Visionspace run a casual CTF during Cysat Europe 2025. This was split between Cyshock – The Prequel, a 5 challenge teaser distributed through LinkedIn posts in the weeks coming up to the event, and Cyshock – The Awakening, a regular CTF available online during the event.

Overall, we’ve hosted over 1000 players and 600 teams engaged with the challenges, with over 300 teams scoring in at least one challenge.

Since the prequel challenges were available online before the competition, they were included during the main event as an extra challenge with a 0 point score. You can find the write-up for all available challenges below.

CTF Highlights

1029 players registered
634 teams formed
12 unique challenges
3197 total possible points
Chapter 1: A New Song [MISC] was the most‑solved challenge with 290 successful agents
The toughest puzzle? A classified challenge cracked by only 2 teams

Figure 1 – Cyshock Top 10 Teams

Cyshock – The Prequel

All prequel challenges are Cryptography related, and self-contained in the image presented. Another important aspect is that each challenge flag also contained a hint for the next challenge. While not absolutely required to solve each challenge, it could provide a helpful push in the final challenges.

Chapter 1. A crack appears

Figure 2 – The Prequel Chapter 1 challenge

The first challenge was straight forward, the message on the screen was encrypted using ROT13, reversible by reapplying the encryption.

Flag: “follow the lights and find me”

Chapter 2. Airgapped

Figure 3 – The Prequel Chapter 2 challenge

The name and description of the challenge contained a hint for the solution. If a system is airgapped, the only way to exfill information is through an output that is available from outside the system. The previous flag mentions to “follow the lights”, the message was encoded in the Capslock LED of the keyboard, blinking in morse code.

Flag: “find the bug”

Chapter 3. A Golden Opportunity

Figure 4 – The Prequel Chapter 3 challenge

Multiple hints were available in the description, previous flag, and title, with mentions of gold and beetle (bug). The symbols used in the ciphertext could also allude to it, as not many ciphers use them. The message was encrypted using the Gold-Bug cipher, a substitution cipher popularized by Edgar Allan Poe in one of his stories.

Flag: “send me to the stars”

Chapter 4. Transmission

Figure 5 – The Prequel Chapter 4 challenge

This challenge had 2 screens, the main challenge, looking almost like a QR code, and a hint screen. The hint screen contains a section of the Arecibo message, an interstellar radio message with basic information about humanity and Earth, sent to space in 1974. The previous flag also hinted at a message transmitted. The message was encoded following the same format, essentially a binary representation in which a square is 1 and empty spot is 0, that can be decoded into ASCII characters.

Flag: “a song for ares”

Chapter 5. Out of this world

Figure 6 – The Prequel Chapter 5 challenge

This was the hardest and most obscure of the challenges. The hints also required extra logic steps. The previous flag hinted at a song for ares. Ares is also used in relation to the planet Mars, while the “song” mention could be a link to older optical disk storage formats. The goal was to hint at researching codes related to the exploration of the red planet. The answer was the Mars DVD Code, a set of challenges that were written in mini-DVDs and mounted to the lander petals on the lander for the Spirit and Opportunity rovers. These were then captured by the rovers after landing and decrypted by teams on earth working on the challenge. You can find more information about this on The Planetary Society page (https://www.planetary.org/outreach/red-rover-goes-to-mars-spacecraft-dvd) as this was a very challenging puzzle at the time.

Decoding it revealed the flag: “its back”

At this point the Prequel had finished, and the main story started.

Cyshock – The Awakening

More than just flavor, the main story tried to include some logic and flow to the challenges. While almost all challenges could be solved independently of each other, solving them in sequence or discussing the solutions and flags with other team members solving different categories could make it easier and provide hints on where to look next. In particular, the last challenge would require teams to link pieces from multiple challenges together before obtaining the final flag.

Chapter 1. A new song [MISC]

The first chall was a Misc challenge. Only a wav file was provided, with the description suggesting listening closely. The sound reveals a morse code message that decodes into “CAN YOU SEE ME”. Since this doesn’t follow the flag format, this was a hint to turn towards a different type of analysis. Listening closely to the file also reveals background noise which, combined with the morse message to SEE, would point towards checking the spectrogram of the audio, a visual representation of the content. The flag is painted on the spectrogram, shown here using Audacity:

CYSAT{take_to_the_sky}

Figure 7 – Screenshot of the challenge spectrogram in Audacity

Chapter 2. An alarming sight [WEB]

This challenge was roughly based on F’ CVE-2024-55029, previously published by Visionspace (Remote Code Execution and Critical Vulnerabilities in NASA fprime v3.4.3). An oversimplified short version is that it was possible to inject XSS on an F’ dashboard receiving telemetry from a satellite by reflecting it from the satellite itself, if certain conditions were present. The simplest form is a health check function that just repeats the content received.

The challenge presented a small telemetry dashboard:

Figure 8 – Chapter 2 Challenge dashboard

The first clues were in the title and description, with mentions of “alarms” and things “waiting to be raised”. As a common approach for XSS testing and to keep it simple, the goal of this challenge was to raise an alert by injecting it through the command sender. The only command that takes user input is “ping”, and most payloads injected after the command should work:

e.g.”ping <img src=x onerror=alert(1)>” would reveal the flag:

CYSAT{hunt_within_me}

Chapter 3. A place to hunt [PWN]

Only a binary was provided for this challenge. Most of the security features have been disabled, and the binary is not stripped. Enumeration of the binary would reveal a hidden “win” function that loads and prints the flag when called:

Figure 9 – Decompiled win function from the Ch.3 binary

This function is located at:

0000000000401233 g F .text 0000000000000089 win

It would also show a vulnerability in the “commandSequence” function in the way the command buffer is handled. A text buffer is first defined with a length of 40 chars, however fget attempts to write 0x40 chars into this location. This results in a buffer overflow that, given the disabled security features, can be used to gain control of the flow of execution by overwriting the return address.

Figure 10 – Decompiled commandSequence function from the Ch.3 binary

The final solution was to calculate the offset between the buffer location in memory and the return address (left as an exercise for the reader here) and overwrite the latter with the address for the win function. This can be made easier with e.g. pwntools:

This would then print the flag:

CYSAT{exploit_the_seasons}

In this case the flag was a minor hint towards the next challenge, alluding to seasons/weather.

Chapter 4. An aptitude test [MISC]

The challenge only provided a wav file. Besides than the flag from Ch.3, other hints were scattered on the challenge itself. The mention of rain on the description, as well as a reference that it was a transmitted message, the picture of the Earth with a storm, and the name of the challenge itself (APTitude). The file itself also contained important information that could help guide in the right direction: it’s an 8 bit, mono, 11025 Hz audio file, which is more common for radio signals than modern audio files.

The challenge was a reference to the Automatic Picture Transmission (APT) system, an analog image transmission system developed for use on weather satellites. The wav file contains a satellite image capture of the area where the event was running, overlayed with the flag. There are a few open-source tools built to decode this type of information, e.g. noaa-apt (https://noaa-apt.mbernardi.com.ar/) could provide a clean enough view:

Figure 11 – Processed image using noaa-apt

Flag: CYSAT{exposed_to_the_world}.

Chapter 5. In front of my eyes [CRYPTO]

As in the previous challenge, the previous flag hints that the solution for this would be exposed to the world, and the same with the title of the challenge.

This challenge only included a picture of a notebook, and the stickers distributed at the CYSAT event.

Figure 12 – Ch.5 provided image

The flag was hidden on the edge of the astronaut sticker. The border contained a morse code message going clock-wise, starting on the top left corner of the sticker, each square representing a dash and each line a dot.

Once decoded it reads:

CYSAT{hidden_in_plain_sight}

Chapter 6. Where it all begun [CRYPTO]

This was the last of the main challenges.

The challenge contained 3 files, a capture.png, a chall.txt file, and a corrupted.py file.

Reading the chall.txt file only revealed a ciphertext. Solving this requires the combination of multiple bits of information from each file.

First, analyzing the corrupted.py file and fixing the corrupted chars would show a small script that AES-CBC encrypts any message given to it. This type of cipher takes a key and an IV to encrypt a message, and the script shows that the IV is set to the current unix timestamp at runtime, rounded to the nearest second, and appended to {CY-9}.

The second step is identifying the key. This can be found in the capture.png file, that mentions that key=sticker+CY-9.

Figure 13 – Ch.6 capture.png

While CY-9 is slightly out of focus and may be harder to parse, it is also present in multiple places in the script, the challenge, and the story so far, so that context clues could act as a sanity check on this case. The key would thus be the flag from Ch.5 + CY-9.

The final step is to identify the timestamp. The logic here would be to understand why the picture is at that angle in the context of the story, and where to find any potential information regarding the time at which chall.txt was created. In this case, the picture was the first input that the AI character had received, taken from a camera tossed to the side, and thus saving the time of creation timestamp. Checking the exif data for the picture would show:

Create Date: 2077:05:14 22:55:35

Converting this date to unix timestamp would result in 3388258535. This would be enough to obtain a partial decrypt and the flag for the challenge, but not enough to proceed with the hidden challenge.

Some informed fuzzing for a few seconds before and after this point would allow for the full decryption of the file. Finding the initial time 3388258539, all messages were encrypted with a 1s difference, so the entire file could be decrypted to:

Figure 14 – Ch.6 solved output

Flag: CYSAT{a_new_end_a_final_beginning}

Hidden challenge

Once all challenges had been flagged, a hidden challenge was unlocked. The end game would take the player through most of the previous challenges in reverse order, with hidden functionality in each.

?????????????

The challenge description contained only:

The end?

Looking at the page source would show an html comment with:

`<!– Follow the path of light and dark, where it all begun. Let the bars guide you–>`

This was a reference to Ch.6 – Where it all begun. The hint `let the bars guide you` pointed at a specific line within the ciphered text, containing:

Figure 15 – Barcode from the fully decrypted text in Ch.6

This line is a bar code, and can be directly scanned with any barcode reader. Once scanned it decodes to /UNPLUG

Browsing to https://cyshock.ctfd.io/unplug would show a hidden page containing:

Figure 16 – /unplug page content

And another html comment:

`<!– The 1st key: AFIRSTSTEP-720797738599689 –>`

Expand my notes was a reference to Ch.5, where notes are first mentioned, and the filename of the picture is `mynotes.png`. This is a polyglot file combining a png and an encrypted zip file. Using the 1^st key mentioned in the comment would allow for the zip extraction:

7za e mynotes.png

This would reveal `piece1.txt`, containing:

Figure 17 – Contents of the piece1.txt file hidden in Ch.5

The hint pointed at a 2^nd missing piece and looking at the corner of a blue marble. Ch. 4 contained an image covering the planet Earth, also called the blue marble. Looking closer, this image is a gif. Inspecting the corners of the image would reveal a rapidly scrolling text on the initial frames of the image (here changed to white but black on the original challenge):

Figure 18 – Detailed image from the GIF presented in Ch.4. Text was changed to white for visualization

This would in turn read:

DER-66;TERMINATE

In addition, the image metadata also contained:

Artist: 2nd piece

Combining the pieces results in:

C9;KILLSWITCH;ORDER-66;TERMINATE

This follows the same format as the command sequencer function in the Ch. 3 binary, which would require communication between team members doing different categories.

Inputting it into the challenge instance would reveal:

Figure 19 – Output from Ch.3 once the hidden command was used

The hint pointed at Ch. 2, where an “Alarm” was raised, and the picture contains a moon shining into the room.

Browsing to the location mentioned would reveal a web page with a form requiring the 2 pieces found before:

Figure 20 – Output from Ch.3 once the hidden command was used

Inputting the correct keys would reveal more lore, and an endpoint to connect to:

Figure 21 – Output once the correct keys are inserted

Connecting to it would ask for elements for each of the previous steps: All the keys found, and a specific word from each of the flags of the previous challenges: