daffainfo
/
ctf-writeup
mirror of https://github.com/daffainfo/ctf-writeup.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
ctf-writeup/2023/CSAW CTF Qualification Roun.../Smug-Dino
History
daffainfo e6c48e50f1 feat: grouped the challs 2024-01-09 16:59:32 +07:00
..
images feat: grouped the challs 2024-01-09 16:59:32 +07:00
README.md feat: grouped the challs 2024-01-09 16:59:32 +07:00

README.md

Smug-Dino

Don't you know it's wrong to smuggle dinosaurs... and other things?

About the Challenge

We were given a website, and this website have 2 endpoints, / and /hint. This is what the /hint endpoint looks like

form_hint

Because we know about the web server information (You can find this information on HTTP response header)

server

Input nginx and 1.17.6 and voilà we got the hint

hint

Hmmm, CVE-2019-*** means this is a CVE related to Nginx considering that the Nginx used in this website is outdated

How to Solve?

At first, i tried to find any CVEs related to nginx (You can also check the list here)

Alt text

And I found this CVE-2019-20372 and luckily we also found the proof of concept

proof of concept

And then i replicate the proof of concept in the website and finally we got the flag

flag

csawctf{d0nt_smuggl3_Fla6s_!}