PEMogite

Platform: spbctf | Category: Crypto | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: certificate_inspection

Summary

Task: Analyze an X.509 PEM certificate file. Solution: Use openssl to inspect certificate fields; flag was hidden in the ST (State/Province) field.

PEMogite — CryptoKids 2.0

Description

A task on analyzing an X.509 PEM certificate. Given a certificate file in PEM format (base64-encoded).

Analysis

PEM (Privacy-Enhanced Mail) is a format for encoding binary data in base64 with characteristic headers -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

X.509 certificates contain multiple fields:

• Subject (CN, O, OU, L, ST, C)
• Issuer
• Validity (Not Before, Not After)
• Public Key
• Extensions

The flag can be hidden in any of the certificate's text fields. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: View the certificate

 bash read-only • copy allowed Copy
openssl x509 -in certificate.pem -text -noout

Step 2: Analyze Subject fields

In the openssl output we see the State/Province (ST) field:

Subject: C = RU, ST = Saint Petersburg, spbctf{REDACTED}, L = ...

The flag was embedded directly in the ST (State/Province) field of the certificate.

Alternative method

 bash read-only • copy allowed Copy
# Decode base64 and look for strings
base64 -d certificate.pem | strings | grep -i flag
base64 -d certificate.pem | strings | grep -i spbctf

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍