TKCTF

Info

The last lab of the class is a 24-hour Capture The Flag (CTF) with challenges from various topics of the class. The challenges will be created by the staffs and participating students. Teams of students will compete in the competition and earn points for lab 10.

The competition is open to the public, welcoming external teams to join in the fun!

The CTF will last from December 4, 3:30 pm EST until December 5, 3:30 pm EST.

Teams

Each team has 3-4 players. Sign your team up on the spreadsheet.

Once the competition platform is set up, each member needs to sign up and and join your team.

Only one member needs to create the team and share the team name and team password for other members to join. Please note that user and team names are fixed and cannot be changed after creation.

For the competition, we recommend you create a team chat where you can easily communicate. Voice chat and screen sharing may be very helpful when you work on challenges together.

Scoring

The details of the scoring may be subject to change!

1. CTF scoring

The score in the CTF consists of three parts: solve points, author points, and LiveCTF points.

This is NOT your actual class score – see the next section.

  • Solve score: up to 500 points for each solved challenge

    • Dynamic scoring decreases the points per challenge as more teams solve it

    • The minimum score for each challenge is 250 (50%)

    • Staff challenges have a 2x multiplier (i.e. each worth 500-1000 points)

  • Author score: up to 2500 points for authoring a challenge of appropriate difficulty

    • All challenges are ranked by their number of solves

    • Fewest solves (0th percentile): 0 points

    • Median number of solves (50th percentile): 2500 points (5 challenges worth)

    • Most solves (100th percentile): 1250 points (2.5 challenges worth)

    • Otherwise, your score is linearly interpolated by your challenge’s solve percentile within those ranges.

    • Staff challenges are included in the ranking and tend to be harder, so aim to author a challenge between trivial and staff-level difficulty

  • LiveCTF score: up to 2500 points for progressing through the tournament

    • Single-elimination bracket where players race head-to-head live to solve a challenge

    • Points = 2500 * [# rounds won] / [# total rounds]

    • Teams qualify and are seeded based on their ranking a few hours into the jeopardy CTF

    • Each participating team may only send a single player per match

    • Players must share their screen for the entire match and may be recorded

    • Only the player in the match may work on the challenge and may not interact with their teammates or anyone else

2. Translation of CTF score to class score

This only pertains to CS 6265 students.

The class score is calculated as the sum of base points and ranking points.

  • Base points:

    • 20 points, awarded for solving at least one challenge

  • Ranking points:

    • First-place team, which scored Z CTF points, gets 380 ranking points.

    • “First-place team” might be either per-section or overall, depending on how many online-section/external teams participate.

    • Other teams, which scored X CTF points, get 380 * X/Z ranking points.

In other words, the first-place team gets 400 class points, and everyone else’s CTF scores will be scaled accordingly, with a minimum of 20.

Example: Team A scored 1500 points in the CTF, Team B scored 2000 points and wins the competition. Thus, Team B gets 400 class points: 20 base points + 380 ranking points. Team A also gets 20 base points. In addition, they get (1500/2000)*380=300 ranking points (linear scaling). Overall, Team A gets 320 (=20+300) points for the class ranking.

We may increase the base points if the average score is too low. In that case, the maximum possible ranking score decreases by the amount we increase the base points (in other words, the first team will always have 400 points).

AI Usage and Judging

This event heavily restricts the use of AI for solving challenges.

Unless otherwise mentioned on a per-challenge basis, adhere to these guidelines:

  • You may use AI to look up concepts, tool syntax, and documentation

  • You may not provide AI with the challenge material or anything derived from it (files, decompilation, server output, exploit code)

  • You may not use AI coding assistants or AI features in RE tools while working on challenges

  • Autonomous agents may not play

Before the closing ceremony, we will set aside time for judging. Top teams, and any team with suspicious solves, will be asked for writeups and may be interviewed. We expect every player to be able to comfortably walk through their analysis of the challenge and their exploits.

Teams found to be in violation of these rules may be denied points or disqualified at the organizers’ discretion. All decisions are final.

Challenge Template and Submission

The deadline for challenges submission is November 20th 11:59 pm. Challenge submission is mandatory for onsite (-A) students and optional for all others (but necessary to score author points).

The challenge template is available at https://tc.gts3.org/cs6265/2026-fall/_static/ctf-template.zip. Submit a link to your challenge archive through this form.

You can submit a pwnable challenge (class-style challenges) or another type. You can check https://ctftime.org/writeups for other types of challenges, and you are free to submit any type of challenge.

/REAMDE.md           : CTF template overview and instructions
/NAME                : team-name:challenge-name (e.g., `staff:fmtstr`)
/PORT                : a port number

# all files to run your service
/docker/Dockerfile   : Dockerfile
       /target       : target binary
       /flag         : follow this format: tkctf{please submit this flag!}

# all files to be released to participants
/release/README.md   : guideline
        /target      : target binary, if you want to release

# source/exploit for your team and organizer
/source/Dockerfile   : Dockerfile for the build environment
       /exploit.py   : exploit code
       /test.sh      : run docker, run exploit.py and print out flag
       /writeup.txt  : solution
       /src/         : source code

  1. Change the NAME file to your challenge name: teamname:challenge (e.g., staff:fmtstr)

  2. Change the docker/flag file as you wish, but wrap it inside tkctf{...} (e.g., tkctf{please submit this flag!})

  3. Refer to the README.md for further instructions

The source code of the challenge locates in source/src/, which contains its source (fmtstr.c) and makefile (Makefile). The makefile includes various defense options you can enable (e.g., CFLAGS += -fstack-protector). Please carefully enable them as you’d like for your challenge.

$ wget https://tc.gts3.org/cs6265/2026-fall/_static/ctf-template.zip
$ unzip ctf-template.zip

$ cd ctf-template
$ make help
prepare: prepare a docker image for compilation
build  : build the target
dist   : build the docker image
release: build the target, docker image and release them
run    : run the docker container
exploit: launch the exploit
test   : test the docker/exploit
submit : zip for submission

Keep in mind that the best challenge should be fun and educational. Please don’t design a challenge that requires any random/pure guessing (but well-designed bruteforcing is fine).

You can replicate real security vulnerabilities, like mini-sudo or mini-heartbleed. There are a few sources that you can refer to: