独家优惠奖金 100% 高达 1 BTC + 180 免费旋转

TUCTF 2018 Full Web Challenge

2/ Mr. Green’s Weird Website

Username: admin

Password: admin

3/ Colonel Mustard’s Simple Signin

Username: admin’1'=’1

Password: admin’or’1'=’1

4/ Easter Egg: Copper Gate

I took a look at its source, there is only one place you need to check: /images

I found it after being blamed by my mate, take a look in sitenotes.txt

Let curl it

5/ Easter Egg: Jade Gate

After wandering this site for 1 hour, my teammate blamed me again and told me to find any folder hidden with burpsuite and i found this

The content of index after hex decoding

I saw the path /crystalsfordays/index.html, it will use for the next challenge

6/ Easter Egg: Crystal Gate

Use the path above

The hint is use ‘?file=’ , LFI time

After being blamed by my teammate for confusing him, I try this path

This is all the path you can file in index file, skipping it

../../TheEgg.html seems interesting

7/ Miss Scarlet’s Resume Requests

nothing here, only one hyper link leads to contact.php

Wait, Mr.Boddy, I had seen it on the first challenge, try /boddy

I’m in the right way, let’s view its source

8/ Professor Plum’s Ravenous Researcher

I found that there is 3 pages: researcher.php, search.php, looking.php, singin.php, tryagain.php

researcher.php has some description, there is nothing interesting in it

search.php

looking.php and tryagain.php is the result of search.php, one is for success and one is for validation (we cannot submit blank)

singin.php for POST location

One thing you need to know before solving this challenge is Clue Board Game, in my country, there are werewolf and some kind of different board game but I hadn’t heard about Clue, but it will help you to solve this challenge, take a look about it with this link:

I had tried all the room in the link above and I saw that when I submitted Kitchen and some different room, the output was

But with the billiard room

OK, I guessed that I just passed the first part of this challenge

Let’s take a look with the cookie, there are 2 cookies of looking.php

Location’s value is what I input after Base64URL encode, skip it because you can not make anything happen with it

Thanks, TUCTF for these challenges

Add a comment

What is your view?

Send

Related posts:

Feedback on the Aftershokz Titanium headphones

I bought a pair of the Aftershokz Sportz Titanium (with Mic) recently and having been using them for longer duration. The price of these kind of headphones have always been quite high and I was…

Menjawab Tanya

Bagi kebanyakan orang, bisa berkuliah di kampus ini merupakan kebahagiaan dan kebanggaan yang tak terkira. Namun hal tersebut tidak berlaku bagi saya. Bisa berdiri di kampus ini saja saya sudah malu…

What I learned whilst taming my inclination to be an introvert

Ten career-changing lessons to help introverts lean on their strengths to make better leaders. Quiet leadership is not an oxymoron!