ctf-misc
Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio puzzles, constraint solving, game theory, unusual sandbox escapes, and hyb...
Install this skill
or
0/100
Security score
The ctf-misc skill was audited on Sep 4, 2026 and we found 11 security issues across 6 threat categories, including 3 critical. Review the findings below before installing.
Categories Tested
Security Issues
critical line 257
Eval function call
SourceSKILL.md
| 255 | - **Taint analysis bypass via type coercion:** In custom ML-like languages with secrecy/taint systems, if-expression secrecy depends on return type not condition — coerce side-effecting functions to private type to leak private data through public mutable refs. See [games-and-vms-3.md](games-and-vms-3.md#taint-analysis-bypass-in-custom-language-via-type-coercion-plaidctf-2018). |
| 256 | - **Shredded document pixel-edge reassembly:** Encode each strip's left/right edge as binary bitmask (dark=1), use XOR + popcount Hamming distance to greedily place strips by minimum edge distance for sub-second reassembly. See [games-and-vms-3.md](games-and-vms-3.md#shredded-document-pixel-edge-reassembly-under-time-pressure-nuit-du-hack-ctf-2018). |
| 257 | - **f-string config injection via stored eval:** Store payload as config value, create key named `eval(stored_key)` — f-string rendering evaluates the key name expression, triggering RCE. See [pyjails.md](pyjails.md#python-f-string-config-injection-via-stored-eval-inshack-2018). |
| 258 | - **Hexadecimal Sudoku + QR assembly:** 4 QR codes encode 16x16 hex Sudoku quadrants; solve grid, read diagonal as hex pairs → ASCII flag. See [encodings-advanced.md](encodings-advanced.md#hexadecimal-sudoku--qr-assembly-bsidessf-2026). |
| 259 | - **Z3 boolean gate network SAT solving:** Product key validation as 250 boolean gates (AND/OR/XOR/NOT) over 125 input bits. Model each gate as Z3 constraint, require all outputs True, solve in milliseconds. See [games-and-vms.md](games-and-vms.md#z3-sat-solving-for-boolean-logic-gate-networks-bsidessf-2026). |
medium line 81
System command execution
SourceSKILL.md
| 79 | |
| 80 | # Python jail test |
| 81 | python3 -c "__import__('os').system('id')" |
| 82 | ``` |
| 83 |
high line 406
System command execution
SourceSKILL.md
| 404 | ## Backdoor Detection in Source Code |
| 405 | |
| 406 | **Pattern (Rear Hatch):** Hidden command prefix triggers `system()` call. |
| 407 | |
| 408 | **Common patterns:** |
high line 409
System command execution
SourceSKILL.md
| 407 | |
| 408 | **Common patterns:** |
| 409 | - `strncmp(input, "exec:", 5)` -> runs `system(input + 5)` |
| 410 | - Hex-encoded comparison strings: `\x65\x78\x65\x63\x3a` = "exec:" |
| 411 | - Hidden conditions in maintenance/admin functions |
high line 497
System command execution
SourceSKILL.md
| 495 | ## rvim Jail Escape via Python3 (BKP 2017) |
| 496 | |
| 497 | `rvim` blocks `:!` but `:python3 import os; os.system("cmd")` executes arbitrary commands. Check `:version` for `+python3`/`+lua`/`+ruby`. See [games-and-vms-3.md](games-and-vms-3.md#rvim-jail-escape-via-custom-vimrc-with-python3-execution-bkp-2017). |
| 498 |
low line 154
Command substitution pattern
SourceSKILL.md
| 152 | ### Nested Archive Script |
| 153 | ```bash |
| 154 | while f=$(ls *.tar* *.gz *.bz2 *.xz *.zip *.7z 2>/dev/null|head -1) && [ -n "$f" ]; do |
| 155 | 7z x -y "$f" && rm "$f" |
| 156 | done |
high line 299
Access to /etc/passwd
SourceSKILL.md
| 297 | ```bash |
| 298 | # GECOS field passwords |
| 299 | cat /etc/passwd # Check 5th colon-separated field |
| 300 | |
| 301 | # ACL permissions |
critical line 340
Instruction to extract credentials
SourceSKILL.md
| 338 | ## PostgreSQL RCE and File Read (Slonik HTB) |
| 339 | |
| 340 | `COPY (SELECT '') TO PROGRAM 'cmd'` executes OS commands as postgres. `pg_read_file('/path')` reads files. Extract credentials from `pg_basebackup` archives (`global/1260` = `pg_authid`). SSH tunnel to Unix sockets: `ssh -fNL 25432:/var/run/postgresql/.s.PGSQL.5432`. See [linux-privesc.md](linux-privesc.md#postgresql-copy-to-program-rce-slonik-htb). |
| 341 | |
| 342 | ## Backup Cronjob SUID Abuse (Slonik HTB) |
high line 410
Hex-encoded string sequence
SourceSKILL.md
| 408 | **Common patterns:** |
| 409 | - `strncmp(input, "exec:", 5)` -> runs `system(input + 5)` |
| 410 | - Hex-encoded comparison strings: `\x65\x78\x65\x63\x3a` = "exec:" |
| 411 | - Hidden conditions in maintenance/admin functions |
| 412 |
critical line 57
Jailbreak keyword
SourceSKILL.md
| 55 | - If the challenge is a real binary exploit instead of a jail, toy VM, or encoding problem, switch to `/ctf-pwn` or `/ctf-reverse`. |
| 56 | - If the input is mostly files, images, audio, or packet captures that need recovery work first, switch to `/ctf-forensics`. |
| 57 | - For ML/AI techniques (model attacks, adversarial examples, LLM jailbreaking), see `/ctf-ai-ml`. |
| 58 | - If the NodeJS sandbox uses **vm2** (`npm ls vm2`), check for **CVE-2023-37466** via `Promise[@@species]` with `nesting:true` — the exception handler escapes the context; see `ctf-web/js-sandbox` for the full exploit chain. In misc challenges with bundled JS, always run `npm ls vm2` to detect vulnerable vm2 before trying other escapes. |
| 59 |
medium line 326
Raw socket creation
SourceSKILL.md
| 324 | ``` |
| 325 | |
| 326 | **Key insight:** Docker group membership is equivalent to root access. The `docker` CLI socket (`/var/run/docker.sock`) allows creating privileged containers that mount the entire host filesystem. |
| 327 | |
| 328 | **Reference:** https://gtfobins.github.io/gtfobins/docker/ |
Scanned on Sep 4, 2026
View Security Dashboard