Add results for picoCTF 2022.

On branch main Your branch is up to date with 'origin/main'. Changes to be committed: new file: CVE-XXXX-XXXX/README.md new file: Forbidden_Paths/README.md new file: Includes/README.md new file: Inspect_HTML/README.md new file: Local_Authority/README.md new file: Overview.png new file: Power_Cookie/README.md new file: Progression.png modified: README.md new file: RPS/README.md new file: Roboto Sans/README.md new file: Roboto Sans/solve/flag.txt new file: Roboto Sans/solve/get_flag.sh new file: SQLiLite/README.md new file: Safe_Opener/README.md new file: Safe_Opener/solve/flag.txt new file: Safe_Opener/solve/get_flag.sh new file: Safe_Opener/solve/get_passwd.py new file: Safe_Opener/solve/leak.tar new file: Safe_Opener/solve/leak/passwords.txt new file: Safe_Opener/solve/leak/usernames.txt new file: Search_source/README.md new file: Search_source/solve/flag.txt new file: Search_source/solve/get_flag.sh new file: Search_source/solve/saturn.picoctf.net:56849/css/bootstrap.min.css new file: Search_source/solve/saturn.picoctf.net:56849/css/owl.carousel.min.css new file: Search_source/solve/saturn.picoctf.net:56849/css/responsive.css new file: Search_source/solve/saturn.picoctf.net:56849/css/style.css new file: Search_source/solve/saturn.picoctf.net:56849/images/1.png new file: Search_source/solve/saturn.picoctf.net:56849/images/2.png new file: Search_source/solve/saturn.picoctf.net:56849/images/3.png new file: Search_source/solve/saturn.picoctf.net:56849/images/banner.jpg new file: Search_source/solve/saturn.picoctf.net:56849/images/loading.gif new file: Search_source/solve/saturn.picoctf.net:56849/images/logo.png new file: Search_source/solve/saturn.picoctf.net:56849/images/mail_icon.png new file: Search_source/solve/saturn.picoctf.net:56849/images/phone_icon.png new file: Search_source/solve/saturn.picoctf.net:56849/index.html new file: Search_source/solve/saturn.picoctf.net:56849/js/bootstrap.bundle.min.js new file: Search_source/solve/saturn.picoctf.net:56849/js/custom.js new file: Search_source/solve/saturn.picoctf.net:56849/js/jquery-3.0.0.min.js new file: Search_source/solve/saturn.picoctf.net:56849/js/jquery.mCustomScrollbar.concat.min.js new file: Search_source/solve/saturn.picoctf.net:56849/js/jquery.min.js new file: Search_source/solve/saturn.picoctf.net:56849/js/owl.carousel.min.js new file: Search_source/solve/saturn.picoctf.net:56849/js/popper.min.js new file: Secrets/README.md new file: basic-file-exploit/README.md new file: basic-mod1/README.md new file: basic-mod1/solve/flag.txt new file: basic-mod1/solve/get_flag.py new file: basic-mod1/solve/message.txt new file: basic-mod2/README.md new file: basic-mod2/solve/flag.txt new file: basic-mod2/solve/get_flag.py new file: basic-mod2/solve/message.txt new file: credstuff/README.md new file: credstuff/solve/flag.txt new file: credstuff/solve/get_flag.sh new file: credstuff/solve/get_passwd.py new file: credstuff/solve/leak.tar new file: credstuff/solve/leak/passwords.txt new file: credstuff/solve/leak/usernames.txt new file: file-run1/README.md new file: file-run1/solve/flag.txt new file: file-run1/solve/get_flag.sh new file: file-run1/solve/run new file: file-run2/README.md new file: file-run2/solve/flag.txt new file: file-run2/solve/get_flag.sh new file: file-run2/solve/run new file: morse-code/README.md new file: morse-code/solve/Notes.txt new file: morse-code/solve/get_flag.sh new file: morse-code/solve/morse_chal.wav new file: patchme.py/README.md new file: patchme.py/solve/flag.txt new file: patchme.py/solve/flag.txt.enc new file: patchme.py/solve/get_flag.sh new file: patchme.py/solve/patched.flag.py new file: patchme.py/solve/patched.py new file: patchme.py/solve/patchme.flag.py new file: substitution0/README.md new file: unpackme.py/README.md new file: unpackme.py/solve/patched_unpackme.flag.py new file: unpackme/README.md new file: unpackme/solve/flag.txt new file: unpackme/solve/get_flag.sh new file: unpackme/solve/unpacked new file: unpackme/solve/unpackme-upx
LauKr · Mar 29, 2022 · 8c1c804 · 8c1c804
1 parent 7825893
commit 8c1c804
Show file tree

Hide file tree

Showing 88 changed files with 5,225 additions and 2 deletions.
diff --git a/picoCTF2022/CVE-XXXX-XXXX/README.md b/picoCTF2022/CVE-XXXX-XXXX/README.md
@@ -0,0 +1,38 @@
+# picoCTF 2022: CVE-XXXX-XXXX
+
+Author: Mubarak Mikail
+
+![Binary_Exploitation category](https://img.shields.io/badge/category-Binary_Exploitation-red.svg)
+![Score: 100](https://img.shields.io/badge/Score-100-brightgreen.svg)
+![Solved](https://img.shields.io/badge/Solved-During_Competition-brightgreen.svg)
+
+## Description
+> Enter the CVE of the vulnerability as the flag with the correct flag format: `picoCTF{CVE-XXXX-XXXXX}` replacing XXXX-XXXXX with the numbers for the matching vulnerability.  
+The CVE we're looking for is the first recorded remote code execution (RCE) vulnerability in 2021 in the Windows Print Spooler Service, which is available across desktop and server versions of Windows operating systems. The service is used to manage printers and print servers.
+
+<!--Artifact Files:
+* [Artifact1]()
+* [Artifact2]()
+-->
+
+### Hints
+
+<details>
+<summary>Hint 1</summary>
+We're not looking for the Local Spooler vulnerability in 2021...
+</details>
+
+## Summary
+
+Search in a database of your choice.  
+Example: [https://cve.mitre.org/](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=remote+code+execution+windows+print+spooler+service+2021) and pick the [oldest](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527) of 2021.
+
+## Flag
+
+<details><summary>Show flag</summary>
+
+```
+picoCTF{CVE-2021-34527}
+```
+
+</details>
diff --git a/picoCTF2022/Forbidden_Paths/README.md b/picoCTF2022/Forbidden_Paths/README.md
@@ -0,0 +1,41 @@
+# picoCTF 2022: Forbidden Paths
+
+Author: LT 'syreal' Jones
+
+![Web_Exploitation category](https://img.shields.io/badge/category-Web_Exploitation-red.svg)
+![Score: 200](https://img.shields.io/badge/Score-200-brightgreen.svg)
+![Solved](https://img.shields.io/badge/Solved-During_Competition-brightgreen.svg)
+
+## Description
+> Can you get the flag?  
+> Here's the [website](http://saturn.picoctf.net:52472/).  
+>
+> We know that the website files live in `/usr/share/nginx/html/` and the flag is at `/flag.txt` but the website is filtering absolute file paths. Can you get past the filter to read the flag?
+
+<!--Artifact Files:
+* [Artifact1]()
+* [Artifact2]()
+-->
+
+### Hints
+
+None
+
+## Summary
+
+Instead of the absolute file path enter a relative one. Enter
+```
+../../../../flag.txt
+```
+to the input field and read the flag.
+
+
+## Flag
+
+<details><summary>Show flag</summary>
+
+```
+ picoCTF{7h3_p47h_70_5ucc355_32e3a320}
+ ```
+
+</details>
diff --git a/picoCTF2022/Includes/README.md b/picoCTF2022/Includes/README.md
@@ -0,0 +1,37 @@
+# picoCTF 2022: Includes
+
+Author: LT 'syreal' Jones
+
+![Web_Exploitation category](https://img.shields.io/badge/category-Web_Exploitation-red.svg)
+![Score: 100](https://img.shields.io/badge/Score-100-brightgreen.svg)
+![Solved](https://img.shields.io/badge/Solved-During_Competition-brightgreen.svg)
+
+## Description
+> Can you get the flag? Go to this [website](http://saturn.picoctf.net:52514/) and see what you can discover
+
+<!--Artifact Files:
+* [Artifact1]()
+* [Artifact2]()
+-->
+
+### Hints
+
+<details>
+<summary>Hint 1</summary>
+Is there more code than what the inspector initially shows?
+</details>
+
+## Summary
+
+There is again a flag hidden somewhere in the source code of the website.
+This time the flag is split into two pieces. One in the `style.css` file and the other in `script.js`. To access them visit e.g. [http://saturn.picoctf.net:52514/style.css](http://saturn.picoctf.net:52514/style.css)
+
+## Flag
+
+<details><summary>Show flag</summary>
+
+```
+picoCTF{1nclu51v17y_1of2_f7w_2of2_5a94a145}
+```
+
+</details>
diff --git a/picoCTF2022/Inspect_HTML/README.md b/picoCTF2022/Inspect_HTML/README.md
@@ -0,0 +1,36 @@
+# picoCTF 2022: Inspect HTML
+
+Author: LT 'syreal' Jones
+
+![Web_Exploitation category](https://img.shields.io/badge/category-Web_Exploitation-red.svg)
+![Score: 100](https://img.shields.io/badge/Score-100-brightgreen.svg)
+![Solved](https://img.shields.io/badge/Solved-During_Competition-brightgreen.svg)
+
+## Description
+> Can you get the flag? Go to this [website](http://saturn.picoctf.net:49609/) and see what you can discover.
+
+<!--Artifact Files:
+* [Artifact1]()
+* [Artifact2]()
+-->
+
+### Hints
+
+<details>
+<summary>Hint 1</summary>
+What is the web inspector in web browsers?
+</details>
+
+## Summary
+
+On the webpage open the HTML inspector (e.g. press F12 on most browsers). When reading through the source code you'll find a comment with the flag
+
+## Flag
+
+<details><summary>Show flag</summary>
+
+```
+picoCTF{1n5p3t0r_0f_h7ml_b101a689}
+```
+
+</details>
diff --git a/picoCTF2022/Local_Authority/README.md b/picoCTF2022/Local_Authority/README.md
@@ -0,0 +1,51 @@
+# picoCTF 2022: Local Authority
+
+Author: LT 'syreal' Jones
+
+![Web_Exploitation category](https://img.shields.io/badge/category-Web_Exploitation-red.svg)
+![Score: 100](https://img.shields.io/badge/Score-100-brightgreen.svg)
+![Solved](https://img.shields.io/badge/Solved-During_Competition-brightgreen.svg)
+
+## Description
+> Can you get the flag? Go to this [website](http://saturn.picoctf.net:50959/) and see what you can discover.
+
+<!--Artifact Files:
+* [Artifact1]()
+* [Artifact2]()
+-->
+
+### Hints
+
+<details>
+<summary>Hint 1</summary>
+How is the password checked on this website?
+</details>
+
+## Summary
+
+Go to website, try to log in with Inspector, see Login Failed and in inspctor <script src="secure.js"> </script>. Go to secure.js ->
+```js
+function checkPassword(username, password)
+{
+  if( username === 'admin' && password === 'strongPassword098765' )
+  {
+    return true;
+  }
+  else
+  {
+    return false;
+  }
+}
+
+```
+-> login -> flag
+
+## Flag
+
+<details><summary>Show flag</summary>
+
+```
+picoCTF{j5_15_7r4n5p4r3n7_b964a657}
+```
+
+</details>
diff --git a/picoCTF2022/Overview.png b/picoCTF2022/Overview.png
diff --git a/picoCTF2022/Power_Cookie/README.md b/picoCTF2022/Power_Cookie/README.md
@@ -0,0 +1,40 @@
+# picoCTF 2022: Power Cookie
+
+Author: LT 'syreal' Jones
+
+![Web_Exploitation category](https://img.shields.io/badge/category-Web_Exploitation-red.svg)
+![Score: 200](https://img.shields.io/badge/Score-200-brightgreen.svg)
+![Solved](https://img.shields.io/badge/Solved-During_Competition-brightgreen.svg)
+
+## Description
+> Can you get the flag?  
+> Go to this [website](http://saturn.picoctf.net:63397/) and see what you can discover.
+
+<!--Artifact Files:
+* [Artifact1]()
+* [Artifact2]()
+-->
+
+### Hints
+
+<details>
+<summary>Hint 1</summary>
+Do you know how to modify cookies?
+</details>
+
+## Summary
+
+Visit the website, _Continue as guest_, you'll get an information printed that "_We apologize, but we have no guest services at the moment._"
+
+If you view* the cookies for this website you'll find a cookie called _isAdmin_ with the value 0. change that value to use, reload the page and you have the flag.  
+*To view the cookies you can just use a cookie manager for your browser or get them from your browser if it's capable to show them.
+
+## Flag
+
+<details><summary>Show flag</summary>
+
+```
+picoCTF{gr4d3_A_c00k13_87608ba8}
+```
+
+</details>
diff --git a/picoCTF2022/Progression.png b/picoCTF2022/Progression.png
diff --git a/picoCTF2022/README.md b/picoCTF2022/README.md
@@ -1,4 +1,20 @@
 # PicoCTF 2022
 
-> Files will be added as soon as the competition ends to ensure 
-> everybody can play it on their on. (29th of March)
+> Competition Start: 5:00pm GMT+1 Mar 15, 2022  
+Competition End: 9:00pm GMT+2 Mar 29, 2022
+
+## Completed Challenges
+
+| Challenge | Category | Points |
+| - | - | - |
+|[morse-code](morse-code/README.md) | Cryptography | 100 |
+|[credstuff](morse-code/README.md) | Cryptography | 100 |
+...
+
+## Metadata on my work
+
+My progression over time shows a clear sign of distinct times when I worked on the CTF.  
+
+![Progression over time](Progression.png)
+
+![Category overview](Overview.png)
diff --git a/picoCTF2022/RPS/README.md b/picoCTF2022/RPS/README.md
@@ -0,0 +1,52 @@
+# picoCTF 2022: RPS
+
+Author: Will Hong
+
+![Binary_Exploitation category](https://img.shields.io/badge/category-Binary_Exploitation-red.svg)
+![Score: 200](https://img.shields.io/badge/Score-200-brightgreen.svg)
+![Solved](https://img.shields.io/badge/Solved-During_Competition-brightgreen.svg)
+
+## Description
+> Here's a program that plays rock, paper, scissors against you. I hear something good happens if you win 5 times in a row.  
+Connect to the program with netcat:
+```sh
+$ nc saturn.picoctf.net 53296
+```
+The program's source code with the flag redacted can be downloaded [here](https://artifacts.picoctf.net/c/447/game-redacted.c).
+
+<!--Artifact Files:
+* [Artifact1]()
+* [Artifact2]()
+-->
+
+### Hints
+
+<details><summary>Hint 1</summary>
+How does the program check if you won?
+</details>
+
+## Summary
+
+The program checks the win using the following code:
+
+```C
+if (strstr(player_turn, loses[computer_turn])) {
+  puts("You win! Play again?");
+  return true;
+} else {
+  puts("Seems like you didn't win this time. Play again?");
+  return false;
+}
+```
+
+We can see that it uses the function `strstr`, which finds the first occurrence of a substring in a sting. So if we enter `rockpaperscissors` it will always find the computers loosing command in our string.
+
+## Flag
+
+<details><summary>Show flag</summary>
+
+```
+picoCTF{50M3_3X7R3M3_1UCK_8525F21D}
+```
+
+</details>
diff --git a/picoCTF2022/Roboto Sans/README.md b/picoCTF2022/Roboto Sans/README.md
@@ -0,0 +1,44 @@
+# picoCTF 2022: Roboto Sans
+
+Author: Mubarak Mikail
+
+![Web_Exploitation category](https://img.shields.io/badge/category-Web_Exploitation-red.svg)
+![Score: 200](https://img.shields.io/badge/Score-200-brightgreen.svg)
+![Solved](https://img.shields.io/badge/Solved-During_Competition-brightgreen.svg)
+
+## Description
+> The flag is somewhere on this web application not necessarily on the website. Find it.  
+> Check [this](http://saturn.picoctf.net:57329/) out.
+
+<!--Artifact Files:
+* [Artifact1]()
+* [Artifact2]()
+-->
+
+### Hints
+
+None
+
+## Summary
+
+If we visit the website we can have a look through all the stuff. A first point should be the /robots.txt file.
+
+Here we see some symbols at the bottom directly above _Disallow: /wp-admin/_.
+The middle part seems like it's Base64 encoded and if we decode it it says _js/myfile.txt_.
+
+If we visit that file we have the flag.
+The interesting part in this challenge is that the flag is not really on the web application, so a website mirror and
+```bash
+grep -rw 'path' -e 'picoCTF'
+```
+does not work here, as the /js/myfile.txt is not mirrored.
+
+## Flag
+
+<details><summary>Show flag</summary>
+
+```
+picoCTF{Who_D03sN7_L1k5_90B0T5_87ccf72a}
+```
+
+</details>
diff --git a/picoCTF2022/Roboto Sans/solve/flag.txt b/picoCTF2022/Roboto Sans/solve/flag.txt
@@ -0,0 +1 @@
+picoCTF{Who_D03sN7_L1k5_90B0T5_87ccf72a}
diff --git a/picoCTF2022/Roboto Sans/solve/get_flag.sh b/picoCTF2022/Roboto Sans/solve/get_flag.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+wget -N http://saturn.picoctf.net:57329/js/myfile.txt
+mv myfile.txt flag.txt
+cat flag.txt