BushBash CTF 2026 Writeup

rev#

Hack The Vault I (beginner) (100pt / 387 solves)#

The jungle holds many secrets, some of them as dark as the night ruled by a laughing moon. Ever since the Moss Man committed his atrocious acts, the villagers slept with an eye open, while detective Kane searches for the taunting vaults he left behind. He wants to talk to you, he needs your help: nc 34.40.133.67 7776.

Just open the vault file and you will find the password th3M0ssM4ni5h3re,y0uc4ntcatchm3. Putting it on the remote server will give you the flag.

bushbash{th1s-is-just-th3-beginning!}.

password (easy) (100pt / 264 solves)#

We've recovered a device with a usb port. We know the username is admin and the password is password, but we just can't log in. The info we received was a cobbled mess, maybe something's missing?

Connect to nc 34.40.133.67 6768 to access.

Attempted standard network logins using line feeds (\n) and CRLF (\r\n). Also tried keyboard layout shift (AZERTY, QWERTZ, Dvorak) caused by physical USB hardware configuration. The server sat idling, never acknowledging received usernames or presenting password prompts.

Scripted a fuzzing routine to test various line terminators (\n, \r\n, \r, \x00) across layout candidates. Sending admin\x00 immediately triggered a response from the server:

Error occured during decoding 'not enough input bytes for length code'

The challenge name hint "cobbled mess" was a direct pun on COBS. tried sending admin\x00 and password\x00 using COBS encoding, but the server still did not respond. After some trial and error, I realized that the server was expecting COBS-encoded packets. The final solution was to send the username and password as COBS-encoded packets, which the server would then decode and validate. The following Python script was used to achieve this:

from pwn import *
 
HOST, PORT = "34.40.133.67", 6768
 
def cobs_encode(data: bytes) -> bytes:
    return b"".join(bytes([len(chunk) + 1]) + chunk for chunk in data.split(b"\x00")) + b"\x00"
 
def send_cobs(io, payload: bytes):
    packet = cobs_encode(payload)
    log.info(f"> Sending: {packet}")
    io.send(packet)
 
io = remote(HOST, PORT)
 
io.recv(timeout=1)
send_cobs(io, b"admin")
io.recv(timeout=1)
send_cobs(io, b"password")
 
io.interactive()

Got the message #Your flag is bushbash{i_l0v3_C0bs}

bushbash{i_l0v3_C0bs}

misc#

Signal Haze (medium) (200pt / 163 solves)#

We heard you've gotten lost out in the bush again. We're sending a little something to you that may prove useful... However, due to the sensitive nature of this operation we cannot tell you how to extract this information from this transmission. We trust you will be able to figure out out though...

Checked file type on cyberchef and it is an audio file (.ogg) The file data.ogg was loaded into Audacity and viewed in Spectrogram mode. The spectrogram did not reveal a hidden image directly. Instead, it revealed that the audio is a Slow-Scan Television (SSTV) signal. Using Robot36 on my phone and playing it back, the flag revealed itself.

bushbash{gR0und-cOntr0l}

Conclusion#

The mix of challenge difficulties was super well-crafted, and the hidden easter eggs made the entire grind a blast. Still lots to learn in web security and reverse engineering, but excited to keep building skills for the next one! 🌙✨