Challenge list
LinuxLevel 3★★★☆☆Linux-Race Condition. Exploiting a TOCTOU Gap for Root Files
A cleanup script that root runs periodically has a gap (TOCTOU) between checking and acting on a file. Try exploiting…
CryptographyLevel 3★★★☆☆Cryptanalysis - RSA Common Modulus Attack
Two systems reused the same RSA modulus n and only changed the public exponent. The ciphertexts c1 and c2 of the same…
CryptographyLevel 3★★★☆☆Cryptanalysis - Diffie-Hellman with a Small Prime
An old IoT device performed Diffie-Hellman key exchange with a prime p of only 36 bits. handshake.txt contains p, g, A…
LinuxLevel 4★★★★☆Linux-Kernel Module. Gaining Root via a Vulnerable Driver
This challenge analyzes a vulnerable character-device driver as a safe user-space simulation. No real kernel module is…
LinuxLevel 4★★★★☆Linux-Buffer Overflow. Exploiting a gets() Vulnerability
A vulnerable SUID C binary with protections disabled is provided. Exploit its buffer overflow to redirect control flow…
CryptographyLevel 4★★★★☆Cryptanalysis - DSA Nonce Reuse Key Recovery
/challenge/signatures.json, created with fresh keys at every start, holds the DSA public parameters (p of 1024 bits, q…
CryptographyLevel 4★★★★☆Cryptanalysis - Wiener's Attack on RSA
An embedded-device team made the RSA private exponent d very small to speed up decryption. The public exponent e in…
CryptographyLevel 4★★★★☆Cryptanalysis - Recovering an LCG's Hidden Parameters
A service generated both session tokens and an encryption keystream from a linear congruential generator x_{k+1} =…
LinuxLevel 5★★★★★Linux-eBPF Rootkit. Unmasking a Hidden Process
This challenge safely recreates eBPF-rootkit investigation as offline evidence analysis. Without loading eBPF, tell…
LinuxLevel 5★★★★★Linux-Kernel Exploit. Rewriting a Read-Only File with Dirty COW
This challenge models mmap, MAP_PRIVATE, and madvise—the ingredients used by Dirty COW (CVE-2016-5195)—as a safe,…
CryptographyLevel 5★★★★★Cryptanalysis - RSA e=3 Broadcast Attack
broadcast.json contains the same plaintext encrypted with unpadded RSA e=3 under three pairwise-coprime moduli.…