CubeCTF 2025 was an annual cybersecurity competition featuring challenges across Web Exploitation, Reverse Engineering, Cryptography, Forensics, and OSINT/Misc.
- Placement: 19th Place (RMIT Computing / RMITC - 2,997 pts)
- Team: Sadiq (
wallsdeep13) & Ibrahim (sleepyswords)
This writeup archive documents the vulnerability mechanisms, exploitation paths, and step-by-step methodologies used to solve each challenge during the competition.
Categories
- Web - Business logic bypass via negative quantity manipulation (Legal Snacks) and runtime prototype/attribute traversal leading to webhook exfiltration in Django-Unicorn (Todo).
- Misc - Visual reconnaissance and geolocation OSINT identifying the Oasis Cable Car Station in Santiago, Chile (Is this stego?).
- Rev - Exploiting an unfiltered standard error (stderr) stream in an assembly execution sandbox to leak environment variables (Gnisrever).
- Crypto - Decompiling an unpacked ELF binary to identify a time-seeded pseudo-random number generator (PRNG) and reconstructing the flag across network latency (Incantation).
- Forensics - Investigating an AccessData AD1 disk image to reverse a PyInstaller AES encryptor using Discord Snowflake IDs (Discord), and extracting a multi-stage backdoor binary from raw TCP packet captures (operator).