BOUZELIFA Mohammed Amine

Flag ITC{l4y3rs_m4k3_m3_h3ll4_d1zzy!} Solve the player is given the powertrip.png image, if they close enough they can see greyscale black / grey stripes at the top right corner, those are ascii characters, running zsteg or a simple python script to decode gives the link: https://files.catbox.moe/r9c5sc.wav the link allows to download a wav audio file, listening to it the player identifies that it’s sstv using any sstv decoding tool gives an image with a “fake flag” ...

spirit — Minecraft PCAP forensics CTF i made this challenge for the ITC CTF 2026. Flag ITC{ANTI_ENS_LIVES_ON!} (case insensitive ig) Capture protocol 772, offline-mode (online-mode=false), login name vanir flag = block geometry, NOT text. 208 Use Item On (0x3f) packets, client->server placed blocks at y=70, band z=-253..-249, X 96..199 art reads ROTATED 180 from map orientation (north-up/east-right shows it inverted) s2c stream has 24 capture gaps (~37KB) — Block Update path unreliable, use c2s c2s stream frames 100% cleanly — this is the intended solve Decoys (intentionally greppable) ITC{never_easy} (sign) ITC{fake_flag} (sign) base64 SVRDe3N0b3BfZ3JlcHBpbmdfYnVkZHl9 -> ITC{stop_grepping_buddy} (book) real flag must NOT appear in strings — verified Solve the player is given a pcap of traffic generated by a player client to a minecraft server (ran on my vps) description: ...

NIT Breach 2 — Memory Forensics Writeup category: forensics / memory Analysis Tooling: Volatility 3 Image: nit_breach_2.raw (Ubuntu Linux memory dump) Flag: nmctf{num1d14n_m3m0ry_s3cr3t_7c2b8a} first instincts I ran strings on the image, grepped for “nmctf{” but found nothing, afterwards i ran strings and grepped for “classified_secrets” strings -t d nit_breach_2.raw | grep -iE "classified_secrets" got: 321038056 ./nit_numidian_db/classified_secrets next thing i did was regex scan for “classified_secrets” python3 vol.py -f nit_breach_2.raw linux.vmaregexscan.VmaRegExScan --pattern "classified_secrets" 3105 mariadbd 0x791e544ec4ac classified_secrets 63 6c 61 73 73 69 66 69 65 64 5f 73 65 63 72 65 74 73 aha! the process is mariadbd, with PID 3105 now we know wassup, we start our digging. Step 1 — Find the MariaDB process (PsList) python3 vol.py -f nit_breach_2.raw linux.pslist.PsList | grep -iE "maria|mysql" 0x8b10029f5200 3105 3105 1 mariadbd ... 2026-06-18 17:50:00 UTC Disabled made sure mariadb is running as: mariadbd, PID 3105. ...