Cybersecurity, Hacking and stuff
Writeup for the “SNES repo” challenge created by Rastislonge for the Hackfest CTF 2024. For this challenge, you’re given the address of a TCP server and the source code: -- base64 decode local b64chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/' local b64map = {} for i = 1, #b64chars do b64map[b64chars:sub(i, i)] = i - 1 end local function base64_decode(data) ...
Writeup for the “Don’t Trust Developers” challenges created by FLR for the Hackfest CTF 2024. For these challenges, we have access to a team on GitLab containing four repositories. The goal is to obtain the flag hidden and masked in the pipeline variables with a user who has restricted permissions. Don’t Trust Developers I In the first repository, we only have a simple pipeline. stages:...
Bookworm is an Insane-difficulty machine from Hack The Box. We will exploit an XSS vulnerability to gain access to a grandfathered feature accessible only to a few users. Subsequently, we’ll leverage a Path Traversal vulnerability to acquire an initial password. Then, we will exploit a bug in an internal HTTP service to pivot to another user. This second user will possess privileges to a system...
Writeup for the “Valhalloween” challenge created by Hack The Box for the Hack The Boo 2023 CTF. For this challenge, multiple Windows Event Log file is provided along with the address to a TCP server: forensics_valhalloween.zip The server asks us a series of questions related to the logs that we must answer correctly in order to obtain the flag. The tool chainsaw makes it easy to search throug...
Writeup for the “Pinata” challenge created by Hack The Box for the Hack The Boo 2023 CTF. For this challenge, an executable named pinata is provided along with the address to a TCP server: pwn_pinata.zip RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE Partial RELRO Canary found NX disab...