Recent content on Jett's blog
We ranked #10 globally in PicoCTF 2024! Elements This problem is essentially an XSS + CSP bypass. The XSS part was easy: we need to construct a dependency tree to build the XSS element. For this, I used topological sorting. import graphlib recipies = [['Ash','Fire','Charcoal'],['Steam Engine','Water','Vapor'],['Brick Oven','Heat Engine','Oven'],['Steam…
Recently, a federal judge ruled against the Internet Archive in their mission to preserve ebooks. While this doesn’t have anything to do with the WayBack Machine, it led me to wonder: why do we need a centralized platform to take and share website snapshots in the first place? Why not let users take them themselves and share them around the internet? The answer to this question seems obvious…
Recently, I have been playing around with shodan images, a service provided by shodan that aggregates screenshots of accesible videofeeds over the internet of things, including a lot of windows login screens and webcams. The catch is, while they provide the screenshot for the users, shodan provides absolutely no hints as of how they obtained the screenshot. Shodan claims that they grabbed those…
About: TIL TIL stands for “Today I Learned,” and I plan to write a TIL post whenever I discover something interesting. It could be related to anything: from technology to life. This is inspired by 100daystooffload and various TIL posts I found over the internet. This can motivate me to keep finding interesting things to learn and experience, improve my writing a little bit, and, most…
Recently, my favorite tv show, Better Call Saul, has ended, and it ended spectacularly Midjourney is a public-facing text-to-image generator that I found often more fun and artistic than DALL-E. To pay tribute to this amazing show, here are some Midjourney generations regarding BCS. It’s really amazing how the model captures the show’s visual style, and might have predicted…
Problem Analysis Analyzing the pcap file, we shall see that there are a lot of /anticheat?x={x_coordinate}?y={y_coordinate} requests. Given the amount of coordinate data, it would make sense to plot these. Solution Required python modules: parse: The opposite of format, used as a convinent replacement of regex. numpy: Numerica processing matplotib: Plotting Data processing from parse import * with…
Problem description The problem starts a docker instance, which could be connected via netcat. This shows the following interface: [*] Directory to work in: QV35hifhJuQ2tO7nNnKNDf30JmUxfAej Component List: +===============+ | | | 1. Head 🤖 | | 2. Torso 🦴 | | 3. Hands 💪 | | 4. Legs 🦵 | | | +===============+ [*] Choose component: Choosing any of the components shows the following interface:…
Problem description The challenge has a downloadable part. After extracting the zip file, we have a NTUSER.DAT Prerequisites NTUSER.DAT is a windows generated file which contains the information of the user account settings and customizations. After some research on the internet, I fond that Regripper and RegistryExplorer are the two useful tools of conducting forensics on NTUSER.DAT files.…
The Problem nahamcon ctf page Preprocessing Downloading the three files, we can see that we have a python program ostrich.py which takes each character of the flag, make some modifications to ostrich.jpg, and store it as a frame in result.apng. First, extract the pictures of result.apng to a folder: from apng import APNG im = APNG.open('result.apng') for i, (png, control) in enumerate(im.frames):…
The problem link to the problem(requires login) Solution First, connect to the remote server: nc 51.124.222.205 13379 After interacting with the server, you’ll find that the server is a python REPL with a lot of charcters and functions such as " unavaliable. This type of problem is called python sandbox escape, or python jail. After trying all the commands from the internet, you’ll…
The problem link to the problem(requires login) Solution First, download the zip file, and unzip it. You should see the file lsass.DMP To check the filedump type, use the file command: file lsass.DMP output: lsass.DMP: Mini DuMP crash report, 16 streams, Sat Apr 9 02:47:27 2022, 0x421826 type After a google search, the term lsass stands for “Local Security Authority Server Service,”…
The problem link to the problem Hints Read about “timing-based side-channel attacks.” Attempting to reverse-enginner or exploit the binary won’t work Run the attacks against the pin_checker binary Solution Running the binary A problem that would likely occur when solving this problem is running the binary. The binary provided by picoCTF is not compatible with my local…
The Problem is the following: Download & extract the image Run the following command: wget https://artifacts.picoctf.net/c/336/disk.flag.img.gz gunzip disk.flag.img.gz a file named disk.flag.img should show up at your working directory. Finding the flag with autopsy In the following steps, I will demonstrate how to extract the key with autopsy, the graphical user interface for sleuthkit. This tool…
Hello, I’m Jett(16yo; he/him; Shanghai, China). I am interested in cybersecurity, machine learning, computer graphics, and all things related to technology. In this blog I will post my CTF writeups, articles about machine learning, programming, life, and other random articles. My projects Scan For Webcams: Scan for webcams on the internet Scan For Wallpapers: An AI wallpaper recommendation…
email: contact@jettchen.me Twitter: @jettchen5