Cyber Talents 2019 Egypt Qualifications
Hello CTF Players ,i will discuss how i solved some of challenges from Cyber Talents 2019 Egypt — Tunis Qualifications , let’s get started
This First Challenge is a forensics type
bflag (50 points)
1- you will have a pcap file to look into it
2- after some searching you can find that there’s a GET Request to /fl4g/analyze_packet_for_fun
at first i thought it’s a troll but when i tried to submit it , it’s validated ^^
it’s really was easy one to start.
Second Challenge is also a Forensics
sgtoe2 (100 Points)
1- it’s a jpg image called target , binwalk it to see if it’s containing anything else to find that there’s another png img in it.
2- let’s extract it with ‘ Binwalk -MDe target.jpg ’ or just ‘foremost’ it
3- Opening the png to find the flag, now we have 2 options
the first one is just try to figure out the flag with that way and damage our eyes or we can open it with ‘stegsolve’ or any online tool to apply filters or see the color bit planes for it to see it in a clear sight
Now let’s go for the Web Challenges .
Referer Valley (100 Points )
1- from the name of the challenge you might guess it’s all about the referer header , and when you open the challenge and intercept the request with burp suite you find that it takes the referer and gives you info about it
2- well you can figure out that it’s a server side shell script , so we can try to command injection in it , let’s try to pipe and ‘ ls -la ’
3- and yeah it works successfully let’s list the content of hidden directory and then we will find the ‘flag.txt’ inside it so we can read it easily
ٍSecond Web Challenge
Secret Browser (100 Medium)
1- open the challenge and find that “Welcome Guest , you are not using our company browser “ so directly i know that it refers to the ‘ user-agent ’ header
2- after a few time with trying and fuzzing the right user agent of the company i figured out that it should be the company name :D
And Now let’s go for the Hard one
Want More Biscuits (200 Points)
1- open the challenge and ‘dirsearch’ it to find ‘ index.php~’ which means it’s the backup or the source code ,download it and read the code to know that it’s an insecure deserialization vulnerability
2- intercept the request with burp and decode the base64 , modifying the serialized data to be “ O:6:”MyExec”:1:{s:7:”command”;s:2:”ls”;} ” which calling the MyExec class , then base64 encode it again with the replacement of ‘==’ with url encoding %3D%3D
3- so now we can put it in the userCookie and send it to see the command executed and the directory listed and there’s a txt file called Flag
4- Now you have 2 options , you can do the same process again and changing the command to cat the flag filename
or we just can skip this with get the file and read the flag :D
Finally , hope i successfully declared the challenges and thanks for reading :)
Cheers,
