Vending

Challenge

A vending-machine challenge with a web front end. There were no docs, so it was all reverse engineering from the responses. We took first blood.

Approach

robots.txt pointed at a login, which fell to a basic SQL injection (admin:' OR '1). The authenticated area leaked the machine’s config:

1
2
3
4
5
6
7

{
  "endpoint": "ws://vending-mqtt.ctfchals.com:433",
  "username": "user",
  "password": "cfsNm5ax8uW402MhLLgq",
  "switch_topic": "/SWITCH/AVA-15134A",
  "track": "2"
}

The machine spoke MQTT over WebSockets. I scripted a client, connected with those creds, and published to the switch topic to vend the track, which released the flag. This was a particularly cool challenge because MQTT controlled an actual locked box in the CTF room. Walked over and opened it, and the organizers gave us points for the flag!