Breaking Seven Challenges: Methods from BSides Mumbai CTF7

Abstract

Team Megnetar solved 10 of 25 challenges (2,250 of 9,950 points) at BSides Mumbai CTF7 in September 2026. This report consolidates the techniques behind seven documented solutions across three categories: covert-channel and image forensics, static reverse engineering of multi-stage binaries and a Game Boy ROM, and cryptanalysis of a Chebyshev-polynomial key exchange, a SHA-1 collision verifier and an Approximate Common Divisor instance. Each case states the weakness, the method that exploited it and the defensive lesson. Flags are withheld.

Overview

BSides Mumbai CTF7 ran 25 challenges across web, forensics, reverse engineering and cryptography. Team Megnetar finished with 10 solves and 2,250 points. The seven solutions documented here are the ones with complete, reproducible methods; full walkthroughs are published as individual writeups.

Forensics: covert channels and structure

High Wi-Fi Latency hid data in ICMP echo payloads: filtering to ICMP, ordering fragments by sequence number and decoding them recovered the message. Phishy GTA VI Game Files encoded information in the ordering and repetition of near-identical JPEGs rather than in any single file.

Lesson: protocols that are usually ignored are classic exfiltration channels, and a dataset's structure can be the payload.

Reverse engineering: trust the artefact

tijori arrived as a hex dump of nested GZIP archives wrapping a five-stage vault binary: XOR with 0xAB, a byte-table lookup and AES-256-CBC with a key derived from the SHA-256 of earlier fragments — recoverable offline because every input was revealed. The Game That Lies shipped a Game Boy ROM with a deliberately unreliable display; static string analysis and a single-byte XOR key (0x55) exposed the hidden region.

Lesson: encryption with a derivable key is a formality, and when the runtime misleads, read the binary.

Cryptography: when the parameters fail

Chebyshev's Revenge used the composition property T_a(T_b(x)) = T_ab(x) for key exchange; mapping it into the order-(p+1) subgroup of F_{p²} and exploiting a smooth group order reduced it to Pohlig–Hellman. FIGureeee1tout required two different inputs with the same SHA-1 digest — the public SHAttered 320-byte prefixes — before AES-CBC decryption. GCD but it's ACD gave ten noisy multiples of a secret prime; an LLL lattice anchored on one exact sample recovered it, with all errors confirmed below 2⁵².

Lesson: exotic constructions don't add security over a weak underlying problem, and broken primitives (SHA-1) and small noise relative to the modulus are exploitable in practice.

Disclosure

This report was written after the event closed. Flag values, challenge files and credentials are withheld.