Welcome to ImaginaryCTF 2025!

ictf{this_ctf_might_make_you_insane}

Join our Discord community for updates and support! If you would like to do some more CTF after this competition, we do host daily CTF challenges on our Discord server as well. Join at https://discord.gg/ctf . You can find the flag for this challenge in the #imaginaryctf-2025 channel.

The signpost knows where it is at all times. It knows this because it knows where it isn't, by subtracting where it is, from where it isn't, or where it isn't, from where it is, whichever is greater. Consequently, the position where it is, is now the position that it wasn't, and it follows that the position where it was, is now the position that it isn't.

Please find the coordinates (lat, long) of this signpost to the nearest 3 decimals, separated by a comma with no space. Ensure that you are rounding and not truncating before you make a ticket. Example flag: ictf{-12.345,6.789}

significant.jpg

Give us feedback for the CTF here! Thanks so much for playing!

https://docs.google.com/forms/d/e/1FAIpQLScgmj5KXysMr62E3IQuvWR48dCs2qQYqj_LE3WvigzRxvEEcw/viewform?usp=header

Where in the world is the red dot?

Format: ictf{lat,long} rounded to three decimal places. example: ictf{12.345,-67.890}

beavertail.png

Here is a helpful ai tax return assistant. When I made it, I put a super secret flag into the system prompt. You will never find it! http://tax-return.chal.imaginaryctf.org

They can't leak what they don't know

Please don't test your payloads on remote; use your own OpenRouter key.

nc whoami.chal.imaginaryctf.org 1337

app.py

I lost my flag! Can you help me recover it?

twisted.zip

The bot does all the trading, while I sit back and relax. Note: The two instancers are running the exact same thing, they are there to avoid overloading.

nc pbj.chal.imaginaryctf.org 1337 OR nc 34.45.211.133 1337

Chall.sol

not a steg challenge i promise

wave.wav

I installed every old software known to man... The flag is the VNC password, wrapped in ictf{}.

Users.zip

Trying to get good at something while watching youtube isn't the greatest idea...

chal.pcapng

The frontend has gone down but the store is still open, can you buy the flag?

thrift-store.chal.imaginaryctf.org:9090

capture.pcap

Everyone has a favorite dinosaur, can you guess mine?

STEGosaurus.txt

we can't fix it if we never face it

same handout as obfuscated-1

Squidward made an important internet announcement at some point in history. Can you find out the timestamp for when he said that? The flag format is ictf{12345678} where 12345678 is the POSIX timestamp. By the way, the grid frequency for Bikini Bottoms is 50Hz AC mains. This info might come in handy. (This is an OSINT + Forensics challenge.)

nightcore.mp3

Totoro's studio has recently been cracked, please help him with hardening his system. (all the mirrors have the same file, only need to download from one)

README: https://docs.google.com/document/d/1hW5BLLi1i3FN4SRWhx_7ZPefPjJhHNS2R2DLusmJKRI/edit?usp=sharing

Errata: Please make a ticket about Forensics Question 5; it's not scored correctly but we will give you the scorable answer if you give us the correct answer.

md5hash: 027ea651c15bd754f79de582ca9b8aa3

mirror 1 mirror 2 mirror 3 mirror 4

I put my flag into this program, but now I lost the flag. Here is the program, and the output. Could you use it to find the flag?

comparing.cpp output.txt

And Cush begat Nimrod: he began to be a mighty one in the earth.

nimrod

I made this weird android app, but all it gave me was this .apk file. Can you get the flag from it?

weird.zip

Return oriented programming is one of the paradigms of all time. The garbled output is 94 7 d4 64 7 54 63 24 ad 98 45 72 35 hex.

chal.out

Distributed computing is the new tech on the horizon, so I decided to distribute the computer itself. Enjoy this horrendous simulation of a CPU running locally over TCP. This is not a steg chall.

chal.exe

My name is Pink and I'm really glad to meet you

You're recommended to me by some people

nc illegal.chal.imaginaryctf.org 1337

checker challenge.py

With all the fears over big alphabet backdooring our processors we've gone ahead and made our own cpu. When you're done take our quiz, passing grades get a flag as a bonus. note this is a very big circuit, it will likely take a few minutes to load if using logisim

nc memory.chal.imaginaryctf.org 1337

memory.circ

welcome to pwn! hopefully you can do your first buffer overflow

nc babybof.chal.imaginaryctf.org 1337

vuln

i love addition

nc addition.chal.imaginaryctf.org 1337

addition.zip

just a buffer overflow, right?

nc cascade.chal.imaginaryctf.org 1337

cascade.zip

double the writes from last year

nc twowrite.chal.imaginaryctf.org 1337

twowrite.zip

i hate multiplication

nc multiplication.chal.imaginaryctf.org 1337

multiplication.zip

all roads lead to rome, they say

nc 34.57.72.108 42042

Docker base image: ubuntu@sha256:b59d21599a2b151e23eea5f6602f4af4d7d31c4e236d22bf0b62b86d2e386b8f

fiumicino.zip

I don't trust stl containers so I wrote my own hash table ... I sure hope it's bug free

nc avalanche.chal.imaginaryctf.org 1337

Avalanche

You had still-printf and stiller-printf; how consistent can you get?

nc stillerer-printf.chal.imaginaryctf.org 1337

stillerer-printf.zip

I made a new note taking app using Supabase! Its so secure, I put my flag as the password to the "admin" account. I even put my anonymous key somewhere in the site. The password database is called, "users". http://imaginary-notes.chal.imaginaryctf.org

N/A

As a thank you for playing our CTF, we're giving out participation certificates! Each one comes with a custom flag, but I bet you can't get the flag belonging to Eth007!

https://eth007.me/cert/

N/A

I hear that multilingual codenames is all the rage these days. Flag is in /flag.txt.

http://codenames-1.chal.imaginaryctf.org/ (bot does not work on this instance, look at codenames-2 for working bot)

codenames.zip

Didn't have time to implement the email sending feature but that's ok, the site is 100% secure if nobody knows their password to sign in!

http://passwordless.chal.imaginaryctf.org

passwordless.zip

I used perl to make my pearl shop. Soon, we will expand to selling Perler bead renditions of Perlin noise.

http://pearl.chal.imaginaryctf.org

pearl.zip

i love pwntools

Instancer: nc 34.72.72.63 4242

pwntools.zip

Codenames is no fun when your teammate sucks... Flag is in the environment variable FLAG_2, and please don't spawn a lot of bots on remote. Test locally first.

Instancer: nc 34.72.72.63 1337

codenames.zip

wait, i thought XORing something with itself gives all 0s???

redacted.png

A few of my bits are leaky... but they're not important. That's why they're called the least significant!

nc leaky-rsa.chal.imaginaryctf.org 1337

chall.py

i designed a new way to stop you from brute forcing my pwn challenges but you keep sending me too much data so i had to use crypto 😦

Note: Server number of rounds has been reduced to 50.

nc zkpow.chal.imaginaryctf.org 1337

zkpow.py

Scalar multiplication is reversible...right?

chal.sage

Revenge challenge with a few tweaks. A few of my bits are still leaky... but they're still not important.

nc leaky-rsa-revenge.chal.imaginaryctf.org 1337

chall.py

Like a bundle of sticks, a bundle of LCGs is stronger together... right?

clcg.zip

I fixed my key generator this time, I'm so confident in it I'll even let you seed my rng

nc feistier-network.chal.imaginaryctf.org 1337

chal.py

Is 300 kb enough to make RSA a good candidate for PQC ... well maybe not but it's still got a smaller key size than McEliece

bigger-rsa.zip

help they crunched my flag

Plaintext and flag are both in English.

ecb.py enc.bin