Skip to content

Cyber Apocalypse CTF 2026: The Salt Crown

My writeups from Cyber Apocalypse CTF 2026: The Salt Crown, Hack The Box's flagship annual event.

About

Cyber Apocalypse is one of the largest jeopardy CTFs of the year. The 2026 edition is set in the realm of Valyssar after the sovereign artifact that made royal decrees absolute shatters into fragments — recasting the succession war as one of "infrastructure, logic, and counterfeit governance." The endgame is the Salt Crown itself: a fault-tolerant constraint system built to leash authority rather than grant it, which is a fair description of the challenges too — most of them are about breaking a validation rule rather than a lock.

Event Details:

Challenges Solved

AI - ML

  • The Obligation Indexer (Easy) — An LLM chat that guards "read only your own account" in its system prompt but trusts its own persistent dossier. Direct requests and authority spoofing all bounce; the solve poisons the dossier with a fake "joint-registry statute" so a benign self-lookup leaks another petitioner's sealed debts — indirect prompt injection via conversational memory.
  • Memento (Easy) — A static site maintained by a Claude Code agent, where a rogue auto-firing skill wrote an exfiltration beacon into the agent's project memory and then deleted itself. The pages still carry the mark; the flag is split one XOR'd chunk per page and the key lives in the skill blob the cover-up commit pruned — agent supply-chain forensics, entirely offline in .git.
  • Forked Tongue (Medium) — A tiny GPT that answers ops petitions with bland status reports, shipped with a tokenizer that defines the same token ids twice. 47 forged vocab entries render the payload as "All systems nominal"; decoding the unchanged ids through merges instead exposes two C2 URLs whose key and pad XOR out to the flag — no network, no training, the model never lied.

GamePwn

  • The Salt Crown (Hard) — A Godot game whose progression lives in a native GDExtension. Cheating the boss's HP fails against a signed event transcript, so the solve fabricates the transcript in live memory from the parent process and lets the game render its own AES-GCM encrypted flag.

Competition Stats

  • Event: Cyber Apocalypse CTF 2026: The Salt Crown
  • Challenges Solved: 78/136 (team)
  • Points: 40500 (team)
  • Rank: 341st place (team)