DEADROP CTF - Event Overview & Retrospective
The agency's systems are compromised. The breach window is open. The pigeon fleet is still operational (847 units active). And somewhere in the infrastructure, an asset classified only as UNIT 7 is filing HR complaints about the number of forms required to achieve sentience.
That was the premise. 36 challenges, 6 categories, one sprawling covert operations platform held together with Flask, classified memos, and increasingly suspicious weather data.
Here's how it went.
The Story
Every challenge in DEADROP was wrapped in the same fiction: a clandestine intelligence agency whose own infrastructure has become the target. FOIA portals, JWT-secured agent dashboards, drone registries, weather control arrays, encrypted dead drops, and a memory forensics image from a router that was doing something it definitely shouldn't have been.
The lore was consistent and occasionally load-bearing. The pigeon fleet wasn't just flavour text, X-Pigeon-Count: 847 in an HTTP response header was a real clue. The "flat earth division" budget memo was a real document with a real flag hidden in it. Unit 7's HR complaints about the org chart were the output of an actual inner VM you had to reverse to get anything useful.
Nothing was labelled, everything was plausible deniability.
The //CHAOS Meta-Challenge
Hidden across the platform (specifically the web challenges) was a meta challenge that didn't come with any hints. Its description: "If you were diligent in Web, you probably picked up some pieces along the way. Those will be useful here, put the pieces back together."
Four fragments, four different hiding techniques, spread across four different challenges:
Fragment 1: Favicon steganography
Every page loads the same surveillance eye favicon. Hash it with MD5, use the hash to find a Pastebin. Fragment: DEADROP{you_were_never_
Fragment 2: Forbidden endpoint
The robots.txt has a disallowed route: /do_not_visit/unit7. It returns a 404. View source and the HTML comment contains base64 encoded: supposed_to_find_
Fragment 3: Zero-width Unicode
The drone firmware page has a checksum field that looks like a standard MD5 hash. In the browser there is slight spacing as a hint. In raw source, the gap between the two halves is packed with U+200B (zero-width space) and U+200C (zero-width non-joiner) encoding binary ASCII. Decode it: this_unit7_
Fragment 4: Malformed meta attribute
The landing page <head> contains <meta name="content-hash" content-hash="REVBRFJPUHt...">. The content-hash attribute doesn't exist in HTML. Base64-decode the value: says_hello}.
Flag: DEADROP{you_were_never_supposed_to_find_this_unit7_says_hello}
Category Breakdown
Web
Six challenges forming a loose chain across the agency's public-facing infrastructure. Authentication bypasses, injection attacks, and a three-stage chain that required output from one step to unlock the next.
| Challenge | Technique |
|---|---|
| Web 1: surveillance.archive.gov | FOIA portal SQLi, UNION injection |
| Web 2: agent_portal.classified | JWT none algorithm attack |
| Web 3: budget.internal.deadrop | SSTI (Jinja2), budget document exfil |
| Web 4: leaks.secure-drop.deadrop | Stored XSS, cookie theft via document exfil |
| Web 5: drone_registry.gov | SSRF, AWS metadata credential theft |
| Web 6: weather.control.deadrop | SQLi → IDOR → command injection chain |
Web 6 was the standout in this category: a deliberate three-stage chain where each stage's output fed directly into the next. SQLi to bypass auth, IDOR to steal the API key from a different operator's report, then command injection to achieve RCE. None of the three vulnerabilities was exotic in isolation. The difficulty was recognizing the dependency chain and following it through.
Crypto
Six challenges across classical and modern cryptography. The difficulty curve was deliberate, CyberChef at one end, backdoored elliptic curves at the other.
| Challenge | Technique |
|---|---|
| Crypto 1: INTERCEPTED TRANSMISSION 774 | Vigenère, Kasiski + acrostic key recovery |
| Crypto 2: RSA Briefing | RSA small public exponent (e=3) cube root attack |
| Crypto 3: The Oracle | CBC padding oracle attack |
| Crypto 4: DSA Again? | DSA repeated nonce, private key recovery |
| Crypto 5: DSC-1.1 | Custom cipher cryptanalysis, incomplete-d RSA brute |
| Crypto 6: CIPHER7 | Backdoored elliptic curve, dual EC DRBG weak RNG, Reed-Solomon ECC |
Crypto 6 was genuinely the hardest challenge in the event. Three separate cryptographic stages in one archive: a weak RNG seeded from a backdoored elliptic curve, Reed-Solomon error correction to recover a corrupted key fragment, and AES decryption as the final step. Each stage required recognizing the attack surface before you could even start.
Forensics
Six challenges covering the full spectrum of digital forensics: disk images, steganography, memory analysis, and multi-artifact document reconstruction.
| Challenge | Technique |
|---|---|
| Forensics 1: Whistleblower | Deleted file recovery, Autopsy/Sleuthkit |
| Forensics 2: Safehouse | LSB steganography, stegsolve |
| Forensics 3: svchost_1337 | ELF core dump analysis, custom 4-layer encoding |
| Forensics 4: Redacted Blueprint | PDF hidden XObject, base64 in orphaned stream |
| Forensics 5: Field Laptop | Encrypted hidden partition, ChaCha20, self-describing header |
| Forensics 6: NIGHTJAR AFTERMATH | Multi-artifact reconstruction, whitespace steganography |
Forensics 4 deserves a special mention for sheer stubbornness, a PDF whose floor plan of rooms spells "OOPS" from above, with a flag hidden in a FlateDecode-compressed XObject that has no page tree reference and is invisible to all standard PDF viewers. Finding it required either a full PDF stream parser or the kind of hex editor patience that builds character.
Network
Six challenges across protocol analysis, traffic decryption, and multi-layer PCAP reconstruction.
| Challenge | Technique |
|---|---|
| Network 1: Breach Traffic | FTP credential extraction, plaintext protocol |
| Network 2: DEADROP C2 | DNS exfiltration, hex-encoded subdomain reconstruction |
| Network 3: TLS Session | TLS decryption with session key log |
| Network 4: ICMP Exfil | ICMP payload exfiltration, Scapy extraction |
| Network 5: C2 Beacon | C2 beacon traffic analysis, polyglot payload |
| Network 6: OPERATION NIGHTJAR | Full kill chain PCAP: recon → exploit → C2 → exfil |
Network 6 was a complete attack chain compressed into a single capture file. Six stages of traffic, reconnaissance, exploitation, C2 establishment, lateral movement, data staging, exfiltration, each requiring a different analysis technique. Solving it meant reading the whole story from first SYN to final exfil packet. The flag was a well-earned compliment.
Reverse Engineering
Six challenges across Linux and Windows binaries, Python obfuscation, and a custom VM architecture that scaled from easy to genuinely brutal.
| Challenge | Technique |
|---|---|
| Rev 1: agent_verify | XOR-encoded passphrase, ltrace -s 200 |
| Rev 2: Clearance Check | Multi-layer Python obfuscation, marshal bytecode |
| Rev 3: asset_tracker | Windows PE, anti-debug bypass, XOR-encoded fragments |
| Rev 4: VM Executor | Custom stack VM, embedded bytecode extraction |
| Rev 5: Drone Firmware | Constraint solving with Z3, firmware auth bypass |
| Rev 6: UNIT7 | VM-in-VM, two chained inner programs, no stored flag |
Rev 6 is the one that warrants its own paragraph. A VM-within-a-VM where the outer stack machine (same ISA as Rev 4, a deliberate callback) runs a banner. The inner register machine runs two programs sequentially: program 1 computes the passphrase through a cross-register dependency chain, program 2 takes that register state and computes the flag character by character. No ciphertext stored anywhere. No DEADROP{} wrapper. No known-plaintext attack surface. The flag only exists as the arithmetic output of a VM program that depends entirely on another VM program's computed state.
Misc
Six challenges covering OSINT, bash jails, email forensics, SIGINT analysis, document forensics, and the //CHAOS meta-challenge.
| Challenge | Technique |
|---|---|
| Misc 1: BURNED ASSET PROFILE | OSINT ghost hunt, GitHub/LinkedIn correlation |
| Misc 2: Bash Jail | Bash jail escape, restricted shell bypass |
| Misc 3: INTERNAL MEMO CHAIN | Email forensics, 12-fragment base64 header chain |
| Misc 4: SIGINT PUZZLE | SIGINT + OSINT correlation, image steganography, cipher key reconstruction |
| Misc 5: Flatearth Committee Minutes | OOXML internals, hidden XML content, revision history |
| Misc 6: //CHAOS | Meta-challenge: favicon MD5, hidden 404, zero-width Unicode, base64 meta tag |
Standout Moments
The Web 6 chain: Three distinct vulnerability classes in sequence with output handoff between each stage. Players who recognized the dependency early finished in one clean session. Players who treated each stage as independent lost time reinventing context they'd already discovered.
Crypto 6's Reed-Solomon stage: Most crypto CTF challenges expect you to attack a cipher. This one expected you to repair a corrupted key using error-correcting codes before you could even get to the cipher. The reedsolo Python library was the unlock; knowing it existed was half the challenge.
Rev 6's register chain: The MOV-heavy cross-register dependency in program 1 meant that tracing registers in isolation was always going to fail. An error on r0 cascaded through eight downstream registers, making partial analysis worthless. Players had to commit to the full trace.
Forensics 4's hidden XObject: A legitimate PDF feature used for exactly the wrong purpose. The XObject was orphaned from the page tree, invisible to all renderers, unreachable by standard tools, completely invisible in the printed document. Finding it meant either knowing PDF internals cold or hex editing until something unexpected appeared.
//CHAOS: The best moment of any CTF is the flag with no hints. Four different hiding techniques, one meta-challenge that rewarded players who treated the entire platform as adversarial surface rather than a menu of labelled problems.
Final Thoughts
DEADROP was designed around a single premise: nothing should be obviously labelled, and everything should be plausibly real. A real FOIA portal could have exactly this SQLi vulnerability. A real firmware blob could have exactly this auth constraint. A real intelligence platform could have exactly this badly-configured JWT implementation. The fiction wasn't decoration, it was the threat model.
The event held together. Unit 7 filed its forms, got cleared, and printed its own flag. The weather control array confirmed three events queued. The pigeon fleet remained active.
The breach window is still open.
All writeups available individually. Unit 7's HR file remains incomplete pending final processing.