Misc

OSINT challenge: identify a Freehold High School alum from a blurred music photo — Bruce Springsteen.

Identify the abandoned ship overgrown with vegetation from an OSINT image — SS Ayrfield.

Reverse-psychology logic puzzle: telling the bot the flag IS the answer gets you the flag.

A trivia/OSINT puzzle: identify Valve’s unreleased game Deadlock and the hero Wraith, then read the shipped ability data (Card Trick) from the community API to get the suit order, max-level stat modifiers, and card-charge count for the flag.

A setuid helper pins an eBPF flag-printer into a world-accessible PROG_ARRAY then chmod 000s the program pin; loading an unprivileged socket-filter that bpf_tail_calls index 0 runs the root-loaded printer and fills the readable flag map.

A 16-frame APNG hides one flag character per frame in the top-left pixel of each frame’s decompressed scanline data; every standard stego avenue is a dead end, so decompressing all 16 fdAT/IDAT streams and reading byte 4 of each yields the flag.

A pcap leaks a flag one character per syslog packet in scrambled order, and sorting by each packet’s Message ID field reassembles the flag.

Abusing pnut-sh’s C-to-shell codegen, where a C local named REPLY aliases the tainted shell $REPLY from gets() and detonates command execution via bash arithmetic to run the setuid nl on /flag.

Exploiting a GitHub Actions workflow that interpolates an untrusted issue body into a run block, gaining RCE to dump the FLAG secret from the Runner.Worker process memory and exfiltrating it as hex to bypass log masking.