

You intercepted a strange encrypted message while infiltrating Caesar's palace. You suspect it's encrypted using a Caesar cipher, but the shift key isn't known. Here's the intercepted ciphertext:

Dro aesmu lbygx pyh TEWZC yfob dro vkji nyq.

You also found a mysterious hint scribbled on a note nearby:

Hint: Caesar never goes beyond what he can count on his fingers.

Task:

Decrypt the message and submit the plaintext as the flag, wrapped in the standard CTF format:

flag{your_plaintext_here}

While scanning through radio frequencies, you intercepted an odd numerical transmission. It seems to represent some coded text. The message looks like this:

.... . .-.. .-.. --- / .-- --- .-. .-.. -..

Beside the intercepted message, there's a small note scribbled hastily:

Hint: Samuel Morse would have liked this.

Task:

Decode the intercepted message and submit the plaintext as the flag wrapped in standard CTF format:

flag{your_plaintext_here}

You intercepted an RSA encrypted message. Fortunately, the RSA modulus (n) is extremely small, allowing you to factorize it easily.

Given RSA parameters:

Public modulus (n):

2773

Public exponent (e):

17

Your task is simple and straightforward:

Factorize the given modulus (n).

Calculate the private exponent (d), which is the modular inverse of e mod φ(n).

Submit the RSA private exponent (d) you calculated in the following flag format:

CTF{d_value_here}

A curious message awaits you at the link below.
Something on the page seems a bit... encoded. Perhaps it’s hiding in plain sight, just waiting to be understood by the right mind.
Can you unveil the truth and uncover the flag?

A simple comment box reflects what you type—harmless fun, right?
But legends say that this page knows something. A secret. One that it will never show you… unless you can trick it.

Your challenge is to find a way to execute JavaScript on the page, and use it to make the site reveal the hidden flag.

Welcome to our highly secure login system.
Users must authenticate to proceed, but we've been told there might be a small oversight in the way inputs are handled.
Can you slip through the cracks and uncover the secret hidden in /home/flag.txt?