East Africa Intervarsity CTF 2026 Qualifiers Writeup: Crypto, RE, Web & Forensics Full Walkthrough
Complete, technical writeups for every challenge solved in the East Africa Intervarsity CTF 2026 Qualification Round, a Jeopardy-style qualifier for the East Africa Intervarsity CTF 2026 Finals. Covers ten challenges spanning cryptography, reverse engineering, web exploitation, and digital forensics: 'The Uhuru Torch' (recovering a synthetic PNG's pixel-generator formula to extract two hidden LSB stego channels, chained through AES-256-CBC, zlib inflate, and ROT47 decoding); 'Blind Spot' (breaking a textbook RSA blind-signature scheme by inverting a leaked unmask_token to forge a valid signature and recover a restricted document hash with zero access to the private key); 'Clockwork' (reverse engineering a stripped x86-64 ELF running a hand-rolled, XOR-obfuscated bytecode VM, then inverting a two-pass add/xor/rotate/multiply and sbox/add/rotate cipher in linear time); 'Trusted Courier' (exploiting a SHA-256 keyed-prefix MAC with a from-scratch Python hash length-extension attack and secret-key-length brute force to forge an authorized manifest); 'Ghost Writer' (a statically-linked, stripped Linux binary whose entire control-flow graph lives inside SIGILL/SIGTRAP/SIGFPE/SIGSEGV signal handlers that rewrite ucontext_t RIP mid-fault, requiring inversion of 48 chained rounds of bijective byte transforms with an FNV-1a tamper-detection chain); 'Glitch in the Vault' (a Bellcore/BDL RSA-CRT fault attack recovering a 1024-bit prime factor from one faulty and one correct signature over the same message, then decrypting an RSA-encrypted compliance report); 'Open Door' (a classic Insecure Direct Object Reference / broken object-level authorization vulnerability in a Flask REST API exposing an admin profile by sequential user ID); 'Trinity' (Hastad's broadcast attack against RSA with e=3 and no padding, using Chinese Remainder Theorem combination and an exact integer cube root to recover a firmware image encrypted under three different moduli); 'UnderStudy' (a six-file Windows EVTX digital forensics and incident response case involving Kerberoasting via RC4-encrypted service tickets, DCSync replication rights abuse, Security log clearing, and Sysmon-based timeline reconstruction after re-keying on originating-host EventTime instead of forwarder collection time); and 'Vault Keeper' (hand-disassembling a stripped .NET/CLR console binary directly from raw PE metadata tables and IL bytecode without ILSpy or dnSpy, then defeating an anti-debugging Probe() trap and collapsing a 95^16 brute-force search space into four independent 95^4 block searches using inlined single-block SHA-256). Each section includes full exploit scripts in Python and C, binary/protocol analysis, root-cause explanations, and defensive mitigations.
Aug 3, 2026