This page looks best with JavaScript enabled

Vulncon CTF

 ·  ☕ 2 min read

Maze

PHP Master

Reading the challenge description the first thing I thought of was to look for hidden files so ran dirsearch:
Dirsearch

Found a /projects folder so when we visit it we get this banner:
Projects

However if we take a look at the source code there is an interesting comment:

1
2
3
<!--
<img src="justsomerandomfoldername/image-0.png">
-->

Checked the image and turns out is a QR, which no apparent hidden data:
QR 0

At this point checked in case there are more images following the same naming convention image-X.png so went for the 27 as the banner on /projects pointed out:

QR 27

Additionally did an intruder scan with BurpSuite to check what images are available:

Intruder

Both intruder and the image are indicating that the qr 13 is hidden data, so ran an exiftool to it:

[jusepe@nix:~/Documents/CTFs/vulncon]$ exiftool image-13.png 
ExifTool Version Number         : 12.12
File Name                       : image-13.png
Directory                       : .
File Size                       : 946 bytes
File Modification Date/Time     : 2020:12:19 14:56:29+01:00
File Access Date/Time           : 2020:12:19 14:56:38+01:00
File Inode Change Date/Time     : 2020:12:19 14:56:30+01:00
File Permissions                : rw-r--r--
File Type                       : PNG
File Type Extension             : png
MIME Type                       : image/png
Image Width                     : 290
Image Height                    : 290
Bit Depth                       : 1
Color Type                      : Grayscale
Compression                     : Deflate/Inflate
Filter                          : Adaptive
Interlace                       : Noninterlaced
XMP Toolkit                     : Image::ExifTool 12.04
Creator                         : aWh5YXBiYXtqQCRfN3UxJF8zaTNhX0BfajNvX3B1QHl5M2F0Mz99
Image Size                      : 290x290
Megapixels                      : 0.084

There is an interesting Creator header so with help of CyberChef got the flag:

Flag

r4t3 L1m1t

PHP Master

When we browse the web the only thing we see is an OTP:

OTP

It makes a get request with a parameter for each digit:

[jusepe@nix:~/Documents/CTFs/vulncon]$ curl "http://ratelimit.noobarmy.org/enterotp?digit_1=1&digit_2=1&digit_3=1&digit_4=1" && echo ""
{"msg":"Your Flag Is  L0L"}

After 10 tries you get banned for 1 minute:

[jusepe@nix:~/Documents/CTFs/vulncon]$ curl "http://ratelimit.noobarmy.org/enterotp?digit_1=1&digit_2=1&digit_3=1&digit_4=1" && echo ""
Our Developers Are Smart Enough To Implement Rate Limit !

Searching for ways of bypassing the ratelimit found this hacktricks post, the article suggest to change the letter casing so tried bruteforcing to /Enterotp.

This endpoint has a 100 request limit which wasn’t enough so kept trying stuff so tried the following headers:

X-Originating-IP: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Forwarded-For: Dashboard

Adding the headers by it’s own didn’t change anything. After some time of struggle switched the request method, hoping that the endpoint processes it too and voilà:

POST bypass

At this point we are able to bruteforce the endpoint, I used BurpSuite Intruder with Cluster Bomb for it. After the bruteforce ends there is a response with different content length:

OTP Pin

Paying attention to the response, removed the X- headers and got the flag:

OTP Pin

Share on

ITasahobby
WRITTEN BY
ITasahobby
InTernet lover