CTF categories
Highlighted writeups
CTF
Math Door
64-bit binary. Heap exploitation. Heap feng shui. Tcache poisoning.FILE structure attackCTF
Share
HITCON CTF Quals 2023. Shamir Secret Sharing. Lagrange interpolation. Chinese Remainder Theorem.multiprocessing
CTF
Paranormial Commitment Scheme
Plaid CTF 2024. BLS12-381. Elliptic curve pairings. Lagrange interpolation
CTF
BatchCraft Potions
GraphQL batching attack. OTP and rate limit bypass. JWT. CSP. DOM Clobbering. XSSRecent CTF
CTF
Lost Modulus Again
RSA. Greatest Common Divisor. Franklin-Reiter related-message attack. Coppersmith’s short-pad attack
Recent HTB
HTB
Eighteen
Hack The Box. Windows. Easy machine. In this assumed-breach machine we have credentials for an exposed MSSQL service where we can impersonate another user and find a hashed password for the website hosted by the machine. This hash can be cracked to find a password. After enumerating users by brute forcing RIDs in MSSQL, we find that it is reused by a domain user and we get access via WinRM. There is a bad ACL configured to groupIT and we can use BadSuccessor to escalate privileges, after configuring a SOCKS proxy to access required AD services
HTB
Dog
Hack The Box. Linux. Easy machine. This machine hosts a CMS that exposes a Git repository. Once we dump the repository, we can find a username and a database password that can be reused to log in as administrator of the CMS. Here, we can install a new module to execute a PHP web shell and get a reverse shell on the machine. Although there are hashed passwords on the database, the same password can be reused for a system user. Finally, we are allowed to runbee as root using sudo, which will let us escalate privileges by running arbitrary PHP code
HTB
Titanic
Hack The Box. Linux. Easy machine. This machine has a Local File Read vulnerability where we can read sensitive files. There is a Gitea instance with some repositories and a Docker configuration that shows how Gitea files are shared in a volume mount. So, we can find hashed passwords on the Gitea SQLite database and crack them. With this, we gain access via SSH reusing credentials. After that, we find a script running asroot using a vulnerable version of ImageMagick where we can perform a library hijacking to get arbitrary code execution, as root
HTB
Alert
Hack The Box. Linux. Easy machine. This machine allows to render Markdown files and share them with a unique link. The Markdown viewer is vulnerable to XSS, and we can send a link to the administrator to perform CSRF and read a confidential webpage. Besides, we find a Local File Read vulnerability, and we can find an.htpasswd file with a hashed password to access another subdomain. Instead, we can crack the hash and reuse the password for SSH. At this point, there is a local PHP server running as root, and we are able to manage PHP scripts, so we can simply execute PHP code as root
HTB
Bizness
Hack The Box. Linux. Easy machine. This machine has a vulnerable version of Apache OFBiz that can be exploited to get RCE using an authentication bypass and Java deserialization payload. Once on the machine, we can inspect the database and search for the password hash of the administrator user. Once the hash is cracked, we can reuse the password and gain access asrootRecent IMC
IMC
IMC 2021, Problem 1
Let
- Prove that there is a unique real
matrix that satisfies the equation - Express
in terms of .
IMC
IMC 2020, Problem 1
Let
consists of letters, all of them are from the alphabet . contains an even number of letters . contains an even number of letters .