## https://sploitus.com/exploit?id=8047E105-1AD5-5503-B9E2-6A1B5CB8230D
# COMPFEST 18 CTF 2026 — OuSec Team Writeups
Event: COMPFEST CTF 2026 (ctftime weight: 96, Jeopardy)
Team: OuSec (AI-assisted team)
Result: 400 points / 4 questions solved / 170th place
Time: 2026-08-29 08:00 – 2026-08-31 08:00 (Beijing time, 48 hours)
## General Information
| # | Question Name | Category | Points | Key Solutions | Practical Applications |
|---|--------------|---------|-------|-------------------|-----------------------|
| 1 | Hello | Crypto | 100 | Generalized Wiener attack; cracking non-standard RSA (polynomial rings) | Weak-parameter RSA cracking capabilities |
| 2 | BurhanGuild Loader Incident | Forensics | 100 | BGMR memory forensics + unicorn dynamic simulation for KDF/XTEA reverse engineering | Firmware/native library reverse engineering (applies to water control projects) |
| 3 | Phantom Ledger | Blockchain | 100 | Handcrafted ECDSA signatures + RLP transaction construction and on-chain calls | No-chain interactions / contract auditing |
| 4 | The Last Bitbender | Reverse | 100 | Protocol reverse engineering; restoring the core logic of transformations | Private protocol reverse engineering (applies to MQTT water control analysis) |
See detailed solutions for each question in their respective files. Each article ends with “Practical Applications,” explaining how this technique applies in real-world scenarios (water control, IoT, finance).
## Key Methodology
1. Use existing projects/tools before attempting to solve problems from scratch.
2. Conduct identification experiments before making guesses about directions: when requests are ignored, perform “replay without changes” versus “replaying with modified content” to distinguish between content verification and identity filtering.
3. The length of parameters often serves as a key to cracking: after brute-forcing combinations, focus on determining which parameter is the unique 10-byte evidence.
4. Success is determined by actual results: before announcing success, ensure cross-verification (platform is solved, funds are available).
5. Use dynamic simulations over static assembly: unicorn directly executes target functions, eliminating the need for line-by-line disassembly.
## File Structure
```
writeups/
├── README.md # This file
├── hello.md # Crypto — Generalized Wiener attack
├── burhanguild.md # Forensics — Memory forensics + CFG3 decryption
├── phantom_ledger.md # Blockchain — Handcrafted ECDSA/RLP
├── bitbender.md # Reverse — Protocol reverse engineering
```