$ cat writeup.md…
$ cat writeup.md…
ASIS CTF 2026
Task: a themed 2048 game frontend hiding a Tomcat 9 Tribes gateway whose AES decrypt-fail path feeds raw attacker bytes to a Commons Collections deserializer. Solution: authentic Tribes ChannelData frame + CC6 Runtime.exec gadget for blind RCE, then one-shot parcel mirror exfil of two flag halves.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
"Are you good @ 2048?" — Citadel Grid — Multiverse 2048, node C-137. "Every move you make is mirrored to sibling universes through the encrypted garage gateway."
English summary: a Rick-and-Morty-themed 2048 game (pure client-side flavor) fronts a Node static server plus an Apache Tomcat 9.0.116 backend serving quote.jsp, leaderboard.jsp, mirror.jsp and a hidden diagnostics.jsp. A "garage gateway" listens on TCP 4000, decrypts AES/CBC session parcels and feeds them to a Java deserializer. Goal: blind RCE through the gateway, then exfiltrate a flag stored as two halves under rotating random labels.
Target: http://91.107.164.78:8080 (gateway TCP 91.107.164.78:4000). Flag format ASIS{...}.
index.html contains an HTML comment "TODO(staff): rotate the staging code" with ASIS{lo0k_at_t41s_scr1pt_kiddi3} — decoy #1.leaderboard.jsp is pre-seeded with EL-injection-looking names (param.label, initParam.flag, sessionScope.flag_SESSX) — red herrings. mirror.jsp rejects any parcel value containing $, {, }, space, /, .. (strict label validation), so EL injection is dead on arrival.robots.txt: Disallow: /citadel/, /citadel/lab-notes.html, /admin/ plus the hint "was there another door into the intranet? like a diagnostics thing?"./admin/ is a fake JS-only login ("logins disabled")....
$ grep --similar