Roo CTF 2025

hosted by University of Missouri-Kansas City, in person only placed 1st overall, beating out high school, university, and open; ts was peak

include

Given the URL https://include.cyberroos.org, find the flag. Navigating to the URL, we are greeted with a simple page that switches themes. We see that the theme is conveyed by a get parameter in the URL, between the themes light and dark. Opening up DevTools, we see that the X-Powered-By header is PHP/8.0.30, shining a light onto how we proceed. Attempting to set a non-existent theme (such as ?theme=flag) results in no styling at all. Examining the page source, we see that the style has a PHP error in it. ...

Paddington

Given the capture file chall.pcap, find the flag. The file was modified to hide it. Opening the capture in Wireshark, almost every packet is Modbus. Filtering with not modbus leaves a few TCP packets that appear unimportant. The packet contents include jumbled ASCII, and several packets are malformed. One field changes consistently: Register Value. Apply the register value as a column and sort by it. The values have the same shape as ASCII codes: for example, the common value 32 is a space. Extract all packets with register values using tshark: ...

split-screen

Provided with the split-screen executable, find the flag. Requirements: Ghidra and WSL on Windows. Run the executable (in WSL on Windows): $ chmod +x ./split-screen $ ./split-screen [timeline] expectation and reality drift apart. press enter to sync> you keep rewinding but nothing changes. try again later. Loading the executable into the Dogbolt decompiler shows several versions of the code. Hex-Rays is the clearest, including the program’s messages and its argument handling. ...