DMU Hackers · Flagship CTF

Pwn2Play

A jeopardy-style Capture The Flag competition run by De Montfort University's cybersecurity society. From web exploitation to OSINT, binary exploitation to cryptography · Pwn2Play tests competitors across the full attack surface. First run in 2025, it has quickly become the centrepiece of DMU Hackers' calendar.

Visit DMU Hackers GitHub · Challenge repo

2025 First year ran

50 Challenges (2026)

12 Categories

6 Max team size

Hybrid In-person + online

Involvement

My role across both editions

2025 · Inaugural edition

Health & Safety Officer, DMU Hackers

As H&S Officer I helped plan and deliver the first-ever Pwn2Play. Alongside the committee I worked on event logistics, venue safety, and participant welfare for what was a brand-new competition. I also wrote the B.P.O challenge · a multi-artefact historical cryptography puzzle involving a Typex rotor cipher machine.

First edition · Challenge author

2026 · Core Incursion

Chairman, DMU Hackers

As Chairman of the society, Pwn2Play 2026 is my event. I oversaw the full competition design: expanding to 50 challenges across 12 categories, securing sponsorship from Kit365, TryHackMe, Immersive Labs, and Yubico, bringing in external challenge creators, and establishing a hybrid in-person / online format at Gateway House, De Montfort University.

Current role · Competition lead

2025 · My challenges

Pwn2Play 2025

B.P.O

Miscellaneous Medium Author: T.A.R.S · Pwn2Play 2025

Scenario

A rusted field case is discovered at a decommissioned signals facility near Bletchley Park. Inside: wartime documents, six damaged forensic artefacts, and a reel of encrypted radio traffic dated February 1944. The cipher system used is unclear from documentation alone.

Objective

Recover all required cipher machine settings from the six clues, then use them to decrypt the provided ciphertext. The machine in question is a Typex · the British military's rotor cipher machine, the closest Allied equivalent to the German Enigma.

The six artefacts

Audio recording · rotor clue
Video file · ring setting clue
Image · initial value clue
Network capture (.pcap) · plugboard clue
File metadata · rotor clue
Encoded data · final rotor / IV clue

Five artefacts yield rotor settings (Rotor · Ring Setting · Initial Value). One yields the plugboard configuration. All six are required to reconstruct the full Typex key and decrypt the intercept.

Flag format

P2P{…}

Machine type

Typex
British WWII rotor cipher machine. 5 rotors, reflector, plugboard. Operationally similar to Enigma but considered more secure.

Skills tested

Steganography Audio analysis Metadata forensics PCAP analysis Historical ciphers Encoding

Repository

View on GitHub →

The Numbers Mason

Cryptography Easy Author: T.A.R.S · Pwn2Play 2025

Scenario

A short-wave intercept lands on a Cold-War listening post, addressed to callsign RED OCTOBER. The transmission is clipped, in Russian, and ends with a repeated string of decimal numbers — the kind of numbers-station traffic that runs to a recipient who already has the pad in hand. The package was intercepted in Sector 4, extraction is incomplete, and Archangel Depot is warning that local assets are compromised. The numbers are the key.

Objective

Pull the repeated decimal byte sequence out of the transmission, treat it as a one-time-pad key, base64-decode the accompanying ciphertext, and XOR the two together to recover the flag. The OTP guarantee of perfect secrecy holds only when the key is used once — repetition is exactly what makes this transmission solvable.

Provided artefacts

message.txt · Russian-language intercept carrying the base64 ciphertext and the repeated numeric pad
transmission.wav · audio carrier of the same intercept · ~2 MB

Both artefacts encode the same payload through different channels. Either can drive the solve; together they reinforce that the numeric sequence is the intended key, not flavour text.

Flag format

P2P{…}

Cipher type

One-time pad (XOR)
Provably unbreakable when the key is truly random, secret, and used exactly once. Reusing the pad collapses it into a stream cipher and hands the plaintext to anyone listening.

Skills tested

Audio analysis Base64 XOR / OTP Decimal encoding Cold-War cryptanalysis

Repository

View on GitHub →

2026 · Core Incursion

My challenges for 2026

Five challenges written for Pwn2Play: Core Incursion (30 May 2026). Now the event has run, each one is unlocked below — open the on-site challenge pages and read the writeups.

Miscellaneous ?

BIKINI State: RED

A classified signal has been intercepted. Recover the message before the window closes.

Open challenge Writeup

Web Series I – IV

The Sign of Four

Four-part web exploitation series. Each stage unlocks the next. Deduction required throughout.

Writeup

OSINT ?

The Cutlery Drawer

Everything has a place. Find what's been hidden in plain sight across open sources.

Writeup

Cryptography Hard

Concordat

Three Cold War intercepts, three services, one combined flag. Solve each leg, assemble the fragments at the operator workstation.

Open challenge Writeup

Crypto · Stego Insane

The Baker Street Affair

Belle Époque, summer 1908. Two intercepted documents, two perspectives on the same theft. Reconcile them — and find what the censors didn't want sent.

Open challenge Writeup

Event details

Pwn2Play: Core Incursion · 2026

Date: Saturday 30 May 2026 · 09:00 – 18:00
Venue: Gateway House, Floor 5 · De Montfort University, Leicester
+ virtual participation available online
Format: Jeopardy-style · 50 challenges · 12 categories
Teams: Up to 6 members · Open to everyone
AI rules: AI tools prohibited on the main scoreboard.
Separate AI scoreboard available for those who want to use them.

Challenge categories

Web Exploitation Reverse Engineering Miscellaneous Forensics OSINT Scripting Cryptography Linux Binary Exploitation Full PWN Code Introductory

Prize structure

1st

First Place Faculty-signed certificate · Challenge Coin · 4× 6-month TryHackMe Premium

2nd

Second Place Certificate · Challenge Coin · 4× 3-month TryHackMe

3rd

Third Place Certificate · Challenge Coin · 4× 1-month TryHackMe

Sponsors & partners

← Back to Projects dmuhackers.com