## https://sploitus.com/exploit?id=9C3DCD25-11F0-5364-A618-E68153B9B0A3
# SkillBit July 2026 Flash CTF
[](https://compete.metactf.com/632/problems)
[](https://compete.metactf.com/632/problems)
---
Working directory for the competition. Six flags solved, spanning
forensics/network, crypto, pwn, misc, web, and forensics/rev. This file is
the high-level index - full technical writeups (with the complete
ATT&CK / Kill Chain / CWE / DREAD / CVSS / OWASP breakdown behind each
one-line summary below) live in `FLAGn/WRITEUP.md`.
## Scoring methodology
Every writeup in `FLAGn/WRITEUP.md` scores its finding against the same
frameworks, applied consistently across challenges. Where a framework
genuinely doesn't fit a challenge's type, that's stated explicitly in the
writeup (with the reason) rather than silently dropped:
- **[MITRE ATT&CK](https://attack.mitre.org/)** - enterprise tactics/techniques matrix. Maps *what an adversary does*: our own actions as attacker for FLAG1–5, or the malware's observed behavior for FLAG6 (framing called out explicitly there, since that challenge is DFIR, not exploitation).
- **[Lockheed Martin Cyber Kill Chain](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html)** - seven-stage intrusion model (Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives). Stages not observed for a given challenge are marked N/A with a reason, not omitted.
- **[CWE](https://cwe.mitre.org/)** - the underlying software/protocol weakness class, distinct from ATT&CK's adversary-behavior framing.
- **DREAD** - Damage, Reproducibility, Exploitability, Affected Users, Discoverability, each scored 1–10 and averaged. Rating bands used throughout: **8.0–10.0 Critical · 6.0–7.9 High · 4.0–5.9 Medium · 0–3.9 Low.** DREAD is a threat-modeling heuristic, scored independently of CVSS, the two intentionally weigh things differently (DREAD leans on ease-of-exploit/discoverability, CVSS leans on realized impact), so a finding landing in different tiers on each is expected, not an inconsistency.
- **CVSS v3.1** - standard vector + base score, computed by hand.
- **[OWASP Top 10:2025](https://owasp.org/www-project-top-ten/)** - only applies to the one web challenge (Dyno / FLAG5); omitted elsewhere rather than padded with N/A rows.
None of these are real assigned scores or tracked IDs, there's no CVE
behind any of them, since every target here is custom CTF challenge code
(or, for FLAG6, a training artifact standing in for DFIR evidence). They're
computed by hand purely to characterize each finding the way a professional
security assessment would.
## Flags at a glance
Split into three tables (identity, severity, threat mapping) so each stays
narrow enough to read without side-scrolling. All three share the same `#`
column, and full detail (full ATT&CK technique names, CWE rationale, Kill
Chain notes) lives in each `FLAGn/WRITEUP.md`.
**Identity**
| # | Challenge | Category | Flag | Writeup |
|---|---|---|---|---|
| 1 | NetBIOS hostnames |  | `SkillBit{n3tbi0s_dc0de_t0_w1n}` | [FLAG1/WRITEUP.md](FLAG1/WRITEUP.md) |
| 2 | babyecc |  | `SkillBit{R3u51ng_n0nc3_4nd_c0nn3ct1on?!?!}` | [FLAG2/WRITEUP.md](FLAG2/WRITEUP.md) |
| 3 | heaps-of-fun |  | `SkillBit{r3t2w1n_m0r3_l1k3_r3t2fun}` | [FLAG3/WRITEUP.md](FLAG3/WRITEUP.md) |
| 4 | EvilEval |  | `MetaCTF{S4f3_3v4l_1s_4_Mu5t_1337}` | [FLAG4/WRITEUP.md](FLAG4/WRITEUP.md) |
| 5 | Dyno |  | `MetaCTF{Dyn0_3xpl0it_C5P_t0_X55}` | [FLAG5/WRITEUP.md](FLAG5/WRITEUP.md) |
| 6 | karsten |  | `SkillBit{d232462e9efefa9ac017b211c3564989}` | [FLAG6/WRITEUP.md](FLAG6/WRITEUP.md) |
**Severity**
| # | CVSS v3.1 | DREAD | CWE |
|---|---|---|---|
| 1 |  |  | [CWE-200](https://cwe.mitre.org/data/definitions/200.html) |
| 2 |  |  | [CWE-338](https://cwe.mitre.org/data/definitions/338.html) |
| 3 |  |  | [CWE-862](https://cwe.mitre.org/data/definitions/862.html), [CWE-787](https://cwe.mitre.org/data/definitions/787.html) |
| 4 |  |  | [CWE-95](https://cwe.mitre.org/data/definitions/95.html), [CWE-693](https://cwe.mitre.org/data/definitions/693.html) |
| 5 |  |  | [CWE-915](https://cwe.mitre.org/data/definitions/915.html), [CWE-79](https://cwe.mitre.org/data/definitions/79.html), [CWE-639](https://cwe.mitre.org/data/definitions/639.html) |
| 6 |  |  | N/A* |
**Threat mapping**
| # | Kill Chain | ATT&CK TTPs | OWASP Top 10:2025 |
|---|---|---|---|
| 1 | Recon only | [T1018](https://attack.mitre.org/techniques/T1018/) | - |
| 2 | Recon→Weap→Exploit→AoO | [T1552.004](https://attack.mitre.org/techniques/T1552/004/), [T1110](https://attack.mitre.org/techniques/T1110/) | - |
| 3 | Recon→Weap→Deliv→Exploit→AoO | [T1190](https://attack.mitre.org/techniques/T1190/), [T1068](https://attack.mitre.org/techniques/T1068/) | - |
| 4 | Recon→Weap→Deliv→Exploit→AoO | [T1059.006](https://attack.mitre.org/techniques/T1059/006/), [T1110](https://attack.mitre.org/techniques/T1110/) | - |
| 5 | Recon→Weap→Deliv→Exploit→AoO | [T1190](https://attack.mitre.org/techniques/T1190/), [T1059.007](https://attack.mitre.org/techniques/T1059/007/), [T1539](https://attack.mitre.org/techniques/T1539/) | A01, A02, A05, A07 (2025) |
| 6 | Deliv→C2→AoO evidenced; rest inferred/out of scope | [T1027](https://attack.mitre.org/techniques/T1027/), [T1036.005](https://attack.mitre.org/techniques/T1036/005/), [T1573.001](https://attack.mitre.org/techniques/T1573/001/), [T1571](https://attack.mitre.org/techniques/T1571/), [T1041](https://attack.mitre.org/techniques/T1041/) | - |
\* karsten (#6) is a DFIR/malware-analysis exercise against an
already-compromised host rather than a vulnerability we exploited: CWE
catalogs weaknesses in legitimate software, not the malicious artifact
itself, and there's no CVSS-scorable vulnerability to cite. Its Kill Chain
and DREAD rows characterize the malware's own observed behavior/threat
instead, see the writeup for the full reasoning and the malware's ATT&CK
TTPs. OWASP Top 10:2025 mapping only applies to the one web challenge
(Dyno); "-" means not applicable to that challenge's category.
## Challenge summaries
**1. NetBIOS hostnames** (forensics/network) - Two RFC 1001
first-level-encoded NetBIOS names (`FLAG1/FlagBIOS.txt`). Decoded the
nibble-pair encoding back to ASCII, stripped NetBIOS's `0x00` padding,
concatenated both names for the flag. No exploit needed - see the writeup
for the decode method.
**2. babyecc** (crypto) - ECDSA server seeds Python's `random` (a Mersenne
Twister, not a CSPRNG) with `int(time.time())` and uses it for the signing
nonce. Brute-forced the ~1-minute seed window around connect time,
recomputed the nonce, solved for the private key from one signature, and
verified it against the published public key. `FLAG2/exploit.py`.
**3. heaps-of-fun** (pwn) - No-PIE, no-canary C++ binary. An unchecked
`atoi()` on a "New role" field lets any user self-promote to admin; the
resulting admin menu then reads an "audit note" into a stack buffer with no
bounds check. Smashed the saved return address to jump straight to a
`win()` gadget that prints `/flag`. `FLAG3/exploit.py`.
**4. EvilEval** (misc/pwn) - Not actually a sandbox escape: the server
`eval()`s filtered input and compares it to a fixed secret. The denylist
blocks digits and most keywords but not `len()` or string literals, so any
candidate integer is representable digit-free as `len('x'*N)`. Brute-forced
N=0..254 over the connection. `FLAG4/exploit_stdlib.py`.
**5. Dyno** (web) - `extract($_GET)`/`extract($_POST)` running after key
variables are already built lets attacker-controlled request params
overwrite (a) the page's CSP string and (b) a new profile's primary key.
Chained CSP neutering with a stored-XSS profile name to steal a review
bot's session cookie into an attacker-chosen profile, then read it back.
`FLAG5/exploit.py`.
**6. karsten** (forensics/rev) - Frozen memory dump + packet capture of a
workstation compromised by a trojanized "Chrome updater." Rebuilt the
malware's .NET PE module from the minidump's memory regions, disassembled
its ConfuserEx-obfuscated IL by hand (`dnfile`/`dncil`, no `dotnet`
available) to recover an exact hand-rolled 20-round Feistel cipher, then
decrypted the 48-byte C2 exfil payload pulled from the pcap using the
session key recovered from the still-resident config blob. `FLAG6/exploit.py`.
---
Scoring frameworks are computed by hand for characterization - see Scoring methodology above. No entries here are real CVE-tracked findings.