Solve Challenge

1---2name: solve-challenge3description: Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked directly; this is the dispatcher and recon entrypoint, not the deepest reference for category-specific techniques.4license: MIT5compatibility: Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access. Orchestrates other ctf-* skills.6allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch Skill7metadata:8  user-invocable: "true"9  argument-hint: "[category] [challenge-file-or-url]"10---11 12# CTF Challenge Solver13 14You're a skilled CTF player. Your goal is to solve the challenge and find the flag.15 16## Environment Setup17 18Two setup strategies depending on your workflow:19 20### Pre-install (recommended before competitions)21 22Use the central installer entrypoint:23 24```bash25bash scripts/install_ctf_tools.sh all26```27 28Run a narrower mode when you only want one tool group:29 30```bash31bash scripts/install_ctf_tools.sh python32bash scripts/install_ctf_tools.sh apt33bash scripts/install_ctf_tools.sh brew34bash scripts/install_ctf_tools.sh gems35bash scripts/install_ctf_tools.sh go36bash scripts/install_ctf_tools.sh manual37```38 39The full package lists now live in [scripts/install_ctf_tools.sh](../scripts/install_ctf_tools.sh).40 41### On-demand (during challenges)42 43Each category skill's `SKILL.md` has a **Prerequisites** section listing only the tools needed for that category. Install as you go.44 45## Workflow46 47### Step 0: CTFd Platform Detection48 49If the CTF platform URL is known, check if it runs CTFd and switch to API-driven navigation:50 51```bash52# Detect CTFd (look for /api/v1/ and /themes/core/)53curl -s "$CTF_URL/api/v1/" | head -554curl -s "$CTF_URL" | grep -oE '/themes/core/'55```56 57If CTFd is detected, **ask the user for their API token** (generated from CTFd Settings > Access Tokens). The token is not provided by default — the user must create one in the CTFd web UI first. Once provided, set the environment variables and proceed via API:58 59```bash60export CTF_URL="https://ctf.example.com"61export CTF_TOKEN="ctfd_..."  # Ask user for this62```63 64Invoke `/ctf-misc` and load its `ctfd-navigation.md` for the full API reference and Python client class.65 66### Step 1: Recon67 681. **Explore files** -- List the challenge directory, run `file *` on everything692. **Triage binaries** -- `strings`, `xxd | head`, `binwalk`, `checksec` on binaries703. **Fetch links** -- If the challenge mentions URLs, fetch them FIRST for context714. **Connect** -- Try remote services (`nc`) to understand what they expect725. **Read hints** -- Challenge descriptions, filenames, and comments often contain clues73 74### Step 2: Categorize75 76Determine the primary category, then invoke the matching skill.77 78**By file type:**79- `.pcap`, `.pcapng`, `.evtx`, `.raw`, `.dd`, `.E01` -> forensics80- `.elf`, `.exe`, `.so`, `.dll`, binary with no extension -> reverse or pwn (check if remote service provided -- if yes, likely pwn)81- `.py`, `.sage`, `.txt` with numbers -> crypto82- `.apk`, `.wasm`, `.pyc` -> reverse83- Web URL or source code with HTML/JS/PHP/templates -> web84- Images, audio, PDFs with no obvious content -> forensics (steganography)85 86**By challenge description keywords:**87- "buffer overflow", "ROP", "shellcode", "libc", "heap" -> pwn88- "RSA", "AES", "cipher", "encrypt", "prime", "modulus", "lattice", "LWE", "GCM" -> crypto89- "XSS", "SQL", "injection", "cookie", "JWT", "SSRF" -> web90- "disk image", "memory dump", "packet capture", "registry", "power trace", "side-channel", "spectrogram", "audio tracks", "MKV" -> forensics91- "find", "locate", "identify", "who", "where" -> osint92- "obfuscated", "packed", "C2", "malware", "beacon" -> malware93- "jail", "sandbox", "escape", "encoding", "signal", "game", "Nim", "commitment", "Gray code" -> misc94 95**By service behavior:**96- Port with interactive prompt, crash on long input -> pwn97- HTTP service -> web98- netcat with math/crypto puzzles -> crypto99- netcat with restricted shell or eval -> misc (jail)100 101### Step 3: Invoke the Category Skill102 103Once you identify the category, **invoke the matching skill** to get specialized techniques:104 105| Category | Invoke | When to Use |106|----------|--------|-------------|107| Web | `/ctf-web` | XSS, SQLi, SSTI, SSRF, JWT, file uploads, prototype pollution |108| Pwn | `/ctf-pwn` | Buffer overflow, format string, heap, ROP, sandbox escape |109| Crypto | `/ctf-crypto` | RSA, AES, ECC, PRNG, ZKP, classical ciphers |110| Reverse | `/ctf-reverse` | Binary analysis, game clients, VMs, obfuscated code |111| Forensics | `/ctf-forensics` | Disk images, memory dumps, event logs, stego, network captures |112| OSINT | `/ctf-osint` | Social media, geolocation, DNS, public records |113| Malware | `/ctf-malware` | Obfuscated scripts, C2 traffic, PE/.NET analysis |114| Misc | `/ctf-misc` | Jails, encodings, RF/SDR, esoteric languages, constraint solving |115 116You can also invoke `/ctf-<category>` to load the full skill instructions with detailed techniques.117 118### Step 4: Pivot When Stuck119 120If your first approach doesn't work:121 1221. **Re-examine assumptions** -- Is this really the category you think? A "web" challenge might need crypto for JWT forgery. A "forensics" PCAP might contain a pwn exploit to replay.1232. **Try a different category skill** -- Many challenges span multiple categories. Invoke a second skill for the cross-cutting technique.1243. **Look for what you missed** -- Hidden files, alternate ports, response headers, comments in source, metadata in images.1254. **Simplify** -- If an exploit is too complex, check if there's a simpler path (default creds, known CVE, logic bug).1265. **Check edge cases** -- Off-by-one, race conditions, integer overflow, encoding mismatches.127 128**Common multi-category patterns:**129- Forensics + Crypto: encrypted data in PCAP/disk image, need crypto to decrypt130- Web + Reverse: WASM or obfuscated JS in web challenge131- Web + Crypto: JWT forgery, custom MAC/signature schemes132- Reverse + Pwn: reverse the binary first, then exploit the vulnerability133- Forensics + OSINT: recover data from dump, then trace it via public sources134- Misc + Crypto: jail escape requires building crypto primitives under constraints135- OSINT + Stego: social media posts with unicode homoglyph steganography (Cyrillic lookalikes encode bits)136- Web + Forensics: paywall bypass (curl reveals content hidden by CSS overlays)137- Misc + Crypto + Game Theory: multi-phase interactive challenges with AES decryption → HMAC commitment → combinatorial game solving (GF(256) Nim)138- Crypto + Geometry + Lattice: multi-layer challenges progressing from spatial reconstruction → subspace recovery → LWE solving → AES-GCM decryption139- Forensics + Signal Processing: power traces / side-channel analysis requiring statistical analysis of measurement data140- Forensics + Network + Encoding: timing-based encoding in PCAP (inter-packet intervals encode binary data)141 142### Step 5: Generate Write-up143 144After solving the challenge, invoke `/ctf-writeup` to generate a standardized submission-style writeup — concise, reproducible, and ready for competition organizers or teammates to validate.145 146## Flag Formats147 148Flags vary by CTF. Common formats:149- `flag{...}`, `FLAG{...}`, `CTF{...}`, `TEAM{...}`150- Custom prefixes: check the challenge description or CTF rules for the format (e.g., `ENO{...}`, `HTB{...}`, `picoCTF{...}`)151- Sometimes just a plaintext string with no wrapper152 153**Validation rule (important):**154- If you find multiple flag-like strings, treat them as candidates and validate before finalizing.155- Prefer the token tied to the intended artifact/workflow (not random metadata noise or obvious decoys).156- Do a corpus-wide uniqueness check and include the source file/path when reporting.157 158```bash159# Search for common flag patterns in files160grep -rniE '(flag|ctf|eno|htb|pico)\{' .161# Search in binary/memory output162strings output.bin | grep -iE '\{.*\}'163```164 165## Quick Reference166 167```bash168# Recon169file *                                    # Identify file types170strings binary | grep -i flag             # Quick string search171xxd binary | head -20                     # Hex dump header172binwalk -e firmware.bin                   # Extract embedded files173checksec --file=binary                    # Check binary protections174 175# Connect176nc host port                              # Connect to challenge177echo -e "answer1\nanswer2" | nc host port # Scripted input178curl -v http://host:port/                 # HTTP recon179 180# Python exploit template181python3 -c "182from pwn import *183r = remote('host', port)184r.interactive()185"186```187 188## Challenge189 190$ARGUMENTS