EHAX CTF 2026

Tue, 03 Mar 2026 00:00:00 +0000

let-the-penguin-live

Analysis

Exiftool

ExifTool Version Number         : 13.36
File Name                       : challenge.mkv
Directory                       : .
File Size                       : 8.1 MB
File Modification Date/Time     : 2026:02:27 13:38:54-05:00
File Access Date/Time           : 2026:03:03 04:20:50-05:00
File Inode Change Date/Time     : 2026:02:27 14:09:14-05:00
File Permissions                : -rw-rw-r--
File Type                       : MKV
File Type Extension             : mkv
MIME Type                       : video/x-matroska
EBML Version                    : 1
EBML Read Version               : 1
Doc Type                        : matroska
Doc Type Version                : 4
Doc Type Read Version           : 2
Timecode Scale                  : 1 ms
Title                           : Penguin
                <SNIP>
Codec ID                        : A_FLAC
Track Type                      : Audio
Audio Channels                  : 2
                <SNIP>
Compatible Brands               : isomiso2avc1mp41
Comment                         : EH4X{k33p_try1ng}
                <SNIP>

we have a Comment EH4X{k33p_try1ng} and 2 audio channels.

Pascal CTF

Tue, 03 Feb 2026 00:00:00 +0000

Web Challenges

JSHit

This was a straightforward challenge that included a JSFuck language. Just needed to decode the text.

Used dcode.fr to decode the text and get the flag:

ZazaStore

This was an online marketplace. An interesting thing was that there was a FakeZa product which gave a fake flag, it hinted me that the real flag was RealZa product.

Code Analysis:

.
├── challenge.zip
└── src
    ├── app
    │   ├── package.json
    │   ├── package-lock.json
    │   ├── public
    │   │   ├── images
    │   │   │   ├── CartoonZa.png
    │   │   │   ├── ElectricZa.jpeg
    │   │   │   ├── FakeZa.jpeg
    │   │   │   ├── RealZa.jpeg
    │   │   │   └── ZazaIsBad.png
    │   │   └── style
    │   │       └── style.css
    │   ├── server.js
    │   └── views
    │       ├── cart.ejs
    │       ├── index.ejs
    │       ├── inventory.ejs
    │       └── login.ejs
    ├── docker-compose.yml
    └── Dockerfile

The /add-cart function didnot validate the product so i noticed the logic flaw. Firstly i tried to exploit a logic flaw in how JavaScript handles NaN (Not-a-Number) during comparisons. The prices object only contains specific keys (FakeZa, ElectricZa, etc.). The /add-cart route does not check if the product we are adding is actually a valid item in the store.