RowdyHacks XII

The 600-point forensics flagship: a 7-Zip reassembled from element symbols, a custom byte transform undone, a glyph panel read, and a spectrogram flag.

A 250-point network-forensics challenge: reassembling a split archive from six pieces scattered across HTTP responses and Base64-encoded DNS TXT records.

A 250-point forensics-into-reversing challenge: carving a ZIP from a PNG, then inverting a 46-byte checker's per-byte transform to recover the accepted code.

A 200-point layered-stego challenge: an EXIF hint led to a ZIP appended after a JPEG end marker, then a steghide payload behind a passphrase.

A 200-point network-forensics challenge: carving an HTTP-transferred PDF out of a packet capture to read the briefing that hid the flag among decoy traffic.

A 100-point forensics challenge where a file posing as a JPEG is really a PNG, hiding the flag in the least-significant bits of its RGB channels.

A 200-point ICS/OT challenge: toggling one Modbus coil enabled a holding-register output whose ASCII bytes spelled the flag, then restoring the coil.

A 150-point ICS/OT recon challenge: use nmap and Modbus port knowledge to pick the real OpenPLC from three decoys, then read its holding registers.

A 150-point ICS/OT challenge: read-only Modbus holding-register reads over the OT tunnel surfaced the overpressured tank value needed for the flag.

A 100-point ICS/OT challenge: an exposed SCADA-LTS HMI view returned the flag through a guest-accessible component that required no login.

A 100-point ICS/OT challenge: a SCADA-LTS dashboard left on the default administrator account exposed the flag in a data point's history.

A 50-point ICS/OT warm-up: recovering the well-known TCP port Modbus uses, confirmed against the local Nmap service registry rather than from memory.

A 300-point challenge chaining a hidden page, an SSH password found in RockYou, and a ZIP password also from RockYou to reach the flag.

A 250-point multi-stage challenge: a PNG with an appended WAV whose stereo-difference DTMF tones spelled the password to a final encrypted ZIP.

The one challenge on the board with no technical component: find and speak to the challenge author during the hackathon. Credited after the freeze.

A 25-point workshop warm-up: reading a check-in page's source to decode a Base64 flag from its JavaScript, past a decoy HTML comment.

A 250-point crypto challenge: a Vigenère letter revealed a key, a four-digit PIN fell to a tiny hash search, and its SHA-256 digest XOR-decrypted the flag.

A 250-point crypto challenge solved by GPU-cracking an AES-encrypted 7-Zip. Documents the known approach; the password and flag were not preserved.

A 200-point crypto challenge exploiting AES-CTR keystream reuse: a reset counter let one known plaintext recover the keystream and decrypt another.

A 350-point reversing challenge with a two-stage handshake: static analysis recovered the first transmission, a connection-specific transform the second.

A 250-point reversing challenge: reconstructing a JAR's hidden service command by reproducing its coin-reconciliation algorithm to derive the service code.

A 200-point reversing challenge: inverting a per-byte transform in a stripped x86-64 ELF to reconstruct the 24-byte passphrase it accepts.

A 300-point pwn challenge: a textbook ret2win stack overflow in a 32-bit binary with no canary and no PIE, returning into a win() that spawns a root shell.

A 250-point pwn challenge against a vulnerable Erlang/OTP SSH daemon allowing pre-authentication command execution, reading the flag through the tunnel.

A 300-point OSINT investigation: geolocating a lift bridge in New Orleans and pulling eight facts, down to a federal case number, from public records.

A 150-point OSINT challenge: identifying a fighter wing from its aircraft markings and resolving its home station to the decimal coordinates the checker wanted.

A 250-point web challenge and textbook BOLA: a skipped case ID exposed a classified case and its evidence through predictable, unauthorized API paths.

A 150-point web challenge: forum hints pointed at SQL injection in a login field, and a comment-terminator payload authenticated as staff.