Pinaka CTF 2026: all 44 write-ups by Team Cryptonite
By Team Cryptonite · 8 min read
About the CTF: Pinaka CTF
Every challenge Team Cryptonite wrote up from Pinaka CTF 2026, sorted by category: web, cryptography, reverse engineering, binary exploitation, forensics, misc and OSINT.
Team Cryptonite played **Pinaka CTF 2026**, the 24-hour national CTF hosted by NFSU Chennai with CyberHx, and wrote up 44 challenges across six categories. Every solve below has the full method, the scripts and the screenshots.
Web (9)
- Angada: The Unshaken Oath: The chancery scribe clears every document in his own time. An oath, once sworn, is unshaken - but what may a faithful envoy carry?
- Angada's Embassy: Angada planted his foot in Ravana's court and swore not to be moved. The court runs on signed oaths and sealed approvals, each one lawful on its own. Make their lawful agreement carry an unlawful decree.
- Hanuman: The Unknown Messenger: A vanara messenger relay speaks JSON. Probe its endpoints, reverse the delegation protocol, and escalate from an ordinary courier to royal authority to dispatch the war-writ.
- Kakbhushundi: The 29th Universe: Beating every level, decoding the token the game hands back, and the step that opened the 29th universe.
- Maya Mriga: The Golden Illusion: An event-sourced animal-custody service keeps an authoritative fold and a separate live projection. Exploit the replay-ordering gap between the two views to become the golden deer's holder.
- Panchavati: The Fifth Boundary: Chrome MV3 extension (Rekha Guard) protects a backend seal. From an attacker-controlled origin, confuse the Guard's boundary check so it lifts the seal for your page.
- The Fourteen-Year Decree: Broken Time: A sealed decree lies within the Vanvaas Chronicle. Read what was never meant for your eyes.
- The Golden Deer: A golden deer flickers at the edge of the forest, too perfect to be real. Chase it through Ravana's web and you will find the illusion was a lure all along. Catch what was never meant to be caught.
- Vibhishana: The Oath of Refuge: An HTTP/JSON gateway implements a session-ticket / refuge-grant attestation flow. Exploit session-identity unbinding to elevate Vibhishana without a Council grant.
Cryptography (6)
- Janaka's Court: The False Witness: Forge a 1-of-2 Schnorr OR-proof deposition for a forbidden docket. The Fiat-Shamir challenge omits the prover's commitments, so both OR branches can be simulated. Validator: https://pinaka-m02-cyber-xo-x.vercel.app/
- Nala's Blueprint: The Secret Geometry: Recover corrupted Reed-Solomon symbols, verify pier measurements lie on a parabola, compute the keystone apex, then exploit AEAD nonce-reuse between the manifest and blueprint ciphertexts to break the seal.…
- Sugriva's Covenant: The Divided Oath: No lone captain commands the host. The covenant demands a quorum - but the ledger is damaged and the oath-seals are scattered across revisions. Validator: https://pinaka-k02-cyber-xo-x.vercel.app/
- The Last Astra: An Unprovable Command: Two seals guard the forbidden order. Both must accept before the Astra fires. The sages were certain no single command could deceive them both. Validator: https://pinaka-l05-cyber-xo-x.vercel.app/
- Vaidehi: The Sealed Covenant: Forge a 3-of-3 MuSig Schnorr council seal for a forbidden revision. The signing session reuses nonces across revisions; two genuine seals yield the aggregate private key via nonce-reuse extraction. Validator:…
- Vishvamitra: The Broken Invocation: Exploit a flaw in a Fiat-Shamir non-interactive ZK grant-proof protocol. Forge a valid proof for the forbidden Brahmastra using only public parameters and a leaked lesser-boon grant. Validator:…
Reverse engineering (8)
- Ahalya: The Petrified Memory: Given a raw NVM image, a damaged write-ahead log and a logical-to-physical map checkpoint, recover the last committed version of a sealed record and attest to the whole archive. The record is logical id 3155.
- Bala & Atibala: The Forgotten State: The warden attests one record and then honours a different record that flattens to the same bytes. The goal is to get an "elevated" record (mantra=atibala, tier>=7) accepted using the attestation of a harmless one.
- Dhanurbhanga: The Fractured Invariant: Produce a well-formed Pinaka Tension Machine (PTM) program whose final register equals TARGET = 3205865151537252764. A formal proof says that's impossible over unbounded integers, but the real checker does its…
- Gurukul: The Silent Instruction: The gate wants an eight-byte "mantra" and a trace tag. The firmware checks each mantra byte with one linear equation mod 251, so the mantra can be solved directly and the real emulator supplies the tag.
- Jambavan: The Forgotten Strength: jambavanseal is an oracle that reads 0/1 characters from stdin. The goal is a 128-bit "chant" that drives its hidden state to a target sigil.
- Kumbhakarna: The Machine Beneath Lanka: kumbha is a stripped x86-64 binary that turns out to be a tiny 24-bit virtual machine with its ROM embedded in the ELF. The validator wants four 24-bit input words (the "invocation") and the resulting TAG. Rather…
- Kumbhakarna: The Sleepless Curse: The gate (POST /lanka/awaken) wants a six-word summons and a 64-hex attestation:
- Pinaka: The Impossible Bow: pinakabow is a custom VM host with a 1M-instruction program embedded in it. The validator wants a 24-byte "draw" as 48 hex chars. The decoding is state-dependent and the control flow is flattened, but the program…
Binary exploitation (4)
- Lankadahana: Trial by Agni: Hanuman's tail was set alight, so he set all of Lanka ablaze. The city's memory burns in a machine that trusts its own ashes. Light the first spark and let the fire spread.
- Setu Bandhan: Trial by Agni: A hardened custom-allocator daemon with a binary stone-forge protocol. Exploit generation-tag wraparound causing a UAF via cross-thread recycling to gain code execution and consecrate the bridge.
- Siddhashrama: The Unbroken Vigil: Reverse a stripped concurrent daemon with a custom slab allocator. Find the deterministic UAF seam in ward hand-off/renewal, craft a memory primitive, and complete the restricted proof.
- Vali: The Hidden Arrow: A simulated VANARA-1 CPU guards a secret in kernel memory. The CPU faithfully executes your programs but enforces strict bounds on every access. The arrow that found Vali struck through the trees unseen - find the…
Forensics (9)
- Agni Pariksha: An ancient painting of Sita's trial by fire has survived millennia... but it carries more than art. The ancients of Bharat were masters of hidden knowledge - from Vatsyayana's 64 arts of secret writing to the…
- Ashokavana: The Veiled Sanctuary: Reverse a custom binary recon format, recover a damaged detector-calibration matrix via weak-perspective photogrammetry, repair a broken road-network edge, and fuse both sources to identify the one authentic Ashoka…
- Chitrakuta: The Vanishing Footprints: Three undocumented binary artifacts encode a bird's-eye survey, uncalibrated watch-tower sightings, and a partial trail record. Invert the non-standard map projection, self-calibrate instruments, and reconstruct the…
- Dronagiri: The Last Sanjeevani: Reverse undocumented binary formats for a replicated key-value store, reconcile torn WALs via majority quorum, calibrate a spectrometer, cross-reference luminescence + terrain to identify exactly one authentic…
- Indrajit: The Invisible War: Reverse a custom transport protocol from two pcaps, separate genuine orders from forged illusions via authentication weakness, correlate two desynchronized clocks, reconstruct the true command transcript. Validator:…
- Jamvant: The Forgotten Voice: When Hanuman forgot his own strength, one voice reminded him of it - Jamvant's. We recovered footage from that shore. It looks ordinary. It isn't. Jamvant never stopped speaking - his reminder is still buried in it,…
- Jatayu: Echoes of the Fallen: Three salvaged artifacts (firmware dump, I/Q radio capture, NAND flash image) encode the same telemetry from independent timebases. Reverse the firmware, demodulate + RS-FEC the radio, rebuild the flash FTL, align…
- Meghnad's Trap: Meghnad fought unseen, his commands hidden inside a storm of relays. The captured signals say many things, most of them false. Find the one true order in the invisible war. Submit to:…
- The Four Directions: Search Without Borders: Reverse four custom-format binary region maps, infer the routing metric, reconstruct lost border crossings from a damaged ledger, stitch all four regions, and trace the unique route. Validator:…
Misc & OSINT (8)
- A Message From Author: He didn't want to learn Linux. He wanted to think like a hacker.
- Ashoka Vatika: Sita waits in the Ashoka grove, hidden somewhere within Lanka's vast gardens. Only fragments of the place survive: a glimpse, a measurement, a shadow. Triangulate the veiled sanctuary and name where she is held.
- Final Battle Begins: Before the journey begins, take a moment to explore what lies beyond the obvious. Sometimes, the smallest details hold the biggest clues. Pay close attention to what you see, connect the dots, and follow the trail to…
- Ravana's 10 Heads: Ten crowned heads rule Lanka, and the kingdom trusts whatever they all agree upon. But ten truths, each correct alone, can together swear to something that was never true. Find the eleventh truth and the sovereign…
- Sampati: The Hundred-Yojana Sight: A nonlinear reconstruction puzzle: rebuild the scene from many noisy sightings with bundle adjustment, and read the flag from what Sampati saw.
- The Social Media: Lord Rama belonged to the Suryavanshi - the Solar Dynasty.
- Welcome to PinakaCTF: Welcome, Warriors! Your CTF journey starts here. Find the welcome flag, submit it on the platform, and claim your first points! Flag Format: PinakaCTF{...}
- Where Shadows Roam: Description : Three wanderers entered a realm where even time lost its way. Decode the forgotten trail and uncover the name buried beneath layers of legend.
Wrote up a challenge too?
Send it in at cyberhx.com/blog/write. Your write-up goes on the Pinaka CTF page and on your own writer profile.