Miscellaneous

A pcap leaks a flag one character per syslog packet in scrambled order, and sorting by each packet’s Message ID field reassembles the flag.

Abusing pnut-sh’s C-to-shell codegen, where a C local named REPLY aliases the tainted shell $REPLY from gets() and detonates command execution via bash arithmetic to run the setuid nl on /flag.

Exploiting a GitHub Actions workflow that interpolates an untrusted issue body into a run block, gaining RCE to dump the FLAG secret from the Runner.Worker process memory and exfiltrating it as hex to bypass log masking.