ClouSEK's CTF challenge during BSides 2023
Points: 100
- Automate Your Way to Get the Flag
- PS: No Bruteforcing is required
- This Challange does not require you to access any other Port
nc 43.204.152.119 1337
When connecting to the server we are given with double encoded text Hex > Base64 and we have to submit the Hex > Base64 decoded text in the input but doing so it keep asking for new decode text
Looking at the challenge category (Scripting), we can figure out that this process requires automation with the use of any scripting language. I'm am using Python here
Click to see python code 💠
from pwn import *
from pwn import unhex
conn = remote('43.204.152.119', 1337)
a = conn.recvline()
print(a)
a = a.decode().split("\t")[1].split("\n")[0]
a = unhex(a)
a = b64d(a)
print(a)
for i in range(2, 102):
print(i)
conn.sendline(a)
a = conn.recvline()
print(a)
try:
a = a.decode().split("\t")[1].split("\n")[0]
a = unhex(a)
a = b64d(a)
except IndexError as e:
print(e)
pass
# print(a)
pass
# n=101 ; flag: CloudSEK{au30ma3i0n_1s_fun}
conn.close()Click to see output 💠
PS D:\GitHub\ctf> python .\1.py
[x] Opening connection to 43.204.152.119 on port 1337
[x] Opening connection to 43.204.152.119 on port 1337: Trying 43.204.152.119
[+] Opening connection to 43.204.152.119 on port 1337: Done
b'What does this mean:\t53485a75634555315231704d563370744d4467304f566c70593356445a6d744b6557466e5a45517855584a6f4d6c5a4f4e6d56436445395362464e7a4e3031764d315634596c52785745744755456c33616b453d\n'
b'HvnpE5GZLWzm0849YicuCfkJyagdD1Qrh2VN6eBtORlSs7Mo3UxbTqXKFPIwjA'
2
b'> What does this mean:\t62453952536b6444596b744d64475a6a64336f785a48467961466b335a336847574735514e54424362576c45546c497a5346527a56545a54646b465756317068545770356130566c4e4738796348564a4f446b3d\n'
3
b'> What does this mean:\t53466b3153544a4d536b4a36596e45304d3239594d575a5452446c6b525574335a32354f5156643263305a53595670775658684e636e56446147705156486b344e6d3033523278576447565059326c524d47733d\n'
4
b'> What does this mean:\t5332637a593056755a4570306430786d6332706155474a4563445177546d5657646c4a434d6c52795455637865476c5062316854567a67324e556c724e304e686457685651564673656e6c7862555a494f566b3d\n'
5
b'> What does this mean:\t65546b346230526c6354567a596b39314d7a466d527a424d554656724e487068545735715a3170444e336442634535584e6c4a526255685565466c4c59306c6b64464e73636a4a6f536c684661585a47516c593d\n'
6
b'> What does this mean:\t5647355753584d7a4e577868634568695258566c4d58704b553346764e474e6b516c6c6d55586c33526c41344e326479644731345745646f5430357161554e4c56555272556b31324e6c6f79515663355444413d\n'
7
b'> What does this mean:\t59306b795a6e68365a466c5654454a75566d3030614852444d453170623342505347564b556a6852526d78545747707253334a325a3364516456644f4e545a4552556333596c5178576e4e354f5546784d32453d\n'
8
b'> What does this mean:\t6245744357544534647a4a34596d313152305659633342505347524d5245356a616d565362324632545870786154517a5a6b4e4255305a5865576451614651334e545a304d456c4b576c4672636d355756546b3d\n'
9
b'> What does this mean:\t556d6c5a5546704859336b775a7a6432565574344d6d67305558524b656b564f4d546c47626a67325457784553445657623346596130395556314e33516e4a6d59574a3163326f7a5a556c425447527463454d3d\n'
10
b'> What does this mean:\t5930787956306732526d4a7655567043515864724e584d7a625768534d54527355305259656a4a56646e464c51326c504e324646575855354f45644a5a335177616b354e566e42755a4756515645706d6558673d\n'
11
b'> What does this mean:\t65576f335a56644a516b744b566d4e3157564a305a6b64504f444652546b687556457832654668745a32744254584d30636a5a454d6c706f51305a51656d4a545a48423352546c7062444e6863565577627a553d\n'
12
b'> What does this mean:\t64465251526b68614d554a4661464e44547a686e5a46453256326c59597a4a76646e6c34636e707361334e4c5a6a5135626e413351565678616e557a536b316c524456575230355a596c4a336254424a5447453d\n'
13
b'> What does this mean:\t5633704a4f5656344d45784459557430536e4e6b524659794e573961556a67325157684853476c52596e5a795a54643152566c4f554731736355316e54305a7263477043626a46595a6c4e334e474e5565544d3d\n'
14
b'> What does this mean:\t656d564b64476f77557a4a504e584e6d526e5a4365576c5a5233417852484a4259314a34566c707452574649643142695355317563554e4c62465672567a63326457684d546c4535564752765a31677a4f44513d\n'
15
b'> What does this mean:\t5a6e647954574a496547315364455242535451325a30737757444a46536c593559577058564778526458464f56575261516a6733553239776330387a57576c755a54563265555a444d57744d5930645161486f3d\n'
16
b'> What does this mean:\t59326f33546e52546357787954576c7a535768426345526d56575233596d633556314534574451774e6d347a53323078526e6c5351315a55645456365430566c52324634576a4a5a5545683261307876516b6f3d\n'
17
b'> What does this mean:\t596a6442546e4e3055464a3552546852595446716345644b53315678636d646161553933626b7731656e597761323949526c6c34566d314562464d354d6e566f57444e4a5a6c644e59325643513251304e6c513d\n'
18
b'> What does this mean:\t596c4a49546b4e7a62325a685a556334624452785648705453335a74626a64564e6b70516156704a51565a47555668716433564d6554566b5254417a4f554a6f5756637863474e795248526e547a4a345457733d\n'
19
b'> What does this mean:\t546a5930525564456157396c65474a6a56335650636d733165546c7154457051556e597a53335249634846424d57785457575a6e595870554f446459516a42616431466b62576857626e4e4a54544a44526c553d\n'
20
b'> What does this mean:\t63584e4c52323132626b464d5a465249536a565856576b33624559345a30564a516c4578636e566c55474a59576a524f595739334f54423654314e535a6a4e6f65566c724e6b31344d6d7030513052775931593d\n'
21
b'> What does this mean:\t53474669626b7335615656774f48703056324e5055584642527a567355323830546c685a6132646b647a5a35513231575a575977526e67335246426f56456c32637a4d7954485653516b3146616c6f78536e493d\n'
22
b'> What does this mean:\t56474a494d3039795932646f52314a574d6b5a5a646c467263586c6154544277535463326545564b4d55524f6333513056545673615770544f48564c5a6a6c51656d524d59566474516d5642623364445747343d\n'
23
b'> What does this mean:\t5956466c4e454579626e593459325a5663324a594e6b5a34616c597853316b316148424a61553153643063776230357853454a3552487074513142584f55786154314e314e307079525764306247737a5647513d\n'
24
b'> What does this mean:\t65484a6d4f48426e626b5a574f55784456324a6b4e7a5649574770506247313156545a43627a46425356466157576c6f52544a78646b704855444e4e5331523359314a6c65584e3652477430546c4e684e44413d\n'
25
b'> What does this mean:\t626a52526444646d5632564c5a3368544d335a7454315a764f5531705932527851577846556a46725356684f4d6c6c354f48707a56454e6f536e6431616c70456347453256555a79596a42495231424d516a553d\n'
26
b'> What does this mean:\t595735595a3046586156706a63314530646e70544d7a6c6b5455785764555a3062473133614563315258687753336b345357387756564a78575446435a554e4f4d6b673356455132596d746d536c4271636b383d\n'
27
b'> What does this mean:\t4e55644a616b51355a336c615630464654335a77625739595a6a4934654773325533464d4d465243656b4e6f556d7879596b74314e30354763315a5a643156524e485275536b677a4d574e6b6157466c5545303d\n'
28
b'> What does this mean:\t5955527a626b4e7861564a6f516d4d35596a644b53566f7757485679566d5a4c4e555a5264486455553055346246424f545842355347395a4d5764565630383051586836616a4a485447746c62544e325a44593d\n'
29
b'> What does this mean:\t54336c4b52546c776357553361574676546e686964445644576c5a7a5445646f646c6c58625668454d6c524253324d774f464d30556b31516456566e55556778636d354353577872526e64715a44597a656d593d\n'
30
b'> What does this mean:\t59544e334e545a42596d6f78546d3430523370345a305a49625842354d485a534f45397653564e316245527a5a454a51576d4e56563070526130784c5647685a6158465757475a304f544a46636b4e4e5a54633d\n'
31
b'> What does this mean:\t57586f3459585a4d566d39785256527755553148557a5a314e32786a5330706b53456b7a596d316d5244567a616e52424d486851513156754f5670475a7a4579655452535a584a5057476833546c64706130493d\n'
32
b'> What does this mean:\t596d784861476c745131526c4f46685363584e686455686a52484a42626b70585a31704a545864575533705a634868564d7a59335a6b35474d6e6c4655454a524d47704c6230394d4e544535646d74304e47513d\n'
33
b'> What does this mean:\t523142704e54525463557477644656754f46645265484a33616d68685a47397454544a6d566e4e4454307032556d74735756706a51545a454d305643546a6c6953485577526c52365744646e5355786c6554453d\n'
34
b'> What does this mean:\t553341775657307a61556c4957445235517a6472636b74465a6c6f31624739455455646c54445a50526a46574f454a3461485669575652755156466b63586f35644746715a33646a55453532536c64534d6e4d3d\n'
35
b'> What does this mean:\t64466461517a673063456c3552453178566b706b56446b3264546331636d35515a553576656e5a6f6432707a5746466e5345464c5444425059576b7a55324a72527a4646526e685a556c566d62473079516d4d3d\n'
36
b'> What does this mean:\t54484d3156573171596a6b3363444a4664566c7352455a7251574e486233644965444275553245325333704351314255546b31504d7a6878556e5a52536d68595a57645756325a35636d517864476c615354513d\n'
37
b'> What does this mean:\t4d564a30566b4e7162327448654670704f55527862576468563155304e6b704d5455393555474e42574734335532677a646b4a73534856365554426c4f475255575556476432593153306c7a63474979546e493d\n'
38
b'> What does this mean:\t4d555255646e643553573931526a6b7a4d4768704e6e42565331646e636b4650523256695a44524e5557343162487030556d4e4f5345566d51315a6157464e4d4f4773795547707862554a4b6544647a59566b3d\n'
39
b'> What does this mean:\t55303435617a466b4d456c6a56334e6e51566c43566a5656555842365431687352444a71625468616545646d5330784b4e30687559586c515a555a76646d4a79556e6446645768706448453256454d304d30303d\n'
40
b'> What does this mean:\t5a55517855556434656c704c62464270547a4e5551545671526b4e59596e466d64315a546132393556303556525730334d6a5a434d4577344e45687561464a795a48566e536c6c6a646d464e4f584e775358513d\n'
41
b'> What does this mean:\t645642585133427a5a6d704b55303976636d6778635749794f4578486547564e52546445576e5a705a455a424e46464f4f566c3353474e4a57444236644459314d304a72556b745662565a55595735735a336b3d\n'
42
b'> What does this mean:\t596a464f64315532527a6c595a6b5243646d645855457846536d4e7561303171623267775530746b4e484e736458517955554e684e586c535348425a576d563665456c504e323142526a4e57636e45346156513d\n'
43
b'> What does this mean:\t55444577654570766157524e4f4851354e304e5856465a6e646e426c575452536145643363555a43617a4e7a4e544a3157486c7455324e505a6b6c795246464d616b74424e6d4a6862453561656b56755655673d\n'
44
b'> What does this mean:\t525464705445466a6258465151326479596c5a4f626e5a7a516e706b5a586c5a523246496431564556303031536a5a5564584247576c685453335252617a6c715354497a4e453976624468535a6e67776144453d\n'
45
b'> What does this mean:\t51557045633345325a466c464f486c365231703063446c524d3368754e7a465154455a4c516a4a595457564462445271614535315a6e6476636d646a53476b7762564e5653565272646c646959545650556c593d\n'
46
b'> What does this mean:\t6444457a64577033636d56476346466a53557868516a5a7052564e7a6230393452486b355231644463565a73565464495754426f4e544a4b55467075546b4659646b74556257643654545272556d51345a6d493d\n'
47
b'> What does this mean:\t516e526c53564e5757486c3455557432616c52565454686e595767304d30784f5a4456365546705a62334e774d6d6c785257314462455233626e56724f55686d4e334a6a543059774d545a5852307053596b453d\n'
48
b'> What does this mean:\t5a314242526d567151324d32635468695555355456446c4e65456859624552484e5570764e476c5756584d7754316c36544856304d6a4668516d7477626c704653316435556e4a4a61444e3362575a324e32513d\n'
49
b'> What does this mean:\t5557593056444e5a62476c4759574e42556a564e516b354956585a505233425162574932576d35796454686f536b7435637a46715746633362306c3664454e545a457846524764574f5449775a5774336548453d\n'
50
b'> What does this mean:\t56335a796233567056574e7254454a75625846475a7a64714d303830536d56684d5768695757513455336735556e4e77656b68574e6d7835523030794e58524252564233576c684f5a6b4e4c5246457756456b3d\n'
51
b'> What does this mean:\t54446b315231644a59564a72516e707351316f345a55467857573546566d70745a326b785a6a4e315a45686a546c6830554574504e45316f52445a35643156775558684b526c4e7a4d6e4a6956446432627a413d\n'
52
b'> What does this mean:\t65466478547a5a765331707354486c54625455794d5768706430493556573536575464535a4764476458524b4f47457a636c5269534646325545357a63454646566b4e4a593052484e4531594d47746d5a576f3d\n'
53
b'> What does this mean:\t526b647556544a425a4868736448465a64305654595668455444527262336f775a7a6c355933426f637a685555453561636b4a4e55557050566b745361545a694e306b78625759315a5856714d30683256304d3d\n'
54
b'> What does this mean:\t5a7a4a3262564a7a546d68566457746a5358645063556475515868354e7a467159573936534452464f545a6d64476c595632786b536e4a474e56704454474a575a5531774d464e515330524355544d345756513d\n'
55
b'> What does this mean:\t556b4e77566c6f334d474d79636b7452635664334d32466f536b3573516b6451616d56475156566e4e464e31644578365345317063316c4a4f445532596e5a756557314565475a504d57397256446c6b5745553d\n'
56
b'> What does this mean:\t613370506244466a6544527a566a4e755955315662575a77553264536148593255566c5552546379546c704557486b776158524d616b464a516b7469526b4e514f5752585233646c62335531636b673463556f3d\n'
57
b'> What does this mean:\t64566c424e315276517a56754e6e4e4854565978593364324d4763304d3035616255786b615868785355526c5a6b745955464a30596d78584f544a354f4870545657464654305a715555707761477449636b493d\n'
58
b'> What does this mean:\t5646644c4e5668315356464b4e6e706b576a686d596d39775a334a35616d3133546b31475255647864454578646d78704d316c54626b51774e33673559574e5061314a7a516c426c4e4578574d6c566f53454d3d\n'
59
b'> What does this mean:\t52325642566d7046656b744f65553143536a5a30534768684e4856704d58424a543274345a3231475531425656485a78593259795245786b636c70754e5749774f56677a55564a4462316c334e3164734f484d3d\n'
60
b'> What does this mean:\t64314e555458424957577453576c46584e336b35616e52765a7a426b646d4a6a526d7878537a68755a55395156566831527a5a444e48686d61445670546a4a464d30524d4d554a57656b707962556c6851584d3d\n'
61
b'> What does this mean:\t636a52305a6a4a474e7a6846536e64695a33464f5356457a5532466f616b46764e55526a4d577335556a5a4d4d4870506545744857584255615568585a454e7a545642566256703562465a435a5668756458593d\n'
62
b'> What does this mean:\t55315252596e646f59574e4a626d394b4e3231575a6b4e494f4846424e486731546d707352575532644578704d305a79576e6c505a44465864585a486345745a5744425355484e72545656435a3370454d6a6b3d\n'
63
b'> What does this mean:\t62306c7955565177526d51346448706c65557458576e425964564e325158685152446c4d52553574516d746d5655316e4e33646859306844547a46484d32687057564a7a63556f324e4735574e5770696244493d\n'
64
b'> What does this mean:\t54477456576d52316230527a59314e43647a68794e6b5a4b56476733543046774d556470596d314659556c53517a563053485a4c54575a6e4d47704f656c5a3465577878567a6b7a55544a6c574734305756413d\n'
65
b'> What does this mean:\t4f4849775a315a50526d51324d30645559577474536b6c3553464e4e616a526f63325a5a57486f33515739325332567363476c524d6b787556584651546e513551324e46645455785631703452474a33556b493d\n'
66
b'> What does this mean:\t52316b3552545a564d465a78596a4e76646d744359324630634664735431526c536e566e576a55795555464a5a487074526b4e6d556c42345246687a4d5864705347354d616b3430537a673361484a355530303d\n'
67
b'> What does this mean:\t4e7a465a635539316255744954554a68565670705a444a6d536a5669566a5a445a545233546e706e627a4234593351355531673456306c35526c4a426246424854484e32564768525245557a626e4a7761326f3d\n'
68
b'> What does this mean:\t52324a32526d525a5256704362306c305554523351557053557a645565486b32524531495a6d3159656b4d78616d466e5a55744d4f444a796133457755484e6a546c5a3161544e6f54323558624455355658413d\n'
69
b'> What does this mean:\t546d704c593246434d47737a4f484650535752515a56464262317070544552496333526e4d55704857545657646d5a7957474a44626a5a474d6a6c35634778535533566f6431564e4e46524662586f336546633d\n'
70
b'> What does this mean:\t5447396b536a4a694d5746334e55527561546c7163584e6c61335250535646445632784f636c4e46566a5a614d48706f62566c6a5454524753485a534f4642775a6d6456527a64356548564257444e435331513d\n'
71
b'> What does this mean:\t4d474e5a636c42345a306c35656e5a68556c4d7a523238336445706f626a5631615552715347315662445a4e516b4e574d586469546a4a4d576b5a465a5842525155746d5a484e59617a6b30563152504f48453d\n'
72
b'> What does this mean:\t64304e53627a597761585a555a55684f5157526a63564d784e304a365448417957474a725a6a566162464130637a4d34535856755657645059584a345330316f52316c4662565a45526e527165546c4b5556633d\n'
73
b'> What does this mean:\t5a55466b65544249535856474e486868576c64334e6a46725445356d4e5552544d6d6c436148524b616c4a6e52334a5562546c51597a673363454e6955566878566c6c4656553973646e4e7562336f7a5455733d\n'
74
b'> What does this mean:\t6545397a5644673353454e596455524363446c485156566d596e5a72526a42684d7a5578563142545a476c4d5a32355259323946536c6c4c6248464a6447683365565979616e70614e6a526c62564a4f5458493d\n'
75
b'> What does this mean:\t5231564363564d3351334a505154426b5a564a52646e6c3153326f785756513263444a7a6144527364307070576e5269544552494f453557656d3835626d5a7253564268526e686a545456584d30566e5747303d\n'
76
b'> What does this mean:\t5155646e4d455a4962566f7956485a504e315a596158497a593074736331645461475669525845354e486c5a643342534e6c5636554577344e553130516d347861336876536c46715a454e6d546d463152456b3d\n'
77
b'> What does this mean:\t65574e47616a4a616345707563334930646b3949566d68524d566869627a6442643152485a6b3554656e565652454d32533264786547773157566468516c42744d32566b6130777753564a46545851354f476b3d\n'
78
b'> What does this mean:\t63565a35647a526b65453432576b4a4856314e4a543059336245567054574a726333705a4e576468556e5a7164475934555446744f554e4b54444a6c51564231614442795346564c4d3235775746524562324d3d\n'
79
b'> What does this mean:\t5630644d536b4e7262324645616d526e55454534555867304e58426f64466878596b3879636e4d7a6433564c54545a49553055335a555a6a566a425553585a5a62564a6165575a4f4d57353662476b355655493d\n'
80
b'> What does this mean:\t5658684f5a6a4a3361566c4b6256646952444271517a525064446b785a44673156445a736233705463455661637a644764565a68523074796557687853485a6e4d30464a5932565254554a536132354d5546673d\n'
81
b'> What does this mean:\t4d44684b626d6c6b5130307956553935566e4a76556d687a613056546356706962574651567a644554454a48526a5a6a5a6d637851585a6c56466c3165446c36644568594e54524a546d6f7a5558644c6248413d\n'
82
b'> What does this mean:\t54554d315a6a6c72656e4e4951576871535642526558526961557057635764464e7a424f62457847623256345a4842755647465964314d7953316c3252304a564f47303056334978556c6f3264544e6a5245383d\n'
83
b'> What does this mean:\t543170476230706d645564594d485a6a626d6c6c59553545656e4e785457683552545657596a686e644731585a456c525658633262464279516a464d57554e424e486872556b677956464d35533270774e7a4d3d\n'
84
b'> What does this mean:\t5a47357a546e4a51616d56734d58564263455531565652534d476848536e644a5757743464445a7859324a3561546b306257464c566b39475a7a64544f444e49656e5a4e56325a5951304a765555777952466f3d\n'
85
b'> What does this mean:\t52315a49643255355354685963575a55576b466e6246426865455a54646a5533636c465665554a3162586f78626d67305432743053306f774e6b356b62334e4d5131497a596c6c58545551795258427161574d3d\n'
86
b'> What does this mean:\t62305a524e484e434e6c644e52566c72593270445545705561555177534464426432786e625752364e58465352306c6d645735595a546c4c646c5a614d6d46695658513454334a776558684d4d326854546a453d\n'
87
b'> What does this mean:\t565464336358566b55544246626e5a615a6c6735534842725631524d5a5851305354466e4d307379656a6868536d4e70566e4e7155304a4e62316c5354304e474e6d7834596b5131546b646f636d31355156413d\n'
88
b'> What does this mean:\t59334d78643252515233707161316454536e684e51325a7953545a6e4e46685053464a42646b5a685a57394655576c314f5464566347314d52474a434f485275546e4531533152574d6a426162466c354d32673d\n'
89
b'> What does this mean:\t526d6476633163344d6d313354306442575752695347684e4e6b49305a5670525132787257457333535845784e58566a615870575657464f6547357152585a555a6b78354f58524555484177636b70544d31493d\n'
90
b'> What does this mean:\t57574676566a5a774d6c567961485a74527a527a6445465557466f7a5545737761555a3354336c78596a643162446c6e5a6d526a616a5653656e6846516a46755130784a5555524b4f47564f6131644e5530673d\n'
91
b'> What does this mean:\t5748644e616c46456447397a5a55566a5a6c4d314f565a6e6355746f62544a4865464250646d6c4b51315133576b4a366554457a636e56476247464a4d474a754f45787263465642546b67325a466b30556c633d\n'
92
b'> What does this mean:\t613268345530646c4d54637a4d6d5a4e57465a77537a6c78556b4a4455486c7053573930536c7049546a565264304650636a4236616a5a58596c5130624468685a32356b54455a746331563252574e3152466b3d\n'
93
b'> What does this mean:\t545841354f475a7a646c5a51567a557a51574e30525573335445525555324a59516d644b52314a6c626e687465544a4f513251304d456879576d464a656d687263586476616b39476457777856566c704e6c453d\n'
94
b'> What does this mean:\t5a6a425763336c61526c46796157315a5a57707355444e454e3168554e6b7730516b35345355467753303978597a45355133557955335931623064536446644661326734536b316e5955686964325256626e6f3d\n'
95
b'> What does this mean:\t62586c4756445a4865464a336457646a61476c5156314669574734314d327857536a467252544a425130314352484a4a644752785956557757545249546b3833576d5535616b7876646a686d656c4e4c6333413d\n'
96
b'> What does this mean:\t4f454a44566b30336255357357446c6c565735474d6e56725544566d556d6c6f52335a4a56474a4b4d32457855334e49547a593065454661616d526e6230786a656e52336348465252584a4556336c4c5754413d\n'
97
b'> What does this mean:\t4e30314f4f47746d5746467864306c61564868685432686b62455a445a574e3151544e46596b633155484a7a536a6c54616a46364e6a523263465a4d52466456655574306257637953476c43556d39755754413d\n'
98
b'> What does this mean:\t614456444e32777a5957564b5a6a5236646b56694d464a4c5933426e57556c7056557878636b3150516c704256465a7a5a456379555852766256644f626b5a3465545a31616d733464316849553052514f54453d\n'
99
b'> What does this mean:\t526b6b7963576449536e6869646e527562565a56517a56704d564650516d464657484a735445316c656e6c7a616b3577563259324f57396b52464e514e30733056466c6a556a677a61444233576b46486457733d\n'
100
b'> What does this mean:\t4e464e5857485645565531504e6a6c79646b786c4d54565a63464651655852424d305a445a324a3653325a466232357153465a336332317363576c61595868485931524f4d6a426f556a6334536d52435357733d\n'
101
b'> CloudSEK{au30ma3i0n_1s_fun}\n'
list index out of range
[*] Closed connection to 43.204.152.119 port 1337
PS D:\GitHub\ctf>
Flag: CloudSEK{au30ma3i0n_1s_fun}
Points: 100
- On 1st October, Our Underground Intelligence Team observed a post at the Dark Web, where an hacker claiming to have whole Database dump of the CSP Bank [Central Public Bank] and was selling it for $5000.
- Soon our security research team started digging further to find out the root cause of this leak, as CSP Bank’s web assets scope were limited and properly secured, we didn’t find anything. Then our team indexed all the apps belongs to the CSP Bank at Bevigil (World’s first security engine for mobile apps) and started performing their research.
- Later they came to know that CSP Bank Firebase database were misconfigured i.e open to the public through one can get the sensitive information to chain it further.
- Moving further, our team checks the other app of the company and noticed something suspicious at the “Unknown High Entropy String” rule of the Bevigil which gave the credentials of the DB through which we accessed the Database having Admin Privilege.
- Soon, we documented the detailed research & notified to the compromised company about this incident.
- Flag format: Once you get it, you would know it.
- Note: Some apps of the CSP bank has been deindexed, so one has to find out a way to reach the other apps.
- https://bevigil.com/osint-api
- Hint
- You can search for all the URL present inside a Package on the Bevigil Asset Explorer
- Bevigil Asset Explorer: https://bevigil.com/osint-api?query=com.intl.cspbank&criteria=package
We can use https://bevigil.com/ and search for CSP Bank, we get this result https://bevigil.com/report/com.intl.cspbank?section=assets
In this section under ASSETS we see Firebase URL Rule
Here we see that it is exposed in com.intl.cspbank/source/sources/com/intl/cspbank/constants.java file
Firebase URL is: https://csp-bank-default-rtdb.firebaseio.com
From the description we know that this Firebase database is misconfigured and open to the public so we try to access the database by visiting \.json file on url
https://csp-bank-default-rtdb.firebaseio.com/.json
we are able to see the database content.
In this file we see one entry on index 45, line 317
"45": {
"Account Name": "Central Public Bank",
"DB_URL": "https://mysql_db.cspbank.com",
"ID": "Y29tLmludGwuY3NwY2FyZA=="
}In this the value "ID" is base64 encoded, by base64 decoding this we get com.intl.cspcard
cspcard is new app name so we search this on https://bevigil.com/ and we get this https://bevigil.com/report/com.intl.cspcard?section=strings
There is one "Unknown High Entropy String" rule in this report and it is also mentioned in description of challenge.
It is exposed in com.intl.cspcard/source/sources/com/intl/cspcard/sec_data.java this file
when we analyze this file we get the_key string which is long hex.
private final String the_key = "D8 FF 20 FF 20 E0 20 00 20 10 20 42 20 46 20 21 20 11 20 00 20 01 20 00 20 48 20 6E 20 27 20 5F 20 2E 20 5F 20 2E 20 73 20 6F 20 6D 20 65 20 52 20 61 20 6E 20 64 20 6F 20 6D 20 43 20 68 20 61 20 72 20 61 20 63 20 74 20 65 20 72 20 73 20 2E 20 5F 20 2E 20 5F 20 0A 44 0A 20 6F 6F 6E 20 74 74 73 72 6F 20 65 61 68 64 72 6F 63 65 64 2F 64 6E 65 6F 63 65 64 20 64 72 63 64 65 6E 65 69 74 6C 61 20 73 6E 69 74 20 65 68 63 20 64 6F 2E 65 20 0A 43 0A 6E 6F 72 67 74 61 2C 73 59 20 75 6F 6D 20 64 61 20 65 74 69 20 2E 65 48 65 72 69 20 20 73 6F 79 72 75 66 20 61 6C 21 67 43 0A 6F 6C 64 75 45 53 5F 4B 65 42 69 56 69 67 2D 6C 64 7B 5F 62 64 61 69 6D 3A 6E 64 61 69 6D 40 6E 38 39 7D 37 0A 0A 43 2D 6F 6C 64 75 45 53 20 4B 65 53 75 63 69 72 79 74 54 20 61 65 0A 6D 5F 20 2E 20 5F 20 2E 20 73 20 6F 20 6D 20 65 20 52 20 61 20 6E 20 64 20 6F 20 6D 20 43 20 68 20 61 20 72 20 61 20 63 20 74 20 D8 20 FF 20 E0 20 FF 20 10 48 69 6E 74 2D 4A 46 49 46 20 D8 20 FF 20 E0";Decoding this from hex we get somthing like this:
D
oon ttsro eahdroced/dneoced drcdeneitla snit ehc do.e
C
norgta,sY uom da eti .eHeri soyruf al!gC
olduES_KeBiVig-ld{_bdaim:ndaim@n89}7
C-olduES KeSucirytT ae
if we look carefully we realize that every 2 characters are swaped we can use python to get the message
a = """D
oon ttsro eahdroced/dneoced drcdeneitla snit ehc do.e
C
norgta,sY uom da eti .eHeri soyruf al!gC
olduES_KeBiVig-ld{_bdaim:ndaim@n89}7
C-olduES KeSucirytT ae"""
for i in range(0, len(a), 2):
print(a[i+1],a[i], end="", sep="")Output:
Do not store hardcoded/encoded credentials in the code.
Congrats, You made it. Here is your flag!
CloudSEK_BeVigil-{db_admin:admin@987}
-CloudSEK Security TeaFlag: CloudSEK_BeVigil-{db_admin:admin@987}
Points: 100
- Recently, we got an email from an anonymous person reporting that a Hacker has setted a proxy for Bevigil which allows anyone from the internet to use Bevigil for Free and Unlimited. He might has Stolen a session cookie from our internal CloudSters and used that in the proxy. We blindly can’t expire all the session’s cookies for user experience, so we need to figure out the Particular session cookie and expire that only.
- The anonymous person has also shared an android application naming Bevigil for Free and Unlimited hosted at BeVigil where an attacker has stored the Proxy URL in the app’s assets [IPs, URLs, Hostnames, etc] & his details for publicity stunt.
- Could you help us to find out the same cookie so that we can revoke it as soon as possible!!
- https://bevigil.com/report/com.intl.bevigilunlimited
In this report after looking in assets we get this file com.intl.bevigilunlimited/source/resources/res/values/strings.xml which contains the proxy URL
In this xml file we get this url:
<string name="proxyUrlBackup">https://webctf.cloudsek.com/hack-in-the-wires</string>In the source code of this given url we get the following comment:
<!--
$cookie = file_get_contents("/cookies.txt");
if ($_GET['getData']){
if(preg_match("/^http.[:]\/\/(bevigil.com\/)./", $_GET['url'];)){
$response = file_get_contents($_GET['url'];, false, $cookiesAndHeaders);
}else{
$response = false;
}
}-->by analyzing this php code we can divide this process in 3 steps
- GET parameter
getData=trueto satisfy the first if condition - value of GET parameter
urlshould match the regex^http.[:]\/\/(bevigil.com\/). - use LFI in
urlparameter to read the/cookies.txt
first condition is easy just include getData=true in GET request
for the seconde step let's understand the regex
^http: it means the string should start withhttp- following
.means any one character \/\/it means//(bevigil.com\/)it means a group in first it start withbevigil+.meaning any one character +com+/- last
.meaning any character
for example: https://bevigil.com/a this will match the regex
but trying LFI in this dose not work so i will use online php editor to debug the payload
In this online editor i'm using payload=echo file_get_contents("https://bevigil.com/../../.code.tio");
In the debug section we can see following warning:
PHP Warning: file_get_contents(): Unable to find the wrapper "https" - did you forget to enable it when you configured PHP? in /home/runner/.code.tio on line 3
It is trying to parse the http protocall so now we have make sure it dose not identify our payload as http url so we can read the local file
for this we have . in regex after http so first i tried different characters like httpq, httpd but it still identify it as http
then i tried special characters, : works now in editor payload=echo file_get_contents("http:://bevigil.com/../../.code.tio"); works so now we just need to try
few ../ to get /cookies.txt
finally the payload=http:://bevigil.com/../../../../../cookies.txt give us the flag
https://webctf.cloudsek.com/hack-in-the-wires?getData=true&url=http:://bevigil.com/../../../../../cookies.txt
Flag: CloudSEK{3FI_i$_C00!}
Happy Hacking