247CTF#

247CTF is hosting a always CTF challenge.

• Official URL: https://247ctf.com/

Writeup#

Format: Title [Rated difficulty] - Short Solution Description / Tags

WEB#

• TRUSTED CLIENT [EASY] - JSFuck Deobfuscation
• SECURED SESSION [EASY] - Information Leak by Flask Session Cookie
• COMPARE THE PAIR [MODERATE] - PHP Type Juggling, Comparison with 0e password hash
• FLAG AUTHORISER [MODERATE] - JWT weak secret
• FORGOTTEN FILE POINTER [MODERATE] - LFI /dev/fd/\
• ACID FLAG BANK [MODERATE] - Race Condition
• THE TWIG INJECTOR [MODERATE] - Twig SSTI
• SLIPPERY UPLOAD [MODERATE] - Zip Slip, RCE
• ADMINISTRATIVE ORM [HARD] - UUIDv1 Calculation
• THE FLAG API KEY [HARD] - SQL Injection with limited attempts
• CEREAL LOGGER [HARD] - Insecure Deserialization in PHP, SQLite SQL Injection, RCE
• MECHANICAL TURK [HARD] - Mathematical-based CAPTCHA Breaking
• HELICOPTER ADMINISTRATORS [HARD] - XSS, SQLite SQL Injection
• MEME UPLOAD SERVICE [HARD] - Blind XXE, Phar Deserialization, RCE

Networking#

• ERROR REPORTING PROTOCOL [MODERATE]

PWNABLE#

• HIDDEN FLAG FUNCTION [EASY] - Classic ret2win
• HIDDEN FLAG FUNCTION PARAMETERS [EASY] - Classic ret2win with argument
• CONFUSED ENVIRONMENT READ [EASY] - Format String Attack
• HEAPED NOTES [EASY] - Use After Free