Cybersecurity, web security and internet nuances
Recommended: Full video write-up ezmd - web (Unintended solution) author: rainhurt Challenge description: Yet another markdown renderer… Number of solves: 5 Points: 733 attachments: ezmd_(…).zip I was solving this challenge together with my teammate drbrix tl;dr bypass dom purify for fname parameter with replacement manipulation bypass setJavaScriptEnabled(false) by opening an iframe which opens…
Recommended: Full video write-up dummyhole - web author: RyotaK Challenge description: Is this a hole or…? Challenge: http://dummyhole.seccon.games Admin bot: http://dummyhole.seccon.games:1337 Number of solves: 15 Points: 233 attachments: dummyhole.tar.gz tl;dr couple of interesting exploits chained: image/jpeg+json / image/png+json allowed as they are checked with just .startsWith('image/png')…
control - misc author: chop0 Challenge description: Design a controller for a digital power supply! nc ctfi.ng 32727 Number of solves: 36 Points: 159 attachments: ctrl.py Dockerfile The Challenge Basically the ctrl.py file contains a simulation of an electrical control system with some noise. It loads our WASM module and check if a our code can track the target waveform close enough. If our code…
sekai-craft - rev author: es3n1n Challenge description: Developed/tested on 1.21.8. When you click the button, Minecraft can freeze for a few seconds… this is normal. It can also crash due to OOM (out of memory)… this is normal too. Wrap result string in SEKAI{} before submitting. Download pack: mvm.zip (provided by organizers). Number of solves: 35 Points: 187 tl;dr The datapack ships a massive…
Meme Launcher - blockchain author: snwo Challenge description: Your meme coin goes to moon When challenge is deployed by the launcher, it forks from mainnet. meme-launcher-dist.7z Number of solves: 13 Points: 326 TL;DR The manager exposes a custom swap() implemented in Yul. It parses raw calldata (custom layout) and–for dir=1 legs– pays the router in ETH from the manager’s own balance instead of…
diceon - misc Challenge description: Please enjoy each flag equally. (You can test locally with the provided dist package, you will need an OPENAIAPIKEY) dist.tar.gz Number of solves: 13 Points: 233 The AI Challenge After launching an instance, we were greeted with the following: Additionally, after going with the [OBJECTIVE] button, we saw the objective of the challenge: To summarize the above,…
Ez flag v3 - web Challenge description: To get the flag, you need: the mTLS cert, connecting from localhost, … and break physics? Should be easy! Challenge note: the handout files contains tls internal while the hosted challenge mostly use real TLS. NOTE: Remote is working as intended! Even with the redirects. Number of solves: 93 Points: 146 notice: all \{\{ and \}\} were without a backslash, but…
KalmarDSL - web Challenge description: A !flag in my diagram? Hopefully someone has already patched the C4. Note: The setup has no Structurizr users and default creds are not supposed to work. Bruteforce is not allowed (and will not work). Goal is Unauthenticated RCE, 0day go brrr? Number of solves: 14 Points: 366 The Challenge The intended solution as mentioned in the description is…
The description of the challenge is as follows: It’s not cryptographically secure random, but I think it’s good enough. (10 solves) Additionally a netcat service is provided, that runs the following: import binascii import random def xor ( * t ): from functools import reduce from operator import xor return [ reduce ( xor , x , 0 ) for x in zip ( * t )] def main (): flag = open ( "flag.txt" , 'rb'…
The challenge is a simple express app with a bot and a very strict Content Security Policy (CSP) , which allows only for injected in-line javascript within <script></script> tags, and script from the same origin. The bot visits the page, types in our HTML input, submits it and takes the screenshot of the page and sends it back to us. Unintended solution We force the bot to open the /script.js…