Python on Th3B0yWh0L1v3d — Security Writeups

Python on Th3B0yWh0L1v3d — Security Writeups https://th3b0ywh0l1v3d.github.io/tags/python/ Recent content in Python on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Tue, 16 Jun 2026 00:00:00 +0000 Amazing https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/amazing/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/amazing/ Reversing a Python marshal bytecode maze generator seeded by an LCG to find the escape path. Flip Dat Bit — TryHackMe https://th3b0ywh0l1v3d.github.io/thm/flip-dat-bit/ Tue, 09 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/thm/flip-dat-bit/ A TCP service hands you the AES-CBC ciphertext of your own input and asks you to return a ciphertext that decrypts to contain admin credentials — solved with a single-byte XOR flip. Fun With RSA — DalCTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/fun-with-rsa/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/fun-with-rsa/ A homemade RSA-CRT signer leaks a correct and a faulted signature of the same message; gcd(s − spz, n) factors n (the Bellcore attack), while the trivial shortcut just recovers the message via s^e mod n — and the XOR ‘protection’ undoes itself. someone said steg? — DalCTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/someone-said-steg/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/someone-said-steg/ A 16-frame APNG hides one flag character per frame in the top-left pixel of each frame’s decompressed scanline data; every standard stego avenue is a dead end, so decompressing all 16 fdAT/IDAT streams and reading byte 4 of each yields the flag. Spoiled Cheese Pull — DalCTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/forensics/spoiled-cheese-pull/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/forensics/spoiled-cheese-pull/ A ‘PNG’ that file() calls a broken JPEG is a PNG with a forged signature and vandalized chunk names; repairing the header reveals an rMQR (rectangular Micro QR) barcode that ZXing decodes to the flag. All's Fair in Love and CTFs — DalCTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/alls-fair/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/alls-fair/ The title ‘All’s Fair’ points at the Playfair cipher; the grid image is the standard 5×5 key square with even columns blanked, and the ciphertext decrypts to ANYTHINGFORTHEFLAG. Angry Shamir — DalCTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/angry-shamir/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/angry-shamir/ An RSA modulus that looks 2054-bit-strong is actually 67 × q — a tiny prime factor makes it trivially factorable (FactorDB / trial division), reconstructing the private key and decrypting the flag. Compression isn't encryption — DalCTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/compression-isnt-encryption/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/compression-isnt-encryption/ A 192-bit Huffman stream and a frequency table; the textbook min-heap decode looks perfect (wrapped in dalctf{}, zero leftover bits) yet is wrong — matching the encoder’s tie-break policy recovers the real flag. LCG Seed Squared — DalCTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/lcg-seed-squared/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/lcg-seed-squared/ A homemade LCG-as-cipher multiplies each flag byte by a deterministic state independent of the plaintext — the known DalCTF{ prefix recovers one state, and replaying the generator divides out the rest. The lost seed is a red herring. Playing with Pointers — DalCTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/playing-with-pointers/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/crypto/playing-with-pointers/ A C program squares each flag byte as a float, then a ‘forgotten’ Quake-style <em>(long</em>)&y type-pun prints the raw IEEE-754 bits as integers; reversing bits→float→sqrt→char recovers the flag. Simple Food Notifications — GPN CTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/simple-food-notifications/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/simple-food-notifications/ A Flask meal-notification SSRF whose is_global filter is defeated by abusing urllib3’s retry-driven DNS re-resolution — a global IP that hangs on port 80 (8.8.8.8) outlasts dnsmasq’s 2s cache, so the retry re-resolves to 127.0.0.1 and reaches the localhost-only /vip-meal. COMpetition — GPN CTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/crypto/competition/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/crypto/competition/ A commit-reveal rock-paper-scissors whose non-binding sha256(r1 + message + r2) commitment lets you open one hash to any winning move and sweep all 100 rounds. Double Fried — GPN CTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/double-fried/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/misc/double-fried/ A pcap leaks a flag one character per syslog packet in scrambled order, and sorting by each packet’s Message ID field reassembles the flag. Fancy Food Notifications — GPN CTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/fancy-food-notifications/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/fancy-food-notifications/ Chaining a weak RNG seed (258 possible HMAC keys), an SSRF token leak, a urlparse vs urllib3 parser differential, and a URL-userinfo Basic-auth override to forge a VIP JWT and reach /vip-meal as localhost. Königsberg Delivery Problem — GPN CTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/reversing/konigsberg-delivery-problem/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/reversing/konigsberg-delivery-problem/ Reversing a 250-state control-flow-flattened automaton whose success check requires visiting every state — i.e. finding a Hamiltonian path through the transition graph. Restaurant Builder — GPN CTF 2026 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/restaurant-builder/ Fri, 05 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/gpn-ctf-2026/web/restaurant-builder/ A FastAPI app builds Pydantic models from user-supplied field definitions, where each string value is eval()ed as a forward-reference annotation, yielding arbitrary code execution and flag exfiltration via the JSON schema.