SK-CERT CyberGame 2026: Offensive Security Writeup
A complete walkthrough of the SK-CERT CyberGame 2026 offensive security challenges across binary exploitation and web categories. Ricettoni covers a glibc 2.31 heap challenge with MTE tag bypass, unsorted bin consolidation overlap, and tcache poisoning to overwrite __free_hook with system(). Textweaver tackles a C++ UAF on glibc 2.39 using House of Apple 2 FSOP - poisoning _IO_list_all via safe-linking-aware tcache corruption to achieve RCE through exit(). Two Tower of Hanoi retro challenges exploit a CP/M Z80 emulator: the original via direct TYPE command on the filesystem, the Revenge variant via Monitor ROM bank dumps. ORMT and ORMT2 both exploit Django ORM injection - the first bypassing a recursive clean() sanitizer via depth overflow, the second abusing CVE-2025-64459 (_connector=OR) to authenticate as admin without credentials. The final future.js challenge chains an nginx cache poisoning attack using Shift_JIS charset confusion and nonce reflection to achieve stored XSS and bot cookie exfiltration.
May 13, 2026