CTF Write-ups
I sometimes write-up solutions to CTF challenges I’ve solved, or at least helped solve. It helps me process and better understand what I learned during the challenge.
My write-ups
corCTF 2024: web/erm
Solution writeup
Starting point:
erm guys? why does goroo have the flag?
- live challenge link
- erm.tar.gz containing app source
First impressions
It’s a library of fake CTF challenge writeups!
The tarball contains everything needed to run the app locally, and the ORM code in db.js helpfully generates random data. The flag is a field on goroo’s Member object, but the endpoint app.js provides to list users only lists the ones who haven’t been kicked. Unfortunately, goroo was kicked :(
corCTF 2024: web/rock-paper-scissors
Solution writeup
Starting point:
can you beat fizzbuzz at rock paper scissors?
- link to instancer
- download link rock-paper-scissors.tar.gz
First impressions
The challenge app is a small rock, paper, scissors game against the server. Users are prompted to enter a name, then presented with an animation, “rock,” “paper,” and “scissors,” buttons, and a scoreboard link. Fun!
Name submission is via POST with a JSON body like:
{"username": "your_name_here"}
Gameplay involves pressing buttons, and receiving a point for each win. The score resets and gets registered on the scoreboard when the player loses a round.
Don't BF Me! (WeCTF 2020)
Solved solo!
The Challenge
| Category | Key Exploit |
|---|---|
| Web | Variable injection |
The handout contained server-side PHP code and the HTML for a small website with a password entry form. There was also a Dockerfile in there, so players could spin up local instances for testing.
Original Prompt
Shou uses Recaptcha for his site to make it “safer”.
Hint: The password is so long that makes any bruteforcing method impotent.
Handout: https://github.com/wectf/2020p/blob/master/dont-bf-me/handout.zip
Summary
The files:
KVCloud (WeCTF 2020)
This solution was developed by teammates Jeff Delamare, Lydia Doza, and Evan Johnson (me) through several hours of remote collaboration.
The Challenge
| Category | Key Exploit |
|---|---|
| Web | Server-side request forgery (SSRF) |
Challenge info can be found here. Many thanks to the challenge authors and WeCTF organizers for putting this one together!
The target was a server running a vulnerable Flask application. The app’s “official” function was to serve as an intermediary between users and a Redis database, but the intended solution did not involve compromising the database.