business-ctf-2025 - Official Writeups for HackTheBox Business CTF 2025

项目说明

<p align='center'>
<img src='assets/banner.png' alt="HTB">
</p>

Challenges

| Category | Name | Objective | Difficulty [⭐⭐⭐⭐⭐] |
| - | - | - | - |
| Pwn | Power Greed | Create a rop-chain through the gadgets of a statically linked binary to call execve("/bin/sh", 0, 0). | ⭐ |
| Pwn | LiteServe | Chained Buffer O & Format string attack | ⭐⭐ |
| Pwn | Null Assembler | Off-by-null to RCE | ⭐⭐ |
| Pwn | Cyber Bankrupt | Trigger tcache double free and show heap base. Get a chunk which is o by using tcache poisoning. Leak libc address. Get a chunk which is o __free_hook and o __free_hook to one gadget rce. | ⭐⭐⭐ |
| Pwn | NeonCGI | .bss buffer o | ⭐⭐⭐⭐ |
| Re | Industry Secret | ARM UART backdoor rev | ⭐⭐ |
| Re | Scrambled Payload | deobfuscation | ⭐⭐ |
| Re | TinyPlatformer | pyinstaller re | ⭐⭐ |
| Re | E | re backdoor in FOSS software | ⭐⭐⭐ |
| Re | ShadowLabyrinth | C++ | ⭐⭐⭐⭐ |
| Web | Blackout Ops | Bypassing multipart form & XSS via SVG | ⭐⭐ |
| Web | Forums | chaining Self XSS with Session Fixation via CRLF injection for account takeover. | ⭐⭐ |
| Web | QuickBlog | Abuse stored XSS on a custom client-side markdown parser -> exfiltrate session cookie via DNS -> upload file to arbitrary path via path tra -> trigger RCE on CherryPy session files pickle. | ⭐⭐⭐ |
| Web | no | Traefik API authentication bypass => memory o on custom keystore implementation => cache poisoning => dom clobbering => client side path tra => prototype pollution => unsafe eval call => CSP bypass => cookie exfiltration feature => unrestricted file upload via path tra => RCE via TAR/ELF polyglot file | ⭐⭐⭐⭐ |
| Crypto | Transcoded | Decode the flag with custom base64-based encoding scheme | ⭐ |
| Crypto | Hidden Handshake | AES-CTR keystream reuse | ⭐⭐ |
| Crypto | Phoenix Zero Trust | Mersenne Twister randcrack | ⭐⭐ |
| Crypto | Early Bird | Manger's Timing Attack | ⭐⭐⭐ |
| Crypto | Cur | Custom ECDSA-like signature scheme with leaked nonce bits | ⭐⭐⭐⭐ |
| Forensics | Phantom Check | detection techniques used by attackers. | ⭐ |
| Forensics | Smoke & Mirrors | Analyze the provided event logs and forensic artifacts to uncover how the attacker disabled or altered security features. | ⭐ |
| Forensics | Ghost Thread | Post-breach attack where malicious code injected into a legitimate process. | ⭐⭐ |
| Forensics | The Nexus Breach | PCAP file analysis containing network traffic related to an attack that targets a Nexus OSS instance. | ⭐⭐⭐ |
| Forensics | Driver's Shadow | Identification and analysis of a memory only rootkit, loaded by a malicious ude rule. | ⭐⭐⭐⭐ |
| Hardware | Echos Of Authority | Extract DTMF tones from a VOIP packet capture | ⭐⭐ |
| Hardware | Whisper | Extract PDU-formatted SMS from USB traffic | ⭐⭐ |
| Hardware | Sky Recon | Exploiting MAVLink protocol | ⭐⭐⭐ |
| Hardware | Motors | Smart car protocol exploitation | ⭐⭐⭐ |
| Hardware | PhantomGate | Reverse engineering firmware and cryptographic primitives | ⭐⭐⭐⭐ |
| Blockchain | Enlistment | Compute an expected proof hash | ⭐ |
| Blockchain | Spectral | Exploit incorrect reentrancy guards | ⭐⭐ |
| Blockchain | Blockout | TODO | ⭐⭐⭐ |
| ICS | Whispers | Extracting Wireshark TCP streams | ⭐ |
| ICS | Floody | Understanding OPC UA protocol basics | ⭐⭐ |
| ICS | Heat Plan | Manipulating PLC data | ⭐⭐ |
| ICS | Gridcryp | Manipulating ICS with encryption | ⭐⭐⭐ |
| AI/ML | External Affairs | prompt injection to manipulate AI response | ⭐⭐ |
| AI/ML | Loyalty Survey | Agentic AI Hijacking with prompt injection | ⭐⭐ |
| AI/ML | TrynaSob Ransomware | prompt injection to leak prompt instructions | ⭐⭐ |
| AI/ML | Doctrine Studio | prompt injection and Agentic AI tool misuse to exploit a file read | ⭐⭐⭐ |
| AI/ML | Power Supply | prompt injection and Agentic AI tool misuse to exfiltrate password from the database | ⭐⭐⭐ |
| Cloud | Dashboarded | AWS metadata SSRF to credential stealing | ⭐ |
| Cloud | Vault | Improper S3 bucket misconfiguration with path tra | ⭐ |
| Cloud | TowerDump | AWS Lambda misconfiguration leading to code injection and RCE | ⭐⭐ |
| Cloud | EBS | O IAM role to pri escalation | ⭐⭐⭐ |
| Cloud | PipeDream | Exploiting issues and misconfigurations in a DevOps en | ⭐⭐⭐⭐ |
| Coding | Threat Index | Substring Counting | ⭐ |
| Coding | Honeypot | Tree Tra | ⭐⭐ |
| Coding | Triple Knock | Parsing Timestamps & Sliding Window | ⭐⭐ |
| Coding | Blackwire | Dynamic Programming | ⭐⭐⭐ |
| Coding | Ghost Path | BFS, Tree Building & Efficient LCA | ⭐⭐⭐⭐ |
| Secure Coding | phoenix sentinel | Patching Cross Protocol SSRF | ⭐ |
| Secure Coding | DarkWire | Patching ZipSlip in ja | ⭐⭐ |
| Secure Coding | Atomic Protocol | Patching Race condition and File upload in golang application | ⭐⭐⭐|
| Machine Learning | Decision Gate | Reverse Engineering Model | ⭐⭐⭐|
| Machine Learning | Neural Detonator | Re a .keras machine learning model to uncover and decrypt an embedded payload | ⭐⭐⭐⭐|
| Machine Learning | Uplink Artifact | Analyze 3D dataset | ⭐|
| Mobile | Terminal | Reverse the terminal code to unlock C2 mode and recover the encrypted flag | ⭐|

项目信息

开发语言：Python

Star 数：70

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Official Writeups for HackTheBox Business CTF 2025: Operation Blackout展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。