Root-Me-XMAS

Meet your X-Mas Assistant! It will help you throughout this entire month of CTF, providing a brand-new way to interact with CTFd through a "futuristic" Chatbot UI. This assistant talks directly to the CTFd API for you! Try it now! Can you exploit its MCP quirks and uncover the flag? **This is not a web challenge.**

Every winter, the elves’ factory relies on a massive statistics system to optimize gift production. Everything was running smoothly… until DevSecOops the elf spilled his eggnog all over his laptop. Disaster: he lost the only access to the production server, which contains the one and only copy of Santa’s List! From his… let’s say “foggy” memory, the file should be somewhere inside the /opt/ directory. Time is running out: without the list, there’s no way to finish production before the big day. Your mission? Find a way to recover the list by accessing the production server! Save Christmas… and DevSecOops’ already fragile reputation! (Remember to clean up any files you create for this challenge—especially on external services—to avoid any hypothetical issues with your accounts.)

Santa is running out of elves to build gifts... So we decided to launch a community project. With enough help, we should be able to build today's flag for everyone! Join the Community Gift Project and help us build this formidable gift! =D https://cgp.challenges.xmas.root-me.org/

Root-Me's volunteers have prepared their wish lists to Father Christmas, nevertheless it seems that some lists with, specific requests, are only accessible to Father Christmas himself. However, a jealous elf, unhappy about not being able to prepare all the gifts has decided to try to get access no matter what. Unfortunately he did not succeed, which is why he's requesting for your help. The only thing the elf managed is to get a network capture of when Father Christmas logged onto the app where the lists are stored. Now it's your turn to help the elf and find a way to access the restricted lists, they might even hide something you're looking for.

Mom! My Wii won't let me run custom games! It's 2008 already and this console is still locked down — time to hack it. Connection informations: type: ssh ssh username: wii-user ssh password: wii-user challenge directory: /app

A mysterious ZIP archive has slipped down the chimney, straight from Santa’s computer. You would like to take a glimpse at the files inside, in case they look... _elf-incriminating_. Can you crack the archive and uncover the secret Santa hoped to keep under wraps?

Find Santa Claus' secret gift for you!

A mystery beneath the powder... Under this sea of whiteness, a secret patiently waits to be uncovered. Invisible to the naked eye, it will reveal itself only to those who know how to look differently. Sometimes, magic hides in the details. Don't try to open the image "as is", it may consume a large amount of RAM memory and crash your system. This challenge is intended to be solved programmatically. We hope you enjoy it. ZIP password: I_Wont_Crash_My_PC