No image

Security/CTF

[HackTheBoo] [Web] Cursed Secret Party Writeup(문제풀이)

Introduction Category : Web Difficulty : Medium Description : You've just received an invitation to a party. Authorities have reported that the party is cursed, and the guests are trapped in a never-ending unsolvable murder mystery party. Can you investigate further and try to save everyone? Code Analysis Flag의 위치는 bot.js 파일에 있었습니다. const flag = fs.readFileSync('/flag.txt', 'utf8'); // ... 생략 ....

by 알 수 없는 사용자 2022. 10. 28.

No image

Security/CTF

[HackTheBoo] [Web] Juggling Facts Writeup(문제풀이)

Introduction Category : Web Difficulty : easy Description : An organization seems to possess knowledge of the true nature of pumpkins. Can you find out what they honestly know and uncover this centuries-long secret once and for all? Code Analysis Flag 가 어디있나 살펴봤고, entrypoint.sh 파일에서 DB 생성 시에 입력되는 것을 볼 수 있었습니다. CREATE DATABASE web_juggling_facts; USE web_juggling_facts; CREATE TABLE facts ( id IN..

by 알 수 없는 사용자 2022. 10. 28.

No image

Security/CTF

[HackTheBoo] [Web] Horror Feeds Writeup(문제풀이)

Introduction Category : Web Difficulty : easy Description : An unknown entity has taken over every screen worldwide and is broadcasting this haunted feed that introduces paranormal activity to random internet-accessible CCTV devices. Could you take down this streaming service? Code Analysis 먼저 Flag를 획득하기 위한 방법에 대해서 알아봅니다. Flag는 config.py에 Flask 환경변수로 저장된 것을 볼 수 있습니다. class Config(object): SECRET..

by 알 수 없는 사용자 2022. 10. 28.

No image

Security/CTF

[HackTheBoo] [Web] Spookifier Writeup(문제풀이)

Introduction Category : Web Difficulty : easy Description : There's a new trend of an application that generates a spooky name for you. Users of that application later discovered that their real names were also magically changed, causing havoc in their life. Could you help bring down this application? Code Analysis application/blueprints/routes.py 파일의 코드를 보면 GET 파라미터 들어온 text 값을 spookify 함수로 넘기고..

by 알 수 없는 사용자 2022. 10. 28.

No image

Security/CTF

[HackTheBoo] [Web] Evaluation Deck Writeup(문제풀이)

Introduction Category : web Difficulty : easy Description : A powerful demon has sent one of his ghost generals into our world to ruin the fun of Halloween. The ghost can only be defeated by luck. Are you lucky enough to draw the right cards to defeat him and save this Halloween? Code Analysis application/blueprints/routes.py 파일의 코드를 보면 Python Arbitrary Code Injection 이 가능하다는 것을 알 수 있습니다. @api.r..

by 알 수 없는 사용자 2022. 10. 28.