diff --git a/1337UP LIVE CTF/Keyless/README.md b/1337UP LIVE CTF/Keyless/README.md index af84ca2..2d625ca 100644 --- a/1337UP LIVE CTF/Keyless/README.md +++ b/1337UP LIVE CTF/Keyless/README.md @@ -60,5 +60,5 @@ Run the script and voilà! ![flag](images/flag.png) ``` -HackTM{Timisoara} +INTIGRITI{m4yb3_4_k3y_w0uld_b3_b3773r_4f73r_4ll} ``` \ No newline at end of file diff --git a/Cyber Jawara 2023 - Umum/README.md b/Cyber Jawara 2023 - Umum/README.md index 7c00dae..2b8a85f 100644 --- a/Cyber Jawara 2023 - Umum/README.md +++ b/Cyber Jawara 2023 - Umum/README.md @@ -3,5 +3,5 @@ CTF writeup for The HackTM CTF 2023. I took part in this CTF competition with No | Category | Challenge | | --- | --- | -| Web | [Static Web](/HackTM%20Quals%202023/Blog/) -| Web | [Magic 1](/HackTM%20Quals%202023/Blog/) \ No newline at end of file +| Web | [Static Web](/Cyber%20Jawara%202023%20-%20Umum/Static%20Web/) +| Web | [Magic 1](/Cyber%20Jawara%202023%20-%20Umum/Magic%201/) \ No newline at end of file diff --git a/NahamCon CTF 2023/IR #2/README.md b/NahamCon CTF 2023/IR #2/README.md index 351f165..9621fc9 100644 --- a/NahamCon CTF 2023/IR #2/README.md +++ b/NahamCon CTF 2023/IR #2/README.md @@ -14,5 +14,5 @@ So I tried to check the browser download history and I got nothing, and then I t ![flag](images/flag.png) ``` -HackTM{Timisoara} +flag{75f086f265fff161f81874c6e97dee0c} ``` \ No newline at end of file diff --git a/README.md b/README.md index 2654828..3dd0fe7 100644 --- a/README.md +++ b/README.md @@ -126,6 +126,8 @@ List of CTF events that i have joined before | TSG CTF 2023 | Yes | [Link](/TSG%20CTF%202023/) | | 1337UP LIVE CTF | Yes | [Link](/1337UP%20LIVE%20CTF/) | | NewportBlakeCTF 2023 | Yes | [Link](/NewportBlakeCTF%202023/) | +| Hackappatoi CTF '23 | No | - | +| pingCTF 2023 | Yes | [Link](/pingCTF%202023/) | ### Local Events | Event Name | Writeup Available? | Writeup Link | diff --git a/pingCTF 2023/README.md b/pingCTF 2023/README.md new file mode 100644 index 0000000..5d1adc6 --- /dev/null +++ b/pingCTF 2023/README.md @@ -0,0 +1,10 @@ +# pingCTF 2023 +CTF writeup for The pingCTF 2023. I took part in this CTF competition with the TCP1P team and secured the 18th place out of 794 teams + +| Category | Challenge | +| --- | --- | +| Web | [i-see-no-vulnerability](/pingCTF%202023/i-see-no-vulnerability/) +| Web | [youtube-trailer](/pingCTF%202023/youtube-trailer/) +| Web | [internet-explorer](/pingCTF%202023/internet-explorer/) +| Misc | [internet-cat](/pingCTF%202023/internet-cat/) +| Cryptography | [hard-work](/pingCTF%202023/hard-work/) \ No newline at end of file diff --git a/pingCTF 2023/hard-work/9cddbd472fe3ad694468f3799cb80e08.zip b/pingCTF 2023/hard-work/9cddbd472fe3ad694468f3799cb80e08.zip new file mode 100644 index 0000000..7864189 Binary files /dev/null and b/pingCTF 2023/hard-work/9cddbd472fe3ad694468f3799cb80e08.zip differ diff --git a/pingCTF 2023/hard-work/README.md b/pingCTF 2023/hard-work/README.md new file mode 100644 index 0000000..723041b --- /dev/null +++ b/pingCTF 2023/hard-work/README.md @@ -0,0 +1,19 @@ +# hard-work +> You've received a cryptic message from your boss at the company. Apparently, your aggressive demeanor has raised concerns, and your paycheck is on hold until you decipher the hidden magic message. + +## About the Challenge +We were given an encrypted msg (You can download the msg [here](9cddbd472fe3ad694468f3799cb80e08.zip))and we need to decode it + +## How to Solve? +Upload to cyberchef and then use this options: +* Hex +* Octal +* Binary +* Hex +* Base64 + +![flag](images/flag.png) + +``` +ping{patience_is_the_key_to_tranquility} +``` \ No newline at end of file diff --git a/pingCTF 2023/hard-work/images/flag.png b/pingCTF 2023/hard-work/images/flag.png new file mode 100644 index 0000000..af451e9 Binary files /dev/null and b/pingCTF 2023/hard-work/images/flag.png differ diff --git a/pingCTF 2023/i-see-no-vulnerability/1c24ae229fff8eb7ac53c1252e52b12e.zip b/pingCTF 2023/i-see-no-vulnerability/1c24ae229fff8eb7ac53c1252e52b12e.zip new file mode 100644 index 0000000..75baa48 Binary files /dev/null and b/pingCTF 2023/i-see-no-vulnerability/1c24ae229fff8eb7ac53c1252e52b12e.zip differ diff --git a/pingCTF 2023/i-see-no-vulnerability/README.md b/pingCTF 2023/i-see-no-vulnerability/README.md new file mode 100644 index 0000000..a5f1705 --- /dev/null +++ b/pingCTF 2023/i-see-no-vulnerability/README.md @@ -0,0 +1,83 @@ +# i-see-no-vulnerability +> With AI we are entering a new era! Join us in this exciting journey with our visionary app! + +> When solving this challenge a new one will be unlocked which is a sequel to this one. + +## About the Challenge +We were given a website and a source code (You can download the source code [here](1c24ae229fff8eb7ac53c1252e52b12e.zip)). And this website has a functionality where the uploaded images will be read using OCR, and if text is found in the image, the text will be displayed on the website. + +![preview](images/preview.png) + +This is when I uploaded a photo containing the text `Hi daffainfo` + +![preview 2](images/preview2.png) + +## How to Solve? +If you look at the source code, our input will go into a script HTML tag and div tag + +```html + + + + Image {{IMAGE}} + + + +
+
+

I'm a visionary!!!

+

I see...

+
{{VISION_TEXT}}
+
+
+ + + { + const { uuid } = req.params; + if (isValidUUID(uuid)) { + const unsafe_text = visionedDict[uuid]; + if (unsafe_text === undefined) { + return res.redirect("/"); + } + const text = DOMPurify.sanitize(unsafe_text); + const page = readFileSync("./templates/result.html", "utf8") + .replaceAll("{{VISION_TEXT}}", text) + .replaceAll("{{IMAGE}}", uuid); + res.send(page); + } else { + res.status(400).send("Invalid UUID"); + } +}); +``` + +This is the final payload I used to obtain the flag: + +![payload](images/payload.png) + +Upload the image and then press the report button + +![flag](images/flag.png) + +``` +ping{a2cfbb9ccd0d1b649cbf99669930092b} +``` \ No newline at end of file diff --git a/pingCTF 2023/i-see-no-vulnerability/images/flag.png b/pingCTF 2023/i-see-no-vulnerability/images/flag.png new file mode 100644 index 0000000..407839f Binary files /dev/null and b/pingCTF 2023/i-see-no-vulnerability/images/flag.png differ diff --git a/pingCTF 2023/i-see-no-vulnerability/images/payload.png b/pingCTF 2023/i-see-no-vulnerability/images/payload.png new file mode 100644 index 0000000..873fdd8 Binary files /dev/null and b/pingCTF 2023/i-see-no-vulnerability/images/payload.png differ diff --git a/pingCTF 2023/i-see-no-vulnerability/images/preview.png b/pingCTF 2023/i-see-no-vulnerability/images/preview.png new file mode 100644 index 0000000..3b5ce43 Binary files /dev/null and b/pingCTF 2023/i-see-no-vulnerability/images/preview.png differ diff --git a/pingCTF 2023/i-see-no-vulnerability/images/preview2.png b/pingCTF 2023/i-see-no-vulnerability/images/preview2.png new file mode 100644 index 0000000..8eca7a3 Binary files /dev/null and b/pingCTF 2023/i-see-no-vulnerability/images/preview2.png differ diff --git a/pingCTF 2023/internet-cat/80295df3cfa79de08064ddffed0deff5.zip b/pingCTF 2023/internet-cat/80295df3cfa79de08064ddffed0deff5.zip new file mode 100644 index 0000000..aad33fb Binary files /dev/null and b/pingCTF 2023/internet-cat/80295df3cfa79de08064ddffed0deff5.zip differ diff --git a/pingCTF 2023/internet-cat/README.md b/pingCTF 2023/internet-cat/README.md new file mode 100644 index 0000000..1045892 --- /dev/null +++ b/pingCTF 2023/internet-cat/README.md @@ -0,0 +1,48 @@ +# internet-cat +> I heard that there are is no official nc for windows and I love this OS! Fortunately, my black hat hacker colleague has sent me his forged copy that he intercepted from other hackers which have intercepted it from others and that from others... I don't know how many times it was intercepted but it works! I have tested it on my Windows 10 and it works like a charm! + +## About the Challenge +We were given a file called `80295df3cfa79de08064ddffed0deff5.zip` (You can download the file [here](880295df3cfa79de08064ddffed0deff5.zip)). Here is the preview of the program + +## How to Solve? +If you upload the file to an online malware sandbox (in this case, I am using https://www.hybrid-analysis.com/), you will receive a base64 string. + +![base64](images/base64.png) + +Decode it using `base64` encoding and you'll get a GitHub gist + +``` +https://gist.github.com/tomek7667/92393a59207d91379f9ee8785878b98b/e3dc6bb2fed39c0f9d3a74b30af09394174ef78c +``` + +If you open the GitHub gist, you'll see `Nothing to see here, move along.` msg. But there are 2 revisions here, open the first revision and you'll get a list of numbers + +![gist](images/gist.png) + +And then upload to cyberchef and then use this options: +* Octal +* Base64 +* Hex +* Base58 +* Render Image +* Parse QR Code + +And you'll get another URL + +![cyberchef](images/cyberchef.png) + +Open the URL and you got another string + +``` +UEsDBBQACQBjABpciVcFV6wiRQAAACcAAAAIAAsAZmxhZy50eHQBmQcAAQBBRQMIAOqNoUX0Z5cij1J6uViuJOT+jLbo0Tibnbs0x++zz1pfItBmkkebOjEsVMVAxWFcUO8yYdA4CXgjEECKzi+mBqdI+rjACFBLBwgFV6wiRQAAACcAAABQSwECHwAUAAkAYwAaXIlXBVesIkUAAAAnAAAACAAvAAAAAAAAACAIAAAAAAAAZmxhZy50eHQKACAAAAAAAAEAGAATmwIRiyraARObAhGLKtoBNqEVIIcq2gEBmQcAAQBBRQMIAFBLBQYAAAAAAQABAGUAAACGAAAAAAA= +``` + +Decode it again using `base64` encoding and you will receive a password-protected zip file. Crack it using john + +![zip](images/zip.png) + +Enter the password and voilà! + +``` +ping{u_w4nt3d_f0r3n51C5_4nD_y0u_g0t_17} +``` \ No newline at end of file diff --git a/pingCTF 2023/internet-cat/images/base64.png b/pingCTF 2023/internet-cat/images/base64.png new file mode 100644 index 0000000..30a3e58 Binary files /dev/null and b/pingCTF 2023/internet-cat/images/base64.png differ diff --git a/pingCTF 2023/internet-cat/images/cyberchef.png b/pingCTF 2023/internet-cat/images/cyberchef.png new file mode 100644 index 0000000..0c95941 Binary files /dev/null and b/pingCTF 2023/internet-cat/images/cyberchef.png differ diff --git a/pingCTF 2023/internet-cat/images/gist.png b/pingCTF 2023/internet-cat/images/gist.png new file mode 100644 index 0000000..36a3f2c Binary files /dev/null and b/pingCTF 2023/internet-cat/images/gist.png differ diff --git a/pingCTF 2023/internet-cat/images/preview.png b/pingCTF 2023/internet-cat/images/preview.png new file mode 100644 index 0000000..5b0f3aa Binary files /dev/null and b/pingCTF 2023/internet-cat/images/preview.png differ diff --git a/pingCTF 2023/internet-cat/images/zip.png b/pingCTF 2023/internet-cat/images/zip.png new file mode 100644 index 0000000..688e641 Binary files /dev/null and b/pingCTF 2023/internet-cat/images/zip.png differ diff --git a/pingCTF 2023/internet-explorer/README.md b/pingCTF 2023/internet-explorer/README.md new file mode 100644 index 0000000..c2642f4 --- /dev/null +++ b/pingCTF 2023/internet-explorer/README.md @@ -0,0 +1,20 @@ +# internet-explorer +> Can you run Internet Explorer on Linux? + +## About the Challenge +We were given a website without the source code, and this is what the website looks like + +![preview](images/preview.png) + +## How to Solve? +At first I tried to change the `User-Agent` header from `Windows` to `Linux` and I got another response: + +![linux](images/linux.png) + +So I googled and found a correct header for Internet Explorer in Linux + +![flag](images/flag.png) + +``` +ping{ping{the_best_browser_ever_made111}} +``` \ No newline at end of file diff --git a/pingCTF 2023/internet-explorer/images/flag.png b/pingCTF 2023/internet-explorer/images/flag.png new file mode 100644 index 0000000..5b9a208 Binary files /dev/null and b/pingCTF 2023/internet-explorer/images/flag.png differ diff --git a/pingCTF 2023/internet-explorer/images/linux.png b/pingCTF 2023/internet-explorer/images/linux.png new file mode 100644 index 0000000..6c85412 Binary files /dev/null and b/pingCTF 2023/internet-explorer/images/linux.png differ diff --git a/pingCTF 2023/internet-explorer/images/preview.png b/pingCTF 2023/internet-explorer/images/preview.png new file mode 100644 index 0000000..481354a Binary files /dev/null and b/pingCTF 2023/internet-explorer/images/preview.png differ diff --git a/pingCTF 2023/youtube-trailer/README.md b/pingCTF 2023/youtube-trailer/README.md new file mode 100644 index 0000000..88d75d9 --- /dev/null +++ b/pingCTF 2023/youtube-trailer/README.md @@ -0,0 +1,14 @@ +# youtube-trailer +> Watch the PING CTF 2023 official trailer and find the flag! + +## About the Challenge +We were given a youtube link + +## How to Solve? +Open the website and then find the flag in the source code by pressing `CTRL + U` + +![flag](images/flag.png) + +``` +ping{hello_welcome_to_ping_ctf} +``` diff --git a/pingCTF 2023/youtube-trailer/images/flag.png b/pingCTF 2023/youtube-trailer/images/flag.png new file mode 100644 index 0000000..4a9fe37 Binary files /dev/null and b/pingCTF 2023/youtube-trailer/images/flag.png differ