From 2350b399c19b867430c7cef5858538a02b4394f1 Mon Sep 17 00:00:00 2001 From: simon13456 Date: Tue, 13 Oct 2026 17:19:09 -0400 Subject: [PATCH] Ajout de l'evenement de octobre 2026 --- .../2026-10-21-matryoshka-security-system.md | 162 ++++++++++++++++++ images/2026-10.jpeg | Bin 0 -> 15953 bytes 2 files changed, 162 insertions(+) create mode 100644 _posts/2026-10-21-matryoshka-security-system.md create mode 100644 images/2026-10.jpeg diff --git a/_posts/2026-10-21-matryoshka-security-system.md b/_posts/2026-10-21-matryoshka-security-system.md new file mode 100644 index 0000000..85441e4 --- /dev/null +++ b/_posts/2026-10-21-matryoshka-security-system.md @@ -0,0 +1,162 @@ +--- +# Editing the below variables is the absolute minimum to get stuff up. Feel +# free [obliged] to add editorial niceties or strip the page if you need to +# include something more complex. +season: 23 +episode: 05 +layout: default +title: UnitedCTF - Matryoshka Security System +# summary for social media cards. Ideal length 55 chars, max 200 +summary: UnitedCTF - Matryoshka Security System +tags: UnitedCTF UEFI +date_fr: 2026-10-21 +date_long_fr: Mercredi le 21 octobre 2026 18:00 à 21:00 +date_en: 10-21-2026 +date_long_en: Wednesday October 21st 2026 18:00 to 21:00 +description_fr: > + Ce Challenge fait partie du UnitedCTF2026! Nous explorerons les interactions entre les applications UEFI et dénicherons les flags dissimulés au sein de la chaîne. +description_en: > + This track is one of UnitedCTF 2026’s challenge tracks! We’ll explore what UEFI applications can really do to one another, and dig out flags buried in the chain. +tools_fr: + - IDA Free, Qemu et pwndbg +tools_en: + - IDA Free, Qemu and pwndbg +presented_by_fr: Défi présenté par Olivier Ouellette (P.S.Y) +presented_by_en: Presented by Olivier Ouellette (P.S.Y) +featured_img: /images/2026-10.jpeg +featured_img_alt: Matryoshka banner +location: CyberEco +--- + +# Next edition: {{ page.date_en }} +[French version](#french) + +### Season {{ page.season }} Episode {{ page.episode }} + +## {{ page.title }} + +The next edition of Montrehack will be held on {{ page.date_long_en }}. + +![ {{ page.featured_img_alt }} ]( {{ page.featured_img }}#centered) + +{{ page.description_en }} + +{% if page.challenge_assets %} +{::options parse_block_html="true" /} +
+## Challenge Assets +{% for asset in page.challenge_assets %} +* [ {{ asset.name }} ]({{ asset.url }}) +{% endfor %} +
+{% endif %} + +{% if page.archived_assets %} +{::options parse_block_html="true" /} +
+## Archives +This edition is over. Here are the archived assets: +{% for asset in page.archived_assets %} +* [ {{ asset.name }} ]({{ asset.url }}) +{% endfor %} +
+{% endif %} + +## Tools and Experience Required + +{% for tool in page.tools_en %} +* {{ tool }} +{% endfor %} + +## Where + + +* {{ page.location }} +* Follow the presentation [online on Twitch](https://twitch.tv/montrehack/) +* Participate in teams or on your own [on Discord](https://discord.gg/4qfFwPX) + +## When + +{{ page.date_long_en | capitalize }} + +## How + +* Workshop style +* Bring your own laptop +* Challenges will be analyzed +* Small groups of people can work on each challenge +* Solutions to each challenge will be presented to everyone at the end of the event + +## Credits + +{{ page.presented_by_en }} + + + +# Prochaine édition: {{ page.date_fr }} + +### Saison {{ page.season }} épisode {{ page.episode }} + +## {{ page.title }} + +La prochaine édition de Montréhack aura lieu {{ page.date_long_fr }}. + +![ {{ page.featured_img_alt }}]( {{ page.featured_img }}#centered) + +{{ page.description_fr }} + +{% if page.challenge_assets %} +{::options parse_block_html="true" /} +
+## Challenge Assets +{% for asset in page.challenge_assets %} +* [ {{ asset.name }} ]({{ asset.url }}) +{% endfor %} +
+{% endif %} + +{% if page.archived_assets %} +{::options parse_block_html="true" /} +
+## Les Archives +Cette édition est terminé, voici les archives: +{% for asset in page.archived_assets %} +* [ {{ asset.name }} ]({{ asset.url }}) +{% endfor %} +
+{% endif %} + +## Outils et expérience requis + +{% for tool in page.tools_fr %} +* {{ tool }} +{% endfor %} + +## Où + +* {{ page.location }} +* Suivez la présentation [en ligne sur Twitch](https://twitch.tv/montrehack/) +* Participez seul ou en équipe [sur Discord](https://discord.gg/4qfFwPX) + +## Quand + +{{ page.date_long_fr | capitalize]] + +## Comment + +* Formule atelier +* Apportez votre ordinateur portable +* Des problèmes seront étudiés et expliqués +* Chaque problème sera analysé en petits groupes +* Les solutions seront présentées avec tout le monde à la fin de la rencontre + +## Remerciements + +{{ page.presented_by_fr }} + +
+### Sponsors // Partenaires + +[![NorthSec](/images/nsec_logo.png)](https://nsec.io/) + +Interested to sponsor or present a challenge? [Contact us here](https://docs.google.com/forms/d/e/1FAIpQLSecc0vfe3pIwMJjIBCYW4G43ZwtagwVESu_qHKnglnBc3R3ww/viewform?usp=sf_link). \ No newline at end of file diff --git a/images/2026-10.jpeg b/images/2026-10.jpeg new file mode 100644 index 0000000000000000000000000000000000000000..838427519348b783d6ba1d6358c25499efecec58 GIT binary patch literal 15953 zcmeHtXIN9))@~316$B$)q-<1BP!K{dLAL_BB}8@zp`!tVfV3dJ3KlvlDuk+_0YZt0 z5PBydB(O1r&=Mf@5~}oe*=L`7KF@Q{_dNIed+(l^KgODCtvSbf$C&RNW6m7(9gF}@ z{bq360Kmq^2Do+j0~`zjZUESi9Qm^zmZOK2;}{3W(W4wExVSiv@tok{;Xc95eUkU| zsgt}wUT*GFLZ^WI0)m2qJbc0;LINVE1q22D?1YW|@SUR^$2mBT3!LOWDeylo2lW8p zu_Iwe!r0k>fFnRQb|Bk9Ge82s24FkNeyHxh%JE}dC)kc~aIzmgynp}H;r%0rYP0j4 zIKjtp{O~EZBZuF>3FJEV%W0+K*G>5EcMD2;Dtl`@c~c^gDEuAvs#sLr%oOeOK}6`+ zhOb}F%c}j3Kt2w?@cP_El^gb>pqmD7vsCrr4qi{6WiKBNA@K9ye`)b&EAS_k{@FSJ z;9+Mw)SVp&&;z`^`Y(fbg z_KGYvwJ|PL{Sbe;h<2}Qura;MP&ME;X8MjTgfJw~^r6~e^Lp;8wz<)UOwSohy48Ad zd5qd(U-rB=By{__MH+}X`EramjgT=-zwx9;)Ya37JS5nLb2TC^L)wGa1VbZCZ$|X$ z!v-QVGNr(;hE9h4tlmkZ`4e_iRcWzYm#Q@hfgF&uCM!pvO+hxBPw*%0$N50C&R3J_ z$1BvYzHY}ZFx>@8p(3ib^1nOJFAAnlZsG{IeVH0&@(Rqz_psi)rc+?NcK~=QdU7-P z$N1v2oh>v@dn$D7mZI+dIVbBY+w-IBGjAh!(xkajknxW3nLTy&!Me)peF4T*u6ki-vwXvX zl=^nnES^}exN0h=e!T;+Xt0090d zIY|tvVMyTFMT|{@aD-I*V|L7u8ji#yPNagu~jF%_@ipv`Cbsj zaSL?ZrL5#tQr9i6>+7B0^*)KJcd>&1(7v2x`ru5oLMI~S-l|Bck}x{9nYH)zFU#*t z3@jQ?i46Mb@CLuL_e7}An>USJ87eBw_8&-2pL#gUSLR;u<#GfN65FNOv9hxU8^AK; z`SmNYI?IAakGV$wvx&ogYL?7aqy+?Ov|2Vk*jl%UYq1_KvFD2+*m%2&b@ntbY8&45 z(Jb-~Yx`VhK`Jf};*|8up&;ETZgIPVqeE z!}>(VdKXR|0Pbp&z*?QkJvL4Bti8O2BC3fgv;(kB?yBeY)ULm{)8fK($~yoMmqH=8 zq|lBf;M*?)Yk57pEIot~_tzw%I~ONJpXJ5V1&r4{1s3^LYzTB45W)N<)K^xA>M%rG zD(cK??9W!{y6R07R&Qt44pZ^0Y6#f2CD4chqJ3=MII>r-_VaWHXuxT7PF=RzO@kv>NbAxqd4qmY3n@ANFJX?g97weHXia`aR$JXO^ZD<+ue&J$ zkNR8arRts{6$!y=g&RIdpSaoNs1^6mG7(|B=Zot*PtVkxd`2olZ3ZQsTys_;6tv(L zh^yLUB@l3Uic@E(d8}BdoQ0ps0s5TlueO8U)(grs6L5qXzpUGK6;whp#!HYW2ohvSI*EYx}H^O+fCCO|fNh*P+N=C4{$0FWaR5 zD(>Nga8xM_Bxryzqwp&!vGP{g#SZ`uo>qoyF~bh|G|rk=Eg>a=^NDj$=HunpQimNf zt;J$n1u5Gti(lY#5z-<0Smz0@rzNH&(#$S+6+9l!xfMlZUhy2Xqd<1PHaq&&zCz<` zp*U{ee|5m;;AvOD*g3yFvZvu{m~yXdyX--16HEI5fNMrT?euPQtc)B0z(LLw4rfW(d@a>eKvHVGuePU5DxZu`>l0?N*HNTKAcKHCHT-`Zcg!lomd|@^wmr6jnj-abmnwg#i zY4!PTiCe2wU8z$|q=d*WAbZ%yE)&=L{buT&-7 zm1BDAcZBse{^1_~W!=DY(R-+kepwp(zg%3ds&Q2?WJCMRiPWSb1k_&qJ8sf`@B6eu zW-L*9K{8oab$VflP-_USDMIS*hU@(Y_xrE@al_mNHakPC=@TwB=<<2{ZMZclw8Hji z)MkxMQP-tXsy^HV@u!NU=B=Rmr^iXfumgbqKPDLdUoJ@3%uq5X0k5N^eUcfOGCSe#vec4S!b^fKl~=`%(o`zUZfnF7p}0rZ z9mPI#m_dR7*#{T7KSwY!*mwTOUu?7pI9zvsDjE>ojGhG^n^NlbvK9qggAPO}*e?sh z!TzbG>>sg3qy?Ttf0MSW1Mcq@&P`CyaN28rSeN| zdvTc@!zr~iv=0Fs$0_(Y4Un!KC~ zj;Uis`UPsIN$xfS)qil4b)GG+%hI54M_jPFPh=a>z&n42Yq)ca+ zmpi?jN*1edb59yCyNvvtlw&^bX<2APzusZyQlPyG}yYOqT zRjx8v5>*ioP40^|<`+gqqhfleDs$&%*|V8kSI)vl-Gn9;O&?y~x!7QZmB)+va#)W} zM=dbMZ&D;CN6G@(ODF+}D&Ixd*|olT(!LDQ*aFfF#DrhqOVHGIM?V~f^VhSly!4(< zCWd1|-dCv2&l>R%xwRTil=ksJ;38A!4GlODw|Cd{Jo~e647Jq=Njo5~W^j#WYLDNL zjGU6F1k|or^U+|DGXY)&Q-ZgxLg4P8g=?3R$|XxKk(DfDoSu?AG-8si-A=Cw&)b!1 zBitrHf-qC)Yb5f#sPsw$kw;OyT=b)N#+iw_I|&UYB2{J!K6|_}$@BCq$1Xv`h449l zwsDR8=GfGyI(l7e&qG75ZW%+L;RSsIvM?1&61~wVM>i_m)yVK2iYR zvPe4CD_3Bz$IxdP&5O4D;;4K$YaAyXIFnv!^!Vjte!ZuHb)z3T-9S&$ z3>v0w4C7P2a(-xrIhKSJ&U6&RjeBgfLSrB>CBar-TiVOhqD-eIT_};)68BBT2O6qJ zb|x*+vQIu8z+odXjH3OKo1u$5V^bSnI_v((p>bfSl~DCRQj(M@TkD()R%s7tvrWvU zr0l_g3TQBBwq7gDW{E>yh%pXxfOP{;fE0n+GKknIb>nlTLUEcYl#{Db0E` zRLv4(G8@O8;?OT6l;&VZWL}IUxR*YwfM~P87C0$MKGDTkA}lQCaGxntl^%_%EE^_6KzdRNwdY|pT}CK!xRZbBd@86jj7{?A&j>(eI)ORUKa;SM{Y zs}(5MSo|hOu6y@$(mc)XYvT|uPz9MK`w^lmowq`%OS%Vz#JoX1GV!5%+Eg;-u$2KV zrd{UA9GaU^GxKU6#^)mYg3R_}G_;gVA-c;pRbOe)g?gpAVGkP#vtq>6pmvWh6BUv9 zo6sZ}jjRzZ9g21kz0^$!^|?;^iBJImPduZmoX6TbX?-v~G=6ydw|17S62YXmwxb)uby>$I?=h08G?iM-Ts47o@#t#k)CrZiD(jJa2|z zk>bm#JyLTv&3Qii*Hxva-5oIL%7ni$mr_i5?1Pzs7}Isfg6*(0zTuhrikQ*{7{*mOGppsye1xbm9Mg(fBWkqnuZwt1Q} z3uq%~n1T$r^^0E1xx{&Vm?h9{Y zXFd59fX8#W$O^JdNbbT-P0I{tjsEA~lxXrzGigP`Uqo9vyh^<- zu(^??Mq6@4dC|eQFqu-a8@HW!GH*D|bKZFQAUP;Urok#kBS`4LQbLgoX@ zF7t`)P^G$5$edr0jh7(Y5P7bYK6IjIZ@-#-f2&`y|In9b{k+Mt+!|H6!QtP}(5`fO zx$DChaicC6e6jc{ef*FrY7K@ySGOy9SLdc4zyPt#UdR+BE--qt zrJ{G@VhgIgV2aO-n?Hj&4@njBSfi*6#XLrodLvAYDAmn3-9e0FAMpjPd9z0j04w5+ zMvfx>*?;ugM9Xbs*~JZ9;;N=6D=(HHb1Re(DRL>uxTy})BToLSIVJ6~{62BneYm<$ zfK~^9d+Ds<$PwAPkG}p-61fyIlhfG8>UyG%=27!fVh9}MqO;eSsYczxJ|?9Ni*5PC!=I- z-dhC@F{MUViJ6FN5gV--{zRj?T0bj>q?^DDT|g-scNi2 zT(o@L&KLpVtZR7>sGBh%ymEF<{2lUP5#t)`Fn=IENqzH|ri}T)#26aQxX4oFWp$cU+Yi z$Z~11Uv)9}&*&=4it(9xI7|ka9RQ@xhif;~JjsjXvhspXB*##Ps*>(2SmRL6Mb*0e zAh16s{tMTVtx z8D2WFzdE<9&vb8qhiGtW)mH=+@7ix#>^ODkrCV{{dAt?e&n5Nq0{{H1I=P&HN89}JN*_Zm zaan%Rq`#9Mt!?Gr83DSCeOr@}K^M4bOqm=KnOYU!+GcY7#U?o2J@B;h)o}zfqS0<(U2OT5 zV%f+CsPO*z`znOXrZag(a>QBdPIB}kinYFpThF#-e)3`p@*!5YKkQc#xr8P?V}nmq zplkg_QAG@iY6FG5$c>En7Vn$;B9U9ybu3pc9_)gRA!99C{ zi110z3C$#mczE>ggCDx2q~u_|JZ(=kuc3_8$E_&^x;9b!X-D)X)i6;r z<43bM<(BQ)BZw|V5=i{Ejt{6C)py3tIx?CWnWE5bh54#u@=hvpN!Z&~fi6$qgJxs?UQ?g`TcXHbK zyp&2S!tArV5X1vOj9nQIbS%vLr33pYW?A)*%+EDHUZ23`m!GN`(_4<9=&@0Lygs(Y zp^s*@<(&3U`>sLO&z|mZ?pP|vG+J*nWV>mDgCVa7KJ}Hwqa3aN2Y_d<3=aUI2Y_p) zcqyGQPs4W$x+eMF4@7M=jUH?)t!fw{KH>?c26Q!!@5>?STX+6Gca3l; z8-`}~93A!3bJ}d*x*OZ*N)`rPo)WYsHMcsa$XvpPN{(<$PSKb#&BNiiT@N1bC+IEv z&DN!ob;`R?tumf>Gb=k^c(47;3+!%sNNv4Xm?p}Ae31HgAv-pqT4i}Jezz{6m+ zYFBXM{Q&3z!1(`Mnsejd*PJD;bf{9cZ!?^=Y5v;g-jJ)*p7j0cI6YEI4f zJ$-^F2EBdZ0OD}+Vi)Zc_^<2;_C0swx~9$tuU8G}Cp#ohDqmiW6g9I+9Z|j`q-1`l zw9Ad$#*j&=^o{6VKGz}^7QoFGh3CR4%oY&o+TCH_mZ(&9S@MirWER-+$tj(_Rg*kT zJX7B?QHvlNV)u+-CV9Etl{P?lT3WkG>wv?6s?c}#Jshw4PQM+gY2dkOzvd`V-0Pgp zEwuNd166s>_0NS*|glXDcDeu^CDSn+1MVpERiS(Mft{xW1`Zr z+E_QAbJVy7p3*J0*5I(Alj8t0=(8m8OQXWdTOrW+I!IcQ*}%H=?w`pj1H&@MovSMS z=f<*h$i?bfq#vcDaCh)h({|9#ZF<^wYX0M!w2@xmYbd|Y2$BkM5z z*r+YkdqZ__$VE*V&yTBa5*`WSzLLI@`sPNhzjqrA67=(CY^ubFYY>xaNbn%^n!XVg z1k&yrblTcK(gv1dqP9youwTn6J3wix zqJrdDAqkXAg#b*ITDCln#bmw|*kf+-?|ffaB<%M$ZUp@!E4bws;6m4HQh4+gl}#1> z6q|Iu5f&S>Ib_6g8+PGFr}%E5kl?#U8S&JUL&?Zgslb77#JO)EAaJ+`C?DNSZ(%Cf z)u8hUMO0OqjaN0*v~%^(h>L5s4Q=iAvC~7;*y=f6GI z0lsM`NeG%W*dCi^i9$@!lkg@(Oz-;pBB50G1xwSUDk+rP;aCnz$Hx_1( zzsmi#Lz1ZXEVC@FWQ+RQfdEaSzeN8`Xn?bF>D#X3oJwgZib$boOPt-Sv5TpGf5w?5 zHlSgCVY&U=VScmr{*j!&N=ODdecNp45K74BNFYR#SF8oAOH`U5CNr0931aRli`6jG zn-GxhUQm6W2)Mpi9+ z?4#N}%aoF}H?H;_2HbA_b*MaSl{ZD30tbmx_{B%kp}Y(qk6qG3jW$&wX==tV1po*qML(qN7WaFho{5 zlR<-JIkTJEwzf4?>*S5EzFk2qpfXRG#_h)W7vV$N-&9bkO~H1T+CML&XfAH_ZwbNZ ziWREqA_$x-<(|2(1#68*se)Z1YJ|TSRZbQAdz->_Qwjz!IRv0CN`Fq+_8$ui$gf4u!0QwEv7o7x3wIHMVVWWgdC>5-J}(id22S)|v9 zMaga;uXkM{E&D4tK5ZRQq&*{!y2C=CDX7oNO0AQ0g1syAZ|u8XNV67Yba- zxS~n(GxowLc~(o+k5&|`vc^1lZXsO0+E7PtRpRulQEOx+*CjmgeQ_yy*NywQ5zP$d zsFRgx+3cu>HUb2223;eO-zo7qB?2{Sy0Bb>|;^-Qo4N zB+qvq$ySHUUH%%ynVPBs@g6F2e27i4FF5?;Lgdj-zeg+FUQd#>b#Bqh&Eve{ip#hZ zD#UgKQRQ>0p`AEcr~OG8`&x(7>`)I?FGicvA5-~bp)L49PTA%9%eR!-mPnf^)6hQK z!{ZbfeCU|%&wCnSM>|LI`M50(0Ip>A9iGrt`TAGx!i&-HP@emtZ%%m)om`)~=j`Z# zPH@#7p{q?+W+h{tagGlo;~M1mMZuDNd!U4l@|xx#4nG}NfdHcyzqD8lOcah`<<>xp zj_&@@Aoqdv$|HBPipbjGvAd?_ls6u$?=Fu)tXoYCvZ){gZjNwlZt7dBXl6b^CSx<} z64r_3dw9llRKV!S8rtrY=b5II43T?RdwdqGx;*+Sv+*@0);73+fH&;ta5}Z~5y}6? z5L;C3p!d(9LY-Eg*4kq#p69MK!nJ(Ox?F%hk(d~b%>;KrXd(ePkbu5^ZCN+-jYPt) z%jZlzx-@cBzgO(v&sjZV|FHSNW^^H3SEtH%_kEk*>tKttxmvSL-;CL_UHoZ|8bg%| zOwYc`9bY%7=~}mR z62`;ES{Yw19R|C=xg!rY^*?!5f}U-|ejx<{6FSg?B3Ap+zBvR4P|y|ZIwH`(6l{B@ z(>YJ%@=Kb4x!jVYqV5b8OLHxNEGJ{l7#m|D0;k@|F~sAWC#0 z!ucnY z!w|jCM;B5@vFS|?mR1)U#x)Hj)Cdvv12K;c^C`8#7F_zRMs;SWv~yI8kmp%s%Y3o0 zif8rkkc|&my6?G?8SRkUSQ+O8GpSRnzKy~Ohy^&hQduh>7YK)IK6M98WQ=$w9Fx#) z-PMWKwIH4AJ=(Tp_q@;eln4IKLlW=m^Ka-Ka}8Vo83q9lpn|GMZMtRkW7dHdD?g4J ztm=(gG#7fey4vKa=!)tsd8rfOamCK-(wE5?eBooCpl)r}LU`}~Ed`z6Iq3typWTP~ zp;z`=z?NTaKYZ8Pz6u}TP%<4uS2Qq@iyw+|2i8Dhk6BPu$Tj%>x#KRPNLI}HObvGs2j`ySAS1m0<5z=P2-RjTCo6k`4Zwc;uY3Is@f2 zTvsk|si^wWR@irq!LlW-K(4&crrxnAi+Dn*-8e#pwiC9bp~$zOXJ2f3e|ogYMITOT zhWk9siq8nZ7QPowcy4>j+L@Z%?g-lv%$71AIBxx)qB5DZRz@SAD*}0#t@CKc(LP4pWk+oU6<4(~^vQ9n9Vq9p@eA|dHud_YKHzKotJo_R1(QNbdc6zVTG|4Ob#{7p4gR8$ z6~)Zf0n+ol`^T{G4+E!?pD+Xj)k3lB`e3fd#$mm@&tN0QSgrufGHY+j#J7II9!W<+=*C>fa!a@Ad zA0GvQU)cnj0Y{&lIte$rrK&HUJlMu-bxn-zv#QD><0Q;@FyhUhR~qYDq=?{`kIn{) z=gsYe4Z(l_xDi||M9S^ly+>zWx|H;Y^_>ih_5mEno*OsO=~ruKiTt~%GQ)ZcmEi*esWBw*1de+Zk5d5Or8li&|%iqwqf z0y9hVEAQNKg$yH|@VleY@tatr-n@OSY$>benh|fpcTt0IiiJ-mWy?qM(zh==Dt(P3 zpTFv>u}s9ffxESLegDlu0DuO9AN0qWXsyF7o;&FeU3K%WAPihyJ?MXf;1>*b;npW_ z#N`yUrZ`CAf1zxJB(;C;w}nL%Cq3wMmZrxloQce$`pzFl-CCNQWN oupk{7_U}2ye>=wCH~vQ8Zv_5E;BN%}M&NG*{vSd>@}U2J0fmpNLI3~& literal 0 HcmV?d00001