Roo CTF 2025 on tuxops

Mon, 01 Jan 0001 00:00:00 +0000

`Roo CTF 2025: Include (tuxops)`

title: “include” date: “2025-10-25” author: “TechnoDot (technodot)” description: “imported”

`TechnoDot, mrnullone`

Given the URL https://include.cyberroos.org, find the flag.

Navigating to the URL, we are greeted with a simple page that switches themes. We see that the theme is conveyed by a get parameter in the URL, between the themes light and dark. Opening up DevTools, we see that the X-Powered-By header is PHP/8.0.30, shining a light onto how we proceed. Attempting to set a non-existent theme (such as ?theme=flag) results in no styling at all. Examining the page source, we see that the style has a PHP error in it.

Mon, 01 Jan 0001 00:00:00 +0000

`Roo CTF 2025: Paddington (tuxops)`

title: “Paddington” date: “2025-10-25” author: “TechnoDot (technodot)” description: ""

`mrnullone, TechnoDot`

Given the capture file chall.pcap, find the flag. chall.pcap was modified to hide the flag.

Opening the file, we see that almost every packet is the Modbus protocol. Putting not modbus into the filter bar yields a few TCP packets, which seem unimportant. Looking through the packets, we notice that in the ascii contents section, there are some jumbled ascii characters as well. There seems to be no rhyme nor reason to these characters, and it can reasonably be inferred that we’ll have to do deeper digging. There’s also a lot of malformed packets, but I can’t seem to make anything of them. Sorting through packets, one value that seems to change consistently is the Register Value.

Mon, 01 Jan 0001 00:00:00 +0000

`Roo CTF 2025: Split-Screen (tuxops)`

title: “split-screen” date: “2025-10-25” author: “TechnoDot (technodot)” description: ""

`TechnoDot (https://github.com/TechDudie)`

Provided with the split-screen executable, find the flag.

REQUIREMENTS: Ghidra, WSL (for Windows); we don’t talk about Mac

Try running the executable. On Windows, run it in WSL.

┏━(Message from Kali developers) ┃ ┃ This is a minimal installation of Kali Linux, you likely ┃ want to install supplementary tools. Learn how: ┃ ⇒ https://www.kali.org/docs/troubleshooting/common-minimum-setup/ ┃ ┗━(Run: “touch ~/.hushlogin” to hide this message) (base) ┌──(technodot㉿VIVOBOOK)-[~] └─$ cd /mnt/c/Users/technodot/Downloads/ (base) ┌──(technodot㉿VIVOBOOK)-[/mnt/c/Users/technodot/Downloads] └─$ chmod +x ./split-screen (base) ┌──(technodot㉿VIVOBOOK)-[/mnt/c/Users/technodot/Downloads] └─$ ./split-screen [timeline] expectation and reality drift apart. press enter to sync> you keep rewinding but nothing changes. try again later. (base) ┌──(technodot㉿VIVOBOOK)-[/mnt/c/Users/technodot/Downloads] └─$

Loading the executable into the dogbolt decompiler, we can see different decompilations to varying detail. Hex-Rays offers the clearest code, with all of the print statements verbatim in the code.