CyCTF-Luxor on z3r0s

Pwn - cyKer

Sun, 10 May 2026 22:54:00 +0300

cyKer — Kernel Exploitation Writeup Link to heading

Category: Pwn / Kernel Flag: CyCTF{3c03ee481e3c39c175d1a8baed7f9bbe}

Overview Link to heading

We are given a QEMU-based kernel challenge containing:

bzImage — Linux 5.4.0 kernel
initramfs.cpio.gz — root filesystem with a vulnerable kernel module hackme.ko
run.sh — QEMU launch script with all mitigations disabled:
```
nokaslr nosmep nosmap mitigations=off
```

The VM boots, loads hackme.ko, then drops us into a shell as uid 1000. The flag at /flag is owned by root with chmod 600.

misc,CyCTF-Luxor - sonnet-jail

Sun, 10 May 2026 00:00:00 +0000

Sonnet Jail - Writeup Link to heading

Challenge Link to heading

Name: Sonnet Jail
Category: Misc / PyJail
Description: "I told Sonnet create me a creative pyjail even you can't solve, does it make the job?"
Goal: Read ./flag.txt

Reconnaissance Link to heading

Connecting to the service presents a Python REPL with several restrictions:

>>> print(1+1)
2
>>> print(open("flag.txt").read())
[blocked] no dots
>>> print(open("flag" + chr(46) + "txt"))
[blocked] 'open' is blocked

Blocked keywords Link to heading

Keyword	Message
`.` (dot character)	`no dots`
`open`	`'open' is blocked`
`eval`	`'eval' is blocked`
`exec`	`'exec' is blocked`
`dir`	`'dir' is blocked`
`getattr`	`'getattr' is blocked`
`hasattr` / `setattr` / `delattr`	blocked
`__builtins__`	blocked
`__import__`	blocked
`globals`	blocked
`breakpoint`	blocked
`compile`	blocked
`input`	blocked
`__subclasses__`	`blocked string`
`__init__`	`blocked string`
`flag`	`blocked string`

Allowed builtins Link to heading

print, type, chr, isinstance, vars, list, map, filter, zip, object, bytes, int, str, range, enumerate, len, tuple, set, dict, frozenset, hex, oct, ord, bin, abs, round, sorted, reversed, min, max, sum, any, all, bool, float, complex, super, staticmethod, classmethod, property, slice, memoryview, bytearray

pwn - bil

Sun, 10 May 2026 00:00:00 +0000

bil - PWN Writeup Link to heading

Challenge Info Link to heading

Name: bil
Category: PWN
Remote: 0.cloud.chals.io:18850

Files Provided Link to heading

app - ELF 64-bit binary
libc.so.6 - GLIBC 2.36
ld-linux-x86-64.so.2 - dynamic linker
flag - placeholder flag

Binary Analysis Link to heading

Checksec Link to heading

Protection	Status
RELRO	Full RELRO
Stack Canary	No
NX	Enabled
PIE	Disabled

Key Functions Link to heading

vuln() @ 0x4011c6

Web - NextBlog

Sun, 10 May 2026 00:00:00 +0000

NextBlog - CTF Writeup Link to heading

Challenge Info Link to heading

Name: NextBlog
URL: https://cyctf-luxor-cbaff7649acb-nextblog-0-0.chals.io
Category: Web
Flag: CyCTF{F7oXj5sHY4xfvfrIo2x2pkbr4eIVEW3DoYSQe1WHsx_iffn39-InchEsJKhkGtnfg8VA60x6WfCvKRQjmHzftiAxx1TvnXF8FA}

Overview Link to heading

A Next.js 16 blog application with a hidden flag server running on localhost:3001. The goal is to exploit a Server-Side Request Forgery (SSRF) vulnerability in a server action to reach the internal flag server.