Root Me : Hacking and Information Security learning platform

CTF all the day

2020-12-11T10:19:58Z

- Capture The Flag

Cryptanalysis

2016-08-10T08:14:02Z

- Challenges

Web - Server

2013-05-22T05:19:51Z

- Challenges

Web - Client

2013-05-22T05:19:41Z

- Challenges

Steganography

2013-05-22T05:19:20Z

- Challenges

Realist

2013-05-22T05:18:59Z

- Challenges

Programming

2013-05-22T05:18:47Z

- Challenges

Network

2013-05-22T05:18:19Z

- Challenges

Forensic

2013-05-22T05:18:09Z

- Challenges

Cracking

2013-05-22T05:17:13Z

- Challenges

Trusted

BoBNewz — 2026-04-21T10:11:53Z

You are called to investigate an employee's machine. For some time now, strange things have been happening on his computer, and the employee has lost access to his passwords.
An initial investigation has confirmed the presence of a malicious individual on the machine.

We ask you to find :

- The CVE used by the attacker to gain initial access.
- The password of the employee's e-mail account.
- The attacker's IP address.
- The C2 used by the attacker (e.g. Havoc).
- The ID of the persistence sub-technique according to MITRE ATT&CK.

The flag is as folllows: RM{CVE-XXXX-XXXXX_password_attacker-IP_attacker-C2_MITRE-ATT&CK-ID}

sha256sum: 29cade26d102e12191f49a72da235b0eeca8953725c85a090beb0b81a95d45ff

- Forensic

Invocation

BoBNewz — 2026-04-21T10:11:48Z

A hacker infiltrated a company's system and encrypted an essential file.
Fortunately, a memory dump of the victim machine was carried out, along with the recovery of some network traces.

Analyze events and retrieve the contents of this file!

sha256sum: aaba88eb944aaf65af1c261a291be20a2e1a34e09a7575a8362767cb389be6a2

- Forensic

ICMP exfiltration

M4tou — 2026-04-21T10:11:43Z

Your SOC has detected a successful intrusion on an administration server. The intrusion was carried out from the outside using the administrator's password, although he was not present at the time. We suspect that his password had been previously compromised ,but there is no trace of this on the IDS.

However, N1 SOC analysts isolated suspicious ICMP traffic the previous day. The alert criterion was the length and shape of the load, which was inconsistent with Linux.
The CSIRT team deployed on site succeeded in recovering a suspicious binary, whose name seems to be directly linked to the SOC detection.

Find the exfiltrated data!

sha256sum : c5d9abda3504725a90fed54c27fc4ccea8510315dbc1daac7934f0e5841986e3

- Forensic

Heist of the century

Ayweth20 — 2026-04-21T10:11:33Z

Two young criminals have carried out a robbery at the town's bank.

The police managed to arrest them as they left the bank, but they need your help. It seems they have seized the two criminals' phones but have been unable to unlock them. They are counting on you to help them unlock these phones by providing the PIN (apparently an 8-digit code) and the password.

Format: RM{PIN:PASSWORD}

sha256sum: 2400EEAA80A0D59A780A912D6739B9B8E8274E1B5C1EFAF891B872AA83B6BDDF

- Forensic

Android - Shady VPN

apges01 — 2025-09-08T10:01:40Z

Challenge sponsored by Airbus at the CTF "Security Hacking Contest 2023".

Mr Y uses the NxShield VPN application to protect his identity when surfing the Internet. Your task in the following steps will be to analyze this application to understand how it works.

In parallel, our network teams were able to intercept a communication about 2 days ago between this application and NxShield's VPN servers. You need to find a way to access the data exchanged during this capture, which will be very important in identifying Mr. Y's identity.

Before starting your analysis, please note that we have shut down the servers used by NxShield VPN. Unfortunately, some of the application's features are no longer available, but we hope this will have no impact on your analysis.

Time is of the essence...

sha256sum (ch33.zip) : 5782eb96b88699962c063249cf8600d2515815cbca4315f662e19af70ee355e0

Information:
This challenge includes 4 flags to be found when analyzing the NxShield application.

– Application access code
– Activation code for connection form
– Mr Y's password
– The flag present on an image in the network capture

The flag format is as follows: sha256sum(flag1:flag2:flag3:flag4)

- Realist

VPN Provider

Nishacid — 2025-09-08T10:01:14Z

Challenge sponsored by Airbus at the CTF "Security Hacking Contest 2023".

We are currently investigating the identity of Mrs Alice X, who is planning to carry out an attack in the next few weeks. Recently, we were able to intercept a photo taken with her personal cell phone. Can you give us an in-depth analysis of this photo? It's the only information we have at the moment...

Furthermore, according to our technical teams, Mrs Alice X seems to use tools such as a VPN to guarantee her security on the Internet.

The challenge flag is located in /flag.txt

- Realist

Analog video

kevin.mille — 2025-06-23T18:18:48Z

Find the flag in this analog video signal.

Recording file format:

binary file
real signal, floating point, quantized on 32 bits
sampling rate = 26 Mech/s

The signal contains only video (no audio).

- Network

Ruby on Rails - ransack

koma — 2025-06-23T18:18:28Z

Find the administrator password.

- Web - Server

PNG - EMD

Thibz — 2025-06-23T18:18:13Z

Our agents discovered that a group of Breton extremists were communicating with each other via postcards depicting the region's landscapes. We have managed to intercept one image and are convinced that it contains information vital to dismantling this group.

Some information to help you:
– Pixel group size is 2
– The size of the hidden message is 892 characters.
– The image must be divided into groups containing 2 pixels, one after the other on the x-axis.
– No secret key has been used during encryption, so there is no random permutation of pixels.

Good luck!

- Steganography

PE32+ - KeygenMe

Redouane — 2025-03-14T08:49:46Z

It's up to you to discover this binary and understand how it works.

The aim is to generate the activation key for the "Root-Me" user.

- Cracking