Writeups

Password reset tokens came from Apache Commons RandomStringUtils on a seeded java.util.Random, so observed tokens recovered the state and predicted the admin …

The cookie was signed over a json-parsed username but authorized over a ujson-parsed one, and a lone surrogate in a duplicate key made the two parsers disagree.

Two images XOR together to reveal the hidden content. No flag recorded.

Registration passed the whole form straight into the user insert, so adding is_admin to the request created an admin account.

A Jinja2 SSTI with builtins blacklisted by name, bypassed by spelling every blocked word with hex escapes.

An image upload ran a vulnerable ExifTool, so a crafted file triggered CVE-2021-22204 for code execution.

The flag was already sitting in the page, no request needed past the source.

A JWT that accepted the none algorithm, so an unsigned token with a tampered claim sailed through.

The download page checked nothing, so requesting the authenticated endpoint directly returned the flag.

A front proxy that did not URL-decode while the backend did, so percent-encoding the admin path walked straight past the access control. abl found it.

A mutation-XSS that looked like a DOMPurify bug but was really a server-side String.replace breakout, plus an iframe and a cookie-scope trick to read a flag …

Sample CTF writeup demonstrating the layout. Delete or replace it with a real one.

A Windows DC: SMB null session leaked a password-protected Office doc, cracking it gave CMS creds, a C1 CMS .NET deserialization bug gave RCE, and BloodHound …

A pile of Windows .evtx logs and a four-part question set, answered by hunting the events with Chainsaw and the Sigma ruleset.

An “interstellar AI” was told never to name five forbidden planets. Asking in another language and forcing a fixed preamble walked it right past its …

A blog rendered user quotes through the Jinja |safe filter and had an admin bot visit them, so a stored XSS payload leaked the bot cookie.

An XSS bot with no filtering at all — a bare alert(1) popped it.

The ELF was a PyInstaller-packed Python program, so the real logic came out by extracting and decompiling the bytecode.

A protobuf-based auth scheme defeated in three steps, an over-permissive registration, a length-truncating rename, and a score endpoint used as a parsing …

The password check returned as soon as a character was wrong, so response time leaked the password one character at a time.

A URL fetcher checked that the host was not internal, then fetched it, so a DNS rebind flipped the name to localhost between the two steps.

The easy-points boxes: a flag sitting in an SNMP sysLocation field, and two backdoor ports that handed out flags over netcat.

Admin creds from the database, command injection in the add-customer form for a shell, then a SUID find for root.

An exposed Jupyter server on port 8888. A notebook is a code-execution primitive by design.

A SQL injection in an invoice search dumped a user table, the password doubled as an SSH login, and a sudo awk entry handed over root.

A client-side filter was the only thing guarding command execution. Past it was a file read to SSH keys, then a SUID gawk for root.

A Gradio app on the usual port 7860, vulnerable to the path-traversal file read that let us pull /flag.txt.

A directory brute force found a transfer endpoint with a password-protected zip. Cracking it gave a CSV whose four encoded passwords were each their own mini …

A length-restricted XSS behind a brutal CSP. Multiline JS comments stitched several short injections into one script, which poisoned the admin bot notes, …

A PCAP of an unencrypted session to a Metasploitable box. Following the TCP stream replayed the attacker shell, flag and all.

A cpio archive extraction allowed path traversal, which overwrote a user record to grant admin, and the admin page printed the flag.

A GraphQL endpoint with introspection turned off still answered a guessed query field that returned the flag.

A link-checker with a local SSRF, reachable at 127.0.0.1:5000/flag. Non-deterministic and not dockerized, the most disliked challenge of the event.

A CSRF/XSS challenge masquerading as SSTI. A script tag on the admin page exfiltrated the bot cookie. First blood.

An image-upload challenge that echoed parsed metadata back. Controlling fields like width and height let us write into the metadata block and reach the flag. …

A game you had to win to get the flag. We automated it with a play script that won often enough to land the flag on a lucky run.

An exposed Firebase database. The flag was stored as a linked list of characters, each node carrying a computed expression for the next index.

The TXT record only answered for a trusted source IP. EDNS Client Subnet let us claim to be 127.0.0.1 and the server coughed up the flag.

A Python jail that forgot to block file descriptors; reopen stdout and shell out.

A recursive merge on user-controlled ticket JSON allowed prototype pollution, setting admin to reach the admin page.

A SQLi login leaked the vending machine config, which spoke MQTT over WebSockets. Flipping the right switch topic vended the item. First blood.

A web chain: a controllable hash function weakened the nonce, with XSS and a CSRF exfil on top.

A SQL injection login bypass opened a recon trail of hidden directories, DB creds, and a riddle pointing at combining encoded values into a PDF. Co-worked with …

A User repr formatted attacker-controlled data twice, so a Python format string injected into the username walked the object graph to RCE.

A cookie-driven object merge gave prototype pollution. Polluting a subscribed flag unlocked the gated quote that held the flag.

A file upload/download app whose /download/ endpoint had a plain path traversal, enough to read a flag off the filesystem.

A public S3 bucket with versioning left old copies of a page readable, and a retrieved image hid the rest behind steghide.

An Express backend ran the needle HTTP library in a way that turned a JSON field into an implicit file upload, which dropped a Python file the server then …

The session token was the user record XOR a secret key, so flipping one bit of ciphertext flipped the UID to 0 without ever recovering the key.

SSTI leaked the values needed to forge a JWT, and pyjwt’s default algorithm set let the public key double as an HMAC secret.

A loose nginx proxy_pass in front of a Ruby Sinatra app leaked the upstream hostname, which was the flag.

The picker fed user input through a shell, so a short reverse shell over an ngrok tunnel gave a session and the flag.

Path normalization let me reach the application source behind nginx, and the Dockerfile carried the flag as an environment variable.

A save/load API unpickled uploaded files, so a crafted pickle gave straight RCE and read the flag back through the save endpoint.

A Kahoot-style websocket quiz that leaks the scoreboard after every guess, which can be turned into an answer oracle. Analyzed but not implemented.

A length check meant for single-character input was bypassed by passing the query parameter as an array, opening a path traversal to flag.txt.

A URL-preview endpoint that fetched any address and handed back a chosen element, which made it a clean SSRF into the internal network and cloud metadata.

Enumeration of an SMB host: protocol, encryption, domain, and SIDs. Recon only, no flag in my notes.

An exposed finger service leaked a user, and that user’s plan field held the flag.

The flag was sitting in the 403 error page, and again in a custom Server response header.

A stock trading server backed up your portfolio under load, but restored it after a posted trade had already deducted stock, so the trade came through for free.

A calculator Discord bot ran user input through eval behind a substring blacklist, which fell to string splitting and hex escapes.

A dictionary attack against a raw-socket login prompt that did not land.

An unbounded read into the number buffer overflowed into the adjacent message buffer, letting me pose as the system user.

A pattern-matching word game with two SQL injection points, neither of which I got past a wall of 500 errors. Unsolved.

A chatbot front end whose prompt field fed straight into a SQL query.

A GIF of a scribbled-over QR code, recovered by stacking every frame so the gaps filled each other in.

The paywall trusted the Referer header, so swapping free.html for paid.html handed over the flag.

The endpoint released the flag only for a request stamped with one specific date, so I set it by hand.

The flag prints once at boot, before you attach to the serial console, so rebooting while connected catches it.

UNION-based SQL injection against a SQLite-backed school lookup, enumerating the schema one column at a time.

The JWT signing secret was exposed, so I forged a token that smuggled an eval payload into the username array.

The author left Vim running, so the server source leaked through a .swp file.

Creds on the page and in robots.txt fed a webshell, where less beat a cat blacklist and sudo less finished it.

A webshell led through sudo find and a SUID cp to the root flag.

An NFS share leaked an SSH key, a cipher and a cracked zip gave users, and no_root_squash planted a SUID bash.

A raw TCP service handed out a TLS key and cert, mutual TLS opened a shell, and layered encoding plus CrackStation gave root.

An SMBv1 host fell to EternalBlue for SYSTEM, then RDP admin for the king server.

A WordPress brute force off a robots.txt dictionary gave a shell, and SUID nmap gave root. Three keys.

SQLi on 81 and a double-extension upload bypass on 82 gave a duku shell and several web-root flags.

A writable FTP script on a timer gave a shell, and SUID env gave root.

Anonymous FTP and hydra gave SSH, a cookie-equals-password page gave a webshell, and python cap_setuid gave root.

WordPress theme injection, an SSH-tunnelled Jenkins, and a note in /opt chained to root across two hosts.

A file-upload webshell, an SMB share with creds, and SUID vim writing sudoers gave root.

A hidden path leaked creds, a sudo module hijack and a PATH-hijacked SUID stepped through users, and perl setuid gave root.

Default CMS creds and two PHP upload points reached serv3, then a writable cron gave root.

A WordPress plugin privesc gave a shell, a readable SSH key gave a user, and a writable module in a root cron gave root.

An outdated nostromo server on 8080 had a public RCE for a user shell.

An unauthenticated Redis wrote a PHP webshell, then SUID xxd read root.

Anonymous FTP leaked an SSH key, then a sudo su chain and sudo git reached root.

A Haskell class site ran uploaded code, and sudo flask run finished the box.

hydra found SSH, WordPress gave a shell, and sudo ftp with a SUID find reached root.

REST API v1 fuzzing leaked a debugger PIN, the Werkzeug console gave a shell, and a SUID binary reversed to a XOR check.

SQL injection on two portals gave SSH creds, then sudo date and SUID ip to root.