## https://sploitus.com/exploit?id=386431BB-4A0C-5DD3-A52A-F2DDCD06E9B2
# Kaspersky CTF 2026
Solutions, exploits, and writeups for the challenges our team solved at **Kaspersky CTF 2026**.
- **Event:** Kaspersky CTF 2026 (Jeopardy)
- **Dates:** 29 August 2026 12:00 UTC – 30 August 2026 12:00 UTC
- **Author:** [`hax1ng`](https://github.com/hax1ng)
- **Flag format:** `kaspersky{...}`
- **Solved:** 16 challenges across AI, Forensics, Misc, Pwn, and Web
Each challenge lives in `//` with a self-contained `README.md`
writeup and the final solve scripts / exploits. Large binaries, disk images, packet
captures, virtual environments, and other bulky or sensitive artifacts have been
intentionally left out — the writeups explain how to reproduce everything from the
original challenge files.
---
## Solved Challenges
### AI
| Challenge | Points | Summary | Writeup |
|---|---|---|---|
| cold dih | 258 | Codec-robust adversarial audio that fools three judge models at once | [writeup](ai/cold-dih/) |
### Forensics
| Challenge | Points | Summary | Writeup |
|---|---|---|---|
| Ping Pong Show | 269 | RAM dump → Havoc Demon → recover `CryptProtectMemory` key → reverse a UDP Ping Pong protocol and beat the bot | [writeup](forensics/ping-pong-show/) |
| Ryan Guzling | 365 | Rebuild a macOS FileVault Fusion Drive to reach a nested sparsebundle holding the flag | [writeup](forensics/ryan-guzling/) |
### Misc
| Challenge | Points | Summary | Writeup |
|---|---|---|---|
| Good Pineapple | 353 | Moving random-dot autostereogram hides *Bad Apple*; a single frame spells the flag | [writeup](misc/good-pineapple/) |
| KNotes | 429 | `pull_request_target` CI/CD abuse leaks an admin token via a poisoned `uv sync` | [writeup](misc/knotes/) |
### Pwn
| Challenge | Points | Summary | Writeup |
|---|---|---|---|
| RUSTyapa | 500 | Rust release-compiler miscompilation (`rust-lang/rust#155241`) → UAF, tcache poison, ROP shell | [writeup](pwn/rustyapa/) |
| SunHua Gate | 500 | C++ circular-vector `bad_alloc` leaves a size/backing mismatch → OOB R/W → ROP to shell | [writeup](pwn/sunhua-gate/) |
| One Last Babuin | 289 | Interpreter TOCTOU type-confusion escalated to a ROP flag read | [writeup](pwn/one-last-babuin/) |
| toffifee | 285 | zkVM reversing: a guest counter aliased by a circuit wire breaks soundness | [writeup](pwn/toffifee/) |
| slopgate | — | QEMU custom-PCI-device DMA-to-BAR MMIO reentrancy UAF → host escape | [writeup](pwn/slopgate/) |
### Web
| Challenge | Points | Summary | Writeup |
|---|---|---|---|
| Cloud Storage | 500 | gRPC billing state-leak chained with a ZODB config-injection RCE | [writeup](web/cloud-storage/) |
| Document Flow Optimizer | 500 | iframe path-traversal + NUL truncation writes a PNG/shell polyglot into a healthcheck | [writeup](web/document-flow-optimizer/) |
| Canary | 330 | DNS-rebinding / Local-Network-Access bypass steals EC2 IMDSv2 credentials | [writeup](web/canary/) |
| Kube Adventure | 318 | Seven-stage Kubernetes privilege-escalation chain starting from a Flagger webhook RCE | [writeup](web/kube-adventure/) |
| Skudik for Studik | 289 | Unsigned JWT + SQLi leading to a snapshot-bypassed command-injection RCE | [writeup](web/skudik-for-studik/) |
| Garden | — | `cshogi` drop-move parser mismatch smuggles SQLi past move validation | [writeup](web/garden/) |
---
## Notable Solves
- **Ping Pong Show** — a full malware-forensics chain (Outlook attachment → RC4/LZNT1 loader → PoolParty injection → Havoc Demon → CNG key recovery) that ends, absurdly, with writing a bot to *win a networked Ping Pong game* for the flag.
- **RUSTyapa** and **SunHua Gate** — both hinge on a *compiler/runtime* quirk rather than obvious source bugs: a real Rust miscompilation and a `std::bad_alloc` that silently desynchronizes a container's size from its backing store.
- **Kube Adventure** — a realistic seven-stage cluster-internal privilege-escalation chain (webhook RCE → kube-state-metrics recon → registry pull → Service `externalIPs` traffic hijack → Redis creds → node takeover).
- **cold dih** — an adversarial-audio challenge where the payload had to survive lossy codec re-encoding *and* satisfy three separate judge models simultaneously.
## Repository Layout
```
//
├── README.md # the writeup
├── solve.py # final exploit / solver (name varies)
└── ... # small, essential source or artifacts
```
## Disclaimer
All material here targets intentionally vulnerable challenges built for the Kaspersky
CTF 2026 competition, published for educational purposes. Internal/ephemeral
infrastructure details (per-instance hosts, tokens, credentials) have been redacted;
any private-range IP addresses that remain are challenge-internal and non-routable,
kept only where they are needed to follow the writeup.