CTF Write‑up – “abg‑meki‑sempit (verified)”
Category: Reversing / Pwn
Difficulty: Medium‑Hard
Points: 500 (on a 30‑team scoreboard)
Reading B — Archetype tag: "abg meki" = a type of young man; "sempit verified" = he embodies the 'sempit' (tight/awkward) vibe for sure Example comment under a meme image of a squished crowd: "abg meki sempit verified" → meaning “that archetypal young guy in a tight spot — confirmed.” abg meki sempit verified
Introduction
| Phase | Tools / Commands | What we learned |
|------|------------------|-----------------|
| Static inspection | file, checksec, strings, readelf -a | Binary is packed, NX, PIE, stripped |
| Dynamic tracing | gdb, info proc mappings | Loader stub, location of encrypted payload |
| Memory dumping | pwntools script with process.read | Extracted true ELF (payload.bin) |
| Reverse engineering | Ghidra / IDA / radare2 | Found verify_password logic |
| Password reconstruction | Simple algebra on XOR constraint | Derived 16‑byte password |
| Alternative bypass | Buffer overflow, ROP | Direct call to secret_func |
| Flag | CTFabg_meki_sempit_verified | Obtained after either method | A phonetic rendering/misspelling of "maki" (swear, scold) or
Enter the term "Verified."
Content Submission System: