niedziela, 29 listopada 2015

[CTF] 9447 CTF web200 "nicklesndimes" write-up

That was really cool challenge on 9447 CTF from Web category. Task description:

Nick's been eating your grandmother's strombomi. Head over to http://nicklesndimes-wq3mhu8l.9447.plumbing. Gain access to his admin account.




So the task is to takeover admin account with user_id = 1.



We are able to register new accounts and login (with Remember me functionality) or request for password reset. After digging a bit with password reset I noticed, that reset token is the same for my userid... and it's md5 hash for my team name ;-)



00:31 zoczus@ropchain[~]$ echo -n "zoczus" | md5sum
5580aed6ac917f2cd6fc08c9581e1ca2  -

So we can simply create password reset link for admin user this way: http://nicklesndimes-wq3mhu8l.9447.plumbing/reset_password?action=choose_password&auth_key=21232f297a57a5a743894a0e4a801fc3&id=1

And first problem - we know team name, but what's e-mail to login? Answer can be found by clicking small icon near to Users, which responds with json with scores, and near our admin account we can find additional field called admin_contact ;) Link was: http://nicklesndimes-wq3mhu8l.9447.plumbing/json?view=scoreboard





Got e-mail, got password, challenge solved... nope!



Tried X-Forwarded-for, X-Real-IP for 127.0.0.1 , 10.43.18.4 (from e-mail headers), etc... and then my team mate (thanks Dawid!) gave me idea to try this one:

00:38 zoczus@ropchain[~]$ host nicklesndimes-wq3mhu8l.9447.plumbing
nicklesndimes-wq3mhu8l.9447.plumbing has address 104.28.12.28
nicklesndimes-wq3mhu8l.9447.plumbing has address 104.28.13.28

Setting X-Forwarded-For to 104.28.13.28 gave me this result after login: 



41 komentarzy:

  1. sex hoc sinh , sinh vien viet lam tinh , clip sex nu sinh

    clip lam tinh moi nhat

    OdpowiedzUsuń
  2. Our Plumber services In Hyderabad point is to give top notch Plumbing Services, best case scenario cost and on concurred time. Every one of our experts are foundation checked, affirmed and exceptionally experienced experts. Plumber services In Hyderabad
    We covers a wide range of Plumbing establishments and repair works. Would you be able to ever think about a working without a pipes benefit done? Appropriate pipes is significant for any structure to offer the occupants a sterile and clean condition. Issues in the pipes framework will undoubtedly happen at some point at some point or another in private units. Remembering this, Adelaide Plumber Services offer you a free pipes review to assess the pipes circumstance at your home.

    OdpowiedzUsuń
  3. Awesome and informative article!
    Just do check out -
    VivaVideo Pro Apk by Apk Hx

    OdpowiedzUsuń
  4. Looking to find a plumber in Chennai to fit an appliance or repair a leak? Magicfinger is the one of Best and leading Plumbing service in Chennai.Book online Electrical Services in Chennai for Home at best price. Plumbers In Chennai

    OdpowiedzUsuń
  5. Thanks for sharing this post, it was great reading this article! would like to know more! keep in touch and stay connected
    Lucky Patcher
    whatsapp plus
    Blackmart
    gbwhatsapp
    wps-wpa-tester-premium
    aptoide

    OdpowiedzUsuń
  6. Specializes in providing all kinds of aluminum production machines, two-head aluminum cutting machines, puzzle milling machines, angle presses, punching machines ...

    visit my website http://maycuanhuacuanhom.vn/

    OdpowiedzUsuń
  7. nice course. thanks for sharing this post this post harried me a lot.
    RHCE Training institute in Delhi

    OdpowiedzUsuń
  8. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  9. Uitstekende blog. Bedankt voor het delen van dit informatieve blog. Als u van plan bent om naar India, Vietnam, Sri Lanka, Turkije te reizen, helpen onze experts u om online een visum te krijgen. Neem contact op met onze experts om een visum aan te vragen.

    online visum india
    visum india aanvragen
    visumaanvraag india
    online visum vietnam
    visum vietnam aanvragen
    visumaanvraag vietnam
    online visum sri lanka
    visum sri lanka aanvragen 
    visumaanvraag sri lanka
    online visum Turkije
    visum Turkije aanvragen
    visumaanvraag Turkije

    OdpowiedzUsuń
  10. Ten komentarz został usunięty przez autora.

    OdpowiedzUsuń
  11. Uitstekende blog. Bedankt voor het delen van dit informatieve blog. Als iemand een visumaanvraag wil indienen of een visum wil aanvragen of van plan is om naar India, Vietnam, Sri Lanka, Turkije te reizen. Dan hoeft u nergens heen. Neem contact op met onze experts om een ​​visum aan te vragen. Onze experts helpen u om binnen 3 werkdagen een visum online te krijgen.

    online visum india
    visum india aanvragen
    visumaanvraag india
    online visum vietnam
    visum vietnam aanvragen
    visumaanvraag vietnam
    online visum sri lanka
    visum sri lanka aanvragen
    visumaanvraag sri lanka
    online visum Turkije
    visum Turkije aanvragen
    visumaanvraag Turkije

    OdpowiedzUsuń
  12. good post and thanks for finding the problem and presenting a solution. llbeanvisa.com

    OdpowiedzUsuń
  13. I just want to thank you for sharing your information and your site or blog this is simple but nice Information I’ve ever seen i like it i learn something today.
    Electrician Services in Rawalpindi

    OdpowiedzUsuń
  14. Buydankvapeonline.com Vapes has been established by a team of avid vapers, which is why we know how to meet our customers’ specific needs. We take great pains to make our assortment as varied as possible. So that you can find all sought of devices and vape supplies under one roof. You no longer have to stray through the mazes of the Internet to get vape carts online. We have all of these and even more at very cheap prices
    Are you wondering where to get vape supplies online that will make your buy dank vape experience like no other? .Simply browse through our catalog and let buydankvapeonline’s Vapes exceed your expectations. At our store, you can buy dank vapes online, buy stiizy carts online, buy kingpens online, buy wholesale carts online, buy brass knuckles online at a click. Simply search by the device type or brand and then add the product that fits the bill to your cart. We will deliver it to you in no time so that you can enjoy your favorite clouds of vapor as soon as possible
    buy vape carts online
    buy dank vapes online
    buy stiizy carts online
    buy kingpens online
    buy wholesale carts online
    buy brass knuckles online
    buy Dank Vapes now
    buy KingPen online now
    where to buy dank vape online
    buy wholesale carts online now
    dank vape store

    OdpowiedzUsuń
  15. Buydankvapeonline.com Vapes has been established by a team of avid vapers, which is why we know how to meet our customers’ specific needs. We take great pains to make our assortment as varied as possible. So that you can find all sought of devices and vape supplies under one roof. You no longer have to stray through the mazes of the Internet to get vape carts online. We have all of these and even more at very cheap prices
    Are you wondering where to get vape supplies online that will make your buy dank vape experience like no other? .Simply browse through our catalog and let buydankvapeonline’s Vapes exceed your expectations. At our store, you can buy dank vapes online, buy stiizy carts online, buy kingpens online, buy wholesale carts online, buy brass knuckles online at a click. Simply search by the device type or brand and then add the product that fits the bill to your cart. We will deliver it to you in no time so that you can enjoy your favorite clouds of vapor as soon as possible
    buy vape carts online
    buy dank vapes online
    buy stiizy carts online
    buy kingpens online
    buy wholesale carts online
    buy brass knuckles online
    buy Dank Vapes now
    buy KingPen online now
    where to buy dank vape online
    buy wholesale carts online now
    dank vape store

    OdpowiedzUsuń


  16. Nice post. I really enjoy reading it. Very instructive, keep on writing.Thanks for sharing.
    clipping path

    OdpowiedzUsuń
  17. The particular online life sites today are flooding with recommendations on the best fashion blogs to seek after. The best thing about truly attempting to comprehend and tips from electronic long range interpersonal communication is that a grouping of people recommend which ones to seek after: enormous names, fashion models, beauticians, engineers and even basically standard people. latest fashion

    OdpowiedzUsuń
  18. You may hear that genuine dank vapes or vape dank dont have a sequential number.on the other hand,in the event
    that you draw up on the mouthpiece,and it flies out,you can make sure its a phony.they may likewise be a 'Ccell' logo
    imprinted on the base of the dank vape cartridge to show it is phony.nontheless, you can discover individuals asserting that
    the Ccell stamp affirms its realness .despite every one of the cases,its essential to just depend on target data.moistvape
    carts offer top 10 amazing,ground-breaking dank vapes flavors.READ MORE

    OdpowiedzUsuń
  19. Nice post. I really enjoy reading it. Very instructive, keep on writing.Thanks for sharing.
    Electrician Services in Rawalpindi

    OdpowiedzUsuń
  20. Our list of items are developing day by day.On the off chance that you can't discover what you are searching for. Please contact our accommodating staff whenever .Your health is yourpriority,so medication should be a great consideration. Get pain pills and buy high quality research chemicals ,xanax ,buy LSD tablets,buy ketamin, buy pure crystal meth and other related products from us.xanax should be cautiously used by the patients suffering acute narrow angle glaucoma, liver problems, respiratory insufficiency, cardiac problems, and myasthenia gravis.
    buy-oxycontin if you are hypersensitive to Alprazolam or your age is under 18.we also have other pills such as buy mdma pills apetamin syrup buy ketamine,buy mephedrone
    buy vyvanse online , buy adderall30mg,you can READ MORE to know a wide range of pain medications.


    OdpowiedzUsuń