SHC 2026 on gk.wtf

swiss hacking challenge 2026 qualifier - bedrockbank

Fri, 01 May 2026 00:00:00 +0000

Difficulty

medium

Categories

rev

Description

Bedrock Bank & Trust is the most secure financial institution in all of Bedrock!

Their new stone-tablet vault app uses “pterodactyl-grade” account key protection.

Unfortunately Dino forgot his password 😭

Can you help recover it?

swiss hacking challenge 2026 qualifier - brachiosaurus

Fri, 01 May 2026 00:00:00 +0000

Difficulty

medium

Categories

web

Description

Gresslyosaurus, the local post officer has unfortunately lost access to the service managing the delivery of letters (the dino swears that he typed the password correctly, he tried it twice). Additionally, it seems that some messages have re-appeared! Please help him to sort this situation out and find the messages that still need to be delivered.

swiss hacking challenge 2026 qualifier - buffer-overflow-intro

Fri, 01 May 2026 00:00:00 +0000

Difficulty

baby

Categories

pwn

Description

This program asks for a password. There’s a variable called is_admin that needs to equal 0xdeadbeef to get the flag. The program uses gets(), which is vulnerable to buffer overflow.

Access: Connect to the binary with ncat --ssl [host] [port] or use pwntools.

swiss hacking challenge 2026 qualifier - canopysaurus

Fri, 01 May 2026 00:00:00 +0000

Difficulty

medium

Categories

pwn

Description

Something’s wrong with the brontosaurus powering Fred’s car. The Dino Control Unit (DCU) is acting up, and the mechanics at the Bedrock Motor Pool can’t figure it out. Can you find the reset code for the DCU and help Fred get back on the road?

Author

Kiwi

Attachments

canopysaurus.tar.gz

Service

Challenge has a remote instance.

LLM Usage

I used ChatGPT to guide me into the genral direction based on the source code. It helped me realize there was a UAF. The exploit was written by myself.

Solution

The server implements the CAN protocol. We can call different diagnostic trouble codes (DTCs):

swiss hacking challenge 2026 qualifier - connivance

Fri, 01 May 2026 00:00:00 +0000

Difficulty

hard

Categories

rev

Description

Bad guys like to obfuscate their code. This challenge implements a part of the DRM behind Tinfoil, a homebrew application that enables pirated games on the Nintendo Switch. Good luck!

Author

Yannik

Attachments

connivance.tar.gz

LLM Usage

I used ChatGPT to guess function signatures and structs. Also, the code for tracing of the compare opcode (at the end) was LLM-guided. Claude rewrote my python code for hash cracking in mulithreaded rust. No actual logic was adjusted.

Overview

We are given a bunch of files:

swiss hacking challenge 2026 qualifier - dino-configurator

Fri, 01 May 2026 00:00:00 +0000

Difficulty

easy

Categories

rev

Description

Feel like you have been transported back in time by looking at this lovely .NET WinForms application.

Note: This challenge only runs on windows.

Author

NoRelect

Attachments

dino-configurator.tar.gz

Solution

It’s a .NET reversing challenge.

swiss hacking challenge 2026 qualifier - dino-test-bank

Fri, 01 May 2026 00:00:00 +0000

Difficulty

easy

Categories

web

Description

Dino Bank has setup a test server so e-banking is going to be less painful when going prod!

Author

Tobias 'floyd' Ospelt

Service

Challenge has a remote instance.

Overview

The challenge initially presents us with a login page, which we can bypass by reading the source code:

swiss hacking challenge 2026 qualifier - dino-vault

Fri, 01 May 2026 00:00:00 +0000

Difficulty

easy

Categories

crypto

Description

Do you have a park with dinosaurs of your own? Then make sure back your dinos up regularly! You never know when the next mass extinction event will happen, so better safe than sorry. We encrypt all your dinosaur data so that you need not worry that anyone is able to copy your designs. Our encrypted designs are uploaded as well for anyone to verify that we use dinosaur-grade cryptography!

Author

Freakness109

Attachments

dino-vault.tar.gz

Service

Challenge has a remote instance.

LLM Usage

I used ChatGPT to generate a reverse 'to_dna' function.

Solution

We get an app.py implementing a dataclass for a dino (RSA variables were renamed from generic names from the handout version):

swiss hacking challenge 2026 qualifier - dinodata

Fri, 01 May 2026 00:00:00 +0000

Difficulty

medium

Categories

web

Description

DinOData gives developers instant access to rich, structured dinosaur data through a fast, modern interface. Build educational apps, research tools, or games with reliable prehistoric data at your fingertips.

Author

NoRelect

Service

Challenge has a remote instance.

Overview

The challenge serves a swagger UI allowing us to call a lot of different API methods:

swiss hacking challenge 2026 qualifier - fossildash

Fri, 01 May 2026 00:00:00 +0000

Difficulty

medium

Categories

web

Description

The Dinosaur Research Network just launched FossilDash, a collaborative platform where researchers share fossil discoveries. Access requires a valid researcher certificate.

Can you find a way to dig up the flag?

swiss hacking challenge 2026 qualifier - grafasaurus

Fri, 01 May 2026 00:00:00 +0000

Difficulty

medium

Categories

misc

Description

Visualizing trends in species, eras, and discoveries of dinosaurs? No better tool for the job than Grafana.

Author

NoRelect

Service

Challenge has a remote instance.

Solution

We get unauthenticated access to a grafana instance. There’s a swagger ui at /swagger and I wrote a script to brute force all paths methods as an unauthenticated user:

swiss hacking challenge 2026 qualifier - juraforum

Fri, 01 May 2026 00:00:00 +0000

Difficulty

hard

Categories

web

Description

The Swiss Jurassic Research Institute just launched JuraForum, an internal discussion board for paleontologists to share findings from the Jura mountains.

Can you dig up something they didn’t expect? RAWWWR!

Author

0x90

Attachments

juraforum.tar.gz

Service

Challenge has a remote instance.

Solution (unintended)

The challenge uses the markdown2 library, which had a CVE one week before the challenge was released. The challenge used a vulnerable version, so XSS was trivial:

swiss hacking challenge 2026 qualifier - lumon

Fri, 01 May 2026 00:00:00 +0000

Difficulty

medium

Categories

rev

Description

The work is mysterious and important.

socat file:$(tty),rawer tcp:$HOST $PORT

Author

fitfrost4

Attachments

lumon.tar.gz

Service

Challenge has a remote instance.

Overview

We have a very pretty TUI to “refine” numbers:

swiss hacking challenge 2026 qualifier - meow

Fri, 01 May 2026 00:00:00 +0000

Difficulty

leet

Categories

misc

Description

Like a powerful, dark storm, I will make my presence known to the world. Like a seeping mist, I will creep into the dogs’ center of power, and make them quake in fear at the very mention of my name!

swiss hacking challenge 2026 qualifier - password-checker

Fri, 01 May 2026 00:00:00 +0000

Difficulty

baby

Categories

rev

Description

This program asks for a password. If you enter the correct password, it grants you access. Figure out what password the program expects by looking at its code.

Author

xnull

Service

Challenge has a remote instance.

Solution

When using a disassembler (here r2ghidra), we can see the flag:

swiss hacking challenge 2026 qualifier - pcap-analysis

Fri, 01 May 2026 00:00:00 +0000

Difficulty

baby

Categories

misc

Description

We captured network traffic from a user logging into a website. The credentials were sent over unencrypted HTTP. Analyze the packet capture and extract the password.

Author

xnull

Service

Challenge has a remote instance.

Solution

We can use tshark to dump the HTTP traffic by following the stream:

swiss hacking challenge 2026 qualifier - plumberhub

Fri, 01 May 2026 00:00:00 +0000

Difficulty

medium

Categories

misc

Description

Got a leaky drain? Give us a call!

Connect using telnet $HOST $PORT flag is in $FLAG

Author

Popax21

Attachments

plumberhub.tar.gz

Service

Challenge has a remote instance.

Overview

The challenge consists of multiple rust files:

swiss hacking challenge 2026 qualifier - punkhash

Fri, 01 May 2026 00:00:00 +0000

Difficulty

medium

Categories

crypto

Description

Look at this punky hash I found. Can you crack it?

Author

berndoJ

Attachments

punkhash.tar.gz

LLM Usage

I used ChatGPT in the browser to get to the general idea of LLL and the CVP approach. The exploit was written by myself.

Solution

The challenge itself has a really small source code:

swiss hacking challenge 2026 qualifier - sql-injection-basics

Fri, 01 May 2026 00:00:00 +0000

Difficulty

baby

Categories

web

Description

You discovered a login page for a company database system. The credentials are unknown, but you need to gain access to retrieve sensitive information. Find a way to bypass the authentication and log in.

Author

xnull

Service

Challenge has a remote instance.

Solution

On the login page, we use the following credentials to get a login as admin:

swiss hacking challenge 2026 qualifier - stackosaurus

Fri, 01 May 2026 00:00:00 +0000

Difficulty

easy

Categories

pwn

Description

Jurassic Stack Park recently upgraded their containment management terminals. We managed to pull a copy of the binary off one of the kiosks near the T-Rex enclosure.

Author

0x90

Attachments

stackosaurus.tar.gz

Service

Challenge has a remote instance.

Overview

We’re dealing with a 32-bit binary:

swiss hacking challenge 2026 qualifier - stegosaurus

Fri, 01 May 2026 00:00:00 +0000

Difficulty

medium

Categories

misc

Description

In 1337 BC. the stegosaurus was known to write malware, infect company servers and extort them. Your task is to… AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA he’s here. I didn’t pay the ransom! Now he’s coming for my spaghetti

swiss hacking challenge 2026 qualifier - weak random

Fri, 01 May 2026 00:00:00 +0000

Difficulty

baby

Categories

crypto

Description

This authentication system generates a random token for access. The token is different each time you load the page. Can you predict what token the system will generate?

Author

xnull

Service

Challenge has a remote instance.

Scenario

We need to supply a 6-digit code and get the timestamp used for a seed.