BoroCTF-2026

cat

Reversing a repeating-key XOR crackme that downloads the flag from catbox.moe.

Brute-force stack canary byte-by-byte via fork’s PID oracle, leak libc with puts, then ORW ROP chain.

Two’s complement INT_MIN negation overflow bypasses an absolute-value check to trigger the win condition.

Password and flag hardcoded in client-side JavaScript — just read the source.

Decoding ASCII characters from RGB color blocks in a PNG image.

Classic path traversal — the challenge name tells you exactly what to do.

Node.js prototype pollution via POST /api/flight-profile grants admin access.

Classic Caesar cipher shifted by +3 conceals the flag.

Recovering the flag from TrueType GSUB ligature substitution rules.

Decompiling a compiled AutoHotkey executable to extract the flag.