/writeups / bushbash-ctf-2026
BushBash CTF 2026
Seven confirmed solves across crypto, reverse engineering, hardware, machine learning, and web. Credited to 1337_PwnSp4c3 / Kernel Kittens (1st place, 28/28 solves, 5,997 pts).
7 write-ups / 1st place overall / August 2026
back to write-ups
CRYPTO / hard (497 pts)
The Eye
Target: dots.png (star field with hex labels), prayer.enc, and decrypt.py.
Analysis: The prompt poem corresponds to Matariki, the Maori star cluster names for the Pleiades. Eight poem lines map directly to eight stars in order (Waiti: Maia, Waita: Taygeta, Pohutukawa: Asterope, Hiwa-i-te-rangi: Celaeno, Tupuanuku: Pleione, Ururangi: Merope, Waipuna-a-rangi: Electra, Tupuarangi: Atlas). Extracting the hex labels adjacent to each star coordinates builds the 16-byte AES-128-ECB decryption key: F02E029F23582DC829F034681057B7A8.
- Category
- crypto / astronomy
- Algorithm
- AES-128-ECB
- Flag
bushbash{happy-MAT4RlKI,k1-a-k0E-e-HiW4!}
REVERSE ENGINEERING / hard (334 pts)
Turned Around
Target: Custom esolang interpreter implementing backward execution and stack reversing.
Analysis: The binary interpreted a program that processed the flag string through alternating direction pointers and reverse stack operations. By instrumenting the state machine and following backward stack transformations, we inverted the byte permutation sequence and extracted the original key.
- Category
- reverse engineering
- Tooling
- Python solver
- Flag
bushbash{(d0Ub13*-*b4ck!}
HARDWARE / medium (300 pts)
chip
Target: unknown-chip.png four-channel logic analyzer waveform capture with sanded labels.
Analysis: Extracted the pixel rows to recover the SPI channels: CS#, MISO, CLK, and MOSI. The master sends 0x9F (JEDEC RDID), and the responder returns EF 40 15. Manufacturer ID 0xEF indicates Winbond, and capacity 0x15 corresponds to a 16 Mbit SPI flash (W25Q16JV).
- Category
- hardware / logic
- Protocol
- SPI JEDEC RDID
- Flag
bushbash{winbond, w25q16jv}
MACHINE LEARNING / medium (300 pts)
matrix_secrets
Target: PyTorch PEFT low-rank adaptation (LoRA) checkpoint with embedded secrets.
Analysis: Decomposed the low-rank projection matrices A and B in the attention layers. Computing the outer product differential between the adapter and the base model parameters revealed vector leakage storing the target flag ASCII bytes.
- Category
- misc / machine learning
- Framework
- PyTorch / PEFT
- Flag
bushbash{vect0rl3ak}
WEB / medium (300 pts)
Secret hidden website
Target: Obscure web target with no direct links provided in challenge description.
Analysis: Queried public Certificate Transparency logs via crt.sh to identify newly registered staging subdomains. Located an internal test endpoint that returned the solve flag in its HTTP response headers.
- Category
- web / recon
- Technique
- Certificate Transparency
- Flag
bushbash{h0w-d1d-y0u-f1nd-th1s}
CRYPTO / easy (190 pts)
membership perks
Target: Custom cipher string with club membership verification rules.
Analysis: Solved modular alphabet substitution schedule using known plaintext constraints from the challenge prompt.
- Category
- crypto / osint
- Method
- Substitution solve
- Flag
bushbash{hello-and-congratulations-for-solving-this-puzzle}
MISC / easy (120 pts)
BLISS I
Target: High-resolution landscape image with embedded stegano data.
Analysis: Applied color channel thresholding and extracted an obscured QR code matrix using OpenCV and Pillow to read the flag string.
- Category
- misc / steganography
- Tooling
- OpenCV / pyzbar
- Flag
bushbash{bucolic_green-hills}