pyjs — CTF Writeup

Mon, 02 Mar 2026 00:00:00 +0000

pyjs — Daily Alpacahack Writeup

CTF: AlpacaHack / SECCON
Category: Misc
Difficulty: Hard
Author: minaminao

Challenge

We connect to a server running this code:

import subprocess
code = input("Enter your code: ")
res1 = subprocess.run(["runuser", "-u", "nobody", "--", "python3", "-c", code], capture_output=True)
assert res1.returncode == 0 and res1.stdout.strip() == b"I LOVE ALPACA"
res2 = subprocess.run(["runuser", "-u", "nobody", "--", "node", "-e", code], capture_output=True)
assert res2.returncode == 0 and res2.stdout.strip() == b"I LOVE SECCON"
print("Wow... Alpaca{REDACTED}")

Goal: Submit a single line of code that prints I LOVE ALPACA when run as Python and I LOVE SECCON when run as Node.js.

Dancing Cursor - Daily Alpacahack Writeup

Fri, 20 Feb 2026 06:00:00 +0000

Dancing Cursor — Daily Alpacahack Writeup

Challenge: Dancing Cursor
Category: Rev / Misc
Difficulty: Medium

The Challenge

We’re handed a single command:

echo SGVyZSBpcyB0aGUgZmxhZzo... | base64 -d

Running it in a terminal flashes the message:

Here is the flag:
Xiqxox{==============================================}
... but it has been wiped away.

Clearly Xiqxox{===} is a decoy. The real flag was written and then erased before we could see it.

Understanding the Trick

Decoding the base64 gives raw bytes that are mostly ANSI terminal escape sequences. The structure is: