CloudSEK - BSides Cyber Security CTF 2023

ClouSEK's CTF challenge during BSides 2023

Challenges

Scripting

The Automater

CloudSEK's Digital Supply Chain Security Solution (BeVigil)

The Automater

Points: 100

Automate Your Way to Get the Flag
PS: No Bruteforcing is required
This Challange does not require you to access any other Port
nc 43.204.152.119 1337

When connecting to the server we are given with double encoded text Hex > Base64 and we have to submit the Hex > Base64 decoded text in the input but doing so it keep asking for new decode text

Looking at the challenge category (Scripting), we can figure out that this process requires automation with the use of any scripting language. I'm am using Python here

Click to see python code :diamond_shape_with_a_dot_inside:

from pwn import *
from pwn import unhex

conn = remote('43.204.152.119', 1337)

a = conn.recvline()
print(a)
a = a.decode().split("\t")[1].split("\n")[0]
a = unhex(a)
a = b64d(a)
print(a)

for i in range(2, 102):
    print(i)
    conn.sendline(a)
    a = conn.recvline()
    print(a)
    try:
        a = a.decode().split("\t")[1].split("\n")[0]
        a = unhex(a)
        a = b64d(a)
    except IndexError as e:
        print(e)
        pass
    # print(a)
    pass

# n=101 ; flag: CloudSEK{au30ma3i0n_1s_fun}
conn.close()

Click to see output :diamond_shape_with_a_dot_inside:

PS D:\GitHub\ctf> python .\1.py
[x] Opening connection to 43.204.152.119 on port 1337
[x] Opening connection to 43.204.152.119 on port 1337: Trying 43.204.152.119
[+] Opening connection to 43.204.152.119 on port 1337: Done
b'What does this mean:\t53485a75634555315231704d563370744d4467304f566c70593356445a6d744b6557466e5a45517855584a6f4d6c5a4f4e6d56436445395362464e7a4e3031764d315634596c52785745744755456c33616b453d\n'
b'HvnpE5GZLWzm0849YicuCfkJyagdD1Qrh2VN6eBtORlSs7Mo3UxbTqXKFPIwjA'
2
b'> What does this mean:\t62453952536b6444596b744d64475a6a64336f785a48467961466b335a336847574735514e54424362576c45546c497a5346527a56545a54646b465756317068545770356130566c4e4738796348564a4f446b3d\n'
3
b'> What does this mean:\t53466b3153544a4d536b4a36596e45304d3239594d575a5452446c6b525574335a32354f5156643263305a53595670775658684e636e56446147705156486b344e6d3033523278576447565059326c524d47733d\n'
4
b'> What does this mean:\t5332637a593056755a4570306430786d6332706155474a4563445177546d5657646c4a434d6c52795455637865476c5062316854567a67324e556c724e304e686457685651564673656e6c7862555a494f566b3d\n'
5
b'> What does this mean:\t65546b346230526c6354567a596b39314d7a466d527a424d554656724e487068545735715a3170444e336442634535584e6c4a526255685565466c4c59306c6b64464e73636a4a6f536c684661585a47516c593d\n'
6
b'> What does this mean:\t5647355753584d7a4e577868634568695258566c4d58704b553346764e474e6b516c6c6d55586c33526c41344e326479644731345745646f5430357161554e4c56555272556b31324e6c6f79515663355444413d\n'
7
b'> What does this mean:\t59306b795a6e68365a466c5654454a75566d3030614852444d453170623342505347564b556a6852526d78545747707253334a325a3364516456644f4e545a4552556333596c5178576e4e354f5546784d32453d\n'
8
b'> What does this mean:\t6245744357544534647a4a34596d313152305659633342505347524d5245356a616d565362324632545870786154517a5a6b4e4255305a5865576451614651334e545a304d456c4b576c4672636d355756546b3d\n'
9
b'> What does this mean:\t556d6c5a5546704859336b775a7a6432565574344d6d67305558524b656b564f4d546c47626a67325457784553445657623346596130395556314e33516e4a6d59574a3163326f7a5a556c425447527463454d3d\n'
10
b'> What does this mean:\t5930787956306732526d4a7655567043515864724e584d7a625768534d54527355305259656a4a56646e464c51326c504e324646575855354f45644a5a335177616b354e566e42755a4756515645706d6558673d\n'
11
b'> What does this mean:\t65576f335a56644a516b744b566d4e3157564a305a6b64504f444652546b687556457832654668745a32744254584d30636a5a454d6c706f51305a51656d4a545a48423352546c7062444e6863565577627a553d\n'
12
b'> What does this mean:\t64465251526b68614d554a4661464e44547a686e5a46453256326c59597a4a76646e6c34636e707361334e4c5a6a5135626e413351565678616e557a536b316c524456575230355a596c4a336254424a5447453d\n'
13
b'> What does this mean:\t5633704a4f5656344d45784459557430536e4e6b524659794e573961556a67325157684853476c52596e5a795a54643152566c4f554731736355316e54305a7263477043626a46595a6c4e334e474e5565544d3d\n'
14
b'> What does this mean:\t656d564b64476f77557a4a504e584e6d526e5a4365576c5a5233417852484a4259314a34566c707452574649643142695355317563554e4c62465672567a63326457684d546c4535564752765a31677a4f44513d\n'
15
b'> What does this mean:\t5a6e647954574a496547315364455242535451325a30737757444a46536c593559577058564778526458464f56575261516a6733553239776330387a57576c755a54563265555a444d57744d5930645161486f3d\n'
16
b'> What does this mean:\t59326f33546e52546357787954576c7a535768426345526d56575233596d633556314534574451774e6d347a53323078526e6c5351315a55645456365430566c52324634576a4a5a5545683261307876516b6f3d\n'
17
b'> What does this mean:\t596a6442546e4e3055464a3552546852595446716345644b53315678636d646161553933626b7731656e597761323949526c6c34566d314562464d354d6e566f57444e4a5a6c644e59325643513251304e6c513d\n'
18
b'> What does this mean:\t596c4a49546b4e7a62325a685a556334624452785648705453335a74626a64564e6b70516156704a51565a47555668716433564d6554566b5254417a4f554a6f5756637863474e795248526e547a4a345457733d\n'
19
b'> What does this mean:\t546a5930525564456157396c65474a6a56335650636d733165546c7154457051556e597a53335249634846424d57785457575a6e595870554f446459516a42616431466b62576857626e4e4a54544a44526c553d\n'
20
b'> What does this mean:\t63584e4c52323132626b464d5a465249536a565856576b33624559345a30564a516c4578636e566c55474a59576a524f595739334f54423654314e535a6a4e6f65566c724e6b31344d6d7030513052775931593d\n'
21
b'> What does this mean:\t53474669626b7335615656774f48703056324e5055584642527a567355323830546c685a6132646b647a5a35513231575a575977526e67335246426f56456c32637a4d7954485653516b3146616c6f78536e493d\n'
22
b'> What does this mean:\t56474a494d3039795932646f52314a574d6b5a5a646c467263586c6154544277535463326545564b4d55524f6333513056545673615770544f48564c5a6a6c51656d524d59566474516d5642623364445747343d\n'
23
b'> What does this mean:\t5956466c4e454579626e593459325a5663324a594e6b5a34616c597853316b316148424a61553153643063776230357853454a3552487074513142584f55786154314e314e307079525764306247737a5647513d\n'
24
b'> What does this mean:\t65484a6d4f48426e626b5a574f55784456324a6b4e7a5649574770506247313156545a43627a46425356466157576c6f52544a78646b704855444e4e5331523359314a6c65584e3652477430546c4e684e44413d\n'
25
b'> What does this mean:\t626a52526444646d5632564c5a3368544d335a7454315a764f5531705932527851577846556a46725356684f4d6c6c354f48707a56454e6f536e6431616c70456347453256555a79596a42495231424d516a553d\n'
26
b'> What does this mean:\t595735595a3046586156706a63314530646e70544d7a6c6b5455785764555a3062473133614563315258687753336b345357387756564a78575446435a554e4f4d6b673356455132596d746d536c4271636b383d\n'
27
b'> What does this mean:\t4e55644a616b51355a336c615630464654335a77625739595a6a4934654773325533464d4d465243656b4e6f556d7879596b74314e30354763315a5a643156524e485275536b677a4d574e6b6157466c5545303d\n'
28
b'> What does this mean:\t5955527a626b4e7861564a6f516d4d35596a644b53566f7757485679566d5a4c4e555a5264486455553055346246424f545842355347395a4d5764565630383051586836616a4a485447746c62544e325a44593d\n'
29
b'> What does this mean:\t54336c4b52546c776357553361574676546e686964445644576c5a7a5445646f646c6c58625668454d6c524253324d774f464d30556b31516456566e55556778636d354353577872526e64715a44597a656d593d\n'
30
b'> What does this mean:\t59544e334e545a42596d6f78546d3430523370345a305a49625842354d485a534f45397653564e316245527a5a454a51576d4e56563070526130784c5647685a6158465757475a304f544a46636b4e4e5a54633d\n'
31
b'> What does this mean:\t57586f3459585a4d566d39785256527755553148557a5a314e32786a5330706b53456b7a596d316d5244567a616e52424d486851513156754f5670475a7a4579655452535a584a5057476833546c64706130493d\n'
32
b'> What does this mean:\t596d784861476c745131526c4f46685363584e686455686a52484a42626b70585a31704a545864575533705a634868564d7a59335a6b35474d6e6c4655454a524d47704c6230394d4e544535646d74304e47513d\n'
33
b'> What does this mean:\t523142704e54525463557477644656754f46645265484a33616d68685a47397454544a6d566e4e4454307032556d74735756706a51545a454d305643546a6c6953485577526c52365744646e5355786c6554453d\n'
34
b'> What does this mean:\t553341775657307a61556c4957445235517a6472636b74465a6c6f31624739455455646c54445a50526a46574f454a3461485669575652755156466b63586f35644746715a33646a55453532536c64534d6e4d3d\n'
35
b'> What does this mean:\t64466461517a673063456c3552453178566b706b56446b3264546331636d35515a553576656e5a6f6432707a5746466e5345464c5444425059576b7a55324a72527a4646526e685a556c566d62473079516d4d3d\n'
36
b'> What does this mean:\t54484d3156573171596a6b3363444a4664566c7352455a7251574e486233644965444275553245325333704351314255546b31504d7a6878556e5a52536d68595a57645756325a35636d517864476c615354513d\n'
37
b'> What does this mean:\t4d564a30566b4e7162327448654670704f55527862576468563155304e6b704d5455393555474e42574734335532677a646b4a73534856365554426c4f475255575556476432593153306c7a63474979546e493d\n'
38
b'> What does this mean:\t4d555255646e643553573931526a6b7a4d4768704e6e42565331646e636b4650523256695a44524e5557343162487030556d4e4f5345566d51315a6157464e4d4f4773795547707862554a4b6544647a59566b3d\n'
39
b'> What does this mean:\t55303435617a466b4d456c6a56334e6e51566c43566a5656555842365431687352444a71625468616545646d5330784b4e30687559586c515a555a76646d4a79556e6446645768706448453256454d304d30303d\n'
40
b'> What does this mean:\t5a55517855556434656c704c62464270547a4e5551545671526b4e59596e466d64315a546132393556303556525730334d6a5a434d4577344e45687561464a795a48566e536c6c6a646d464e4f584e775358513d\n'
41
b'> What does this mean:\t645642585133427a5a6d704b55303976636d6778635749794f4578486547564e52546445576e5a705a455a424e46464f4f566c3353474e4a57444236644459314d304a72556b745662565a55595735735a336b3d\n'
42
b'> What does this mean:\t596a464f64315532527a6c595a6b5243646d645855457846536d4e7561303171623267775530746b4e484e736458517955554e684e586c535348425a576d563665456c504e323142526a4e57636e45346156513d\n'
43
b'> What does this mean:\t55444577654570766157524e4f4851354e304e5856465a6e646e426c575452536145643363555a43617a4e7a4e544a3157486c7455324e505a6b6c795246464d616b74424e6d4a6862453561656b56755655673d\n'
44
b'> What does this mean:\t525464705445466a6258465151326479596c5a4f626e5a7a516e706b5a586c5a523246496431564556303031536a5a5564584247576c685453335252617a6c715354497a4e453976624468535a6e67776144453d\n'
45
b'> What does this mean:\t51557045633345325a466c464f486c365231703063446c524d3368754e7a465154455a4c516a4a595457564462445271614535315a6e6476636d646a53476b7762564e5653565272646c646959545650556c593d\n'
46
b'> What does this mean:\t6444457a64577033636d56476346466a53557868516a5a7052564e7a6230393452486b355231644463565a73565464495754426f4e544a4b55467075546b4659646b74556257643654545272556d51345a6d493d\n'
47
b'> What does this mean:\t516e526c53564e5757486c3455557432616c52565454686e595767304d30784f5a4456365546705a62334e774d6d6c785257314462455233626e56724f55686d4e334a6a543059774d545a5852307053596b453d\n'
48
b'> What does this mean:\t5a314242526d567151324d32635468695555355456446c4e65456859624552484e5570764e476c5756584d7754316c36544856304d6a4668516d7477626c704653316435556e4a4a61444e3362575a324e32513d\n'
49
b'> What does this mean:\t5557593056444e5a62476c4759574e42556a564e516b354956585a505233425162574932576d35796454686f536b7435637a46715746633362306c3664454e545a457846524764574f5449775a5774336548453d\n'
50
b'> What does this mean:\t56335a796233567056574e7254454a75625846475a7a64714d303830536d56684d5768695757513455336735556e4e77656b68574e6d7835523030794e58524252564233576c684f5a6b4e4c5246457756456b3d\n'
51
b'> What does this mean:\t54446b315231644a59564a72516e707351316f345a55467857573546566d70745a326b785a6a4e315a45686a546c6830554574504e45316f52445a35643156775558684b526c4e7a4d6e4a6956446432627a413d\n'
52
b'> What does this mean:\t65466478547a5a765331707354486c54625455794d5768706430493556573536575464535a4764476458524b4f47457a636c5269534646325545357a63454646566b4e4a593052484e4531594d47746d5a576f3d\n'
53
b'> What does this mean:\t526b647556544a425a4868736448465a64305654595668455444527262336f775a7a6c355933426f637a685555453561636b4a4e55557050566b745361545a694e306b78625759315a5856714d30683256304d3d\n'
54
b'> What does this mean:\t5a7a4a3262564a7a546d68566457746a5358645063556475515868354e7a467159573936534452464f545a6d64476c595632786b536e4a474e56704454474a575a5531774d464e515330524355544d345756513d\n'
55
b'> What does this mean:\t556b4e77566c6f334d474d79636b7452635664334d32466f536b3573516b6451616d56475156566e4e464e31644578365345317063316c4a4f445532596e5a756557314565475a504d57397256446c6b5745553d\n'
56
b'> What does this mean:\t613370506244466a6544527a566a4e755955315662575a77553264536148593255566c5552546379546c704557486b776158524d616b464a516b7469526b4e514f5752585233646c62335531636b673463556f3d\n'
57
b'> What does this mean:\t64566c424e315276517a56754e6e4e4854565978593364324d4763304d3035616255786b615868785355526c5a6b745955464a30596d78584f544a354f4870545657464654305a715555707761477449636b493d\n'
58
b'> What does this mean:\t5646644c4e5668315356464b4e6e706b576a686d596d39775a334a35616d3133546b31475255647864454578646d78704d316c54626b51774e33673559574e5061314a7a516c426c4e4578574d6c566f53454d3d\n'
59
b'> What does this mean:\t52325642566d7046656b744f65553143536a5a30534768684e4856704d58424a543274345a3231475531425656485a78593259795245786b636c70754e5749774f56677a55564a4462316c334e3164734f484d3d\n'
60
b'> What does this mean:\t64314e555458424957577453576c46584e336b35616e52765a7a426b646d4a6a526d7878537a68755a55395156566831527a5a444e48686d61445670546a4a464d30524d4d554a57656b707962556c6851584d3d\n'
61
b'> What does this mean:\t636a52305a6a4a474e7a6846536e64695a33464f5356457a5532466f616b46764e55526a4d577335556a5a4d4d4870506545744857584255615568585a454e7a545642566256703562465a435a5668756458593d\n'
62
b'> What does this mean:\t55315252596e646f59574e4a626d394b4e3231575a6b4e494f4846424e486731546d707352575532644578704d305a79576e6c505a44465864585a486345745a5744425355484e72545656435a3370454d6a6b3d\n'
63
b'> What does this mean:\t62306c7955565177526d51346448706c65557458576e425964564e325158685152446c4d52553574516d746d5655316e4e33646859306844547a46484d32687057564a7a63556f324e4735574e5770696244493d\n'
64
b'> What does this mean:\t54477456576d52316230527a59314e43647a68794e6b5a4b56476733543046774d556470596d314659556c53517a563053485a4c54575a6e4d47704f656c5a3465577878567a6b7a55544a6c574734305756413d\n'
65
b'> What does this mean:\t4f4849775a315a50526d51324d30645559577474536b6c3553464e4e616a526f63325a5a57486f33515739325332567363476c524d6b787556584651546e513551324e46645455785631703452474a33556b493d\n'
66
b'> What does this mean:\t52316b3552545a564d465a78596a4e76646d744359324630634664735431526c536e566e576a55795555464a5a487074526b4e6d556c42345246687a4d5864705347354d616b3430537a673361484a355530303d\n'
67
b'> What does this mean:\t4e7a465a635539316255744954554a68565670705a444a6d536a5669566a5a445a545233546e706e627a4234593351355531673456306c35526c4a426246424854484e32564768525245557a626e4a7761326f3d\n'
68
b'> What does this mean:\t52324a32526d525a5256704362306c305554523351557053557a645565486b32524531495a6d3159656b4d78616d466e5a55744d4f444a796133457755484e6a546c5a3161544e6f54323558624455355658413d\n'
69
b'> What does this mean:\t546d704c593246434d47737a4f484650535752515a56464262317070544552496333526e4d55704857545657646d5a7957474a44626a5a474d6a6c35634778535533566f6431564e4e46524662586f336546633d\n'
70
b'> What does this mean:\t5447396b536a4a694d5746334e55527561546c7163584e6c61335250535646445632784f636c4e46566a5a614d48706f62566c6a5454524753485a534f4642775a6d6456527a64356548564257444e435331513d\n'
71
b'> What does this mean:\t4d474e5a636c42345a306c35656e5a68556c4d7a523238336445706f626a5631615552715347315662445a4e516b4e574d586469546a4a4d576b5a465a5842525155746d5a484e59617a6b30563152504f48453d\n'
72
b'> What does this mean:\t64304e53627a597761585a555a55684f5157526a63564d784e304a365448417957474a725a6a566162464130637a4d34535856755657645059584a345330316f52316c4662565a45526e527165546c4b5556633d\n'
73
b'> What does this mean:\t5a55466b65544249535856474e486868576c64334e6a46725445356d4e5552544d6d6c436148524b616c4a6e52334a5562546c51597a673363454e6955566878566c6c4656553973646e4e7562336f7a5455733d\n'
74
b'> What does this mean:\t6545397a5644673353454e596455524363446c485156566d596e5a72526a42684d7a5578563142545a476c4d5a32355259323946536c6c4c6248464a6447683365565979616e70614e6a526c62564a4f5458493d\n'
75
b'> What does this mean:\t5231564363564d3351334a505154426b5a564a52646e6c3153326f785756513263444a7a6144527364307070576e5269544552494f453557656d3835626d5a7253564268526e686a545456584d30566e5747303d\n'
76
b'> What does this mean:\t5155646e4d455a4962566f7956485a504e315a596158497a593074736331645461475669525845354e486c5a643342534e6c5636554577344e553130516d347861336876536c46715a454e6d546d463152456b3d\n'
77
b'> What does this mean:\t65574e47616a4a616345707563334930646b3949566d68524d566869627a6442643152485a6b3554656e565652454d32533264786547773157566468516c42744d32566b6130777753564a46545851354f476b3d\n'
78
b'> What does this mean:\t63565a35647a526b65453432576b4a4856314e4a543059336245567054574a726333705a4e576468556e5a7164475934555446744f554e4b54444a6c51564231614442795346564c4d3235775746524562324d3d\n'
79
b'> What does this mean:\t5630644d536b4e7262324645616d526e55454534555867304e58426f64466878596b3879636e4d7a6433564c54545a49553055335a555a6a566a425553585a5a62564a6165575a4f4d57353662476b355655493d\n'
80
b'> What does this mean:\t5658684f5a6a4a3361566c4b6256646952444271517a525064446b785a44673156445a736233705463455661637a644764565a68523074796557687853485a6e4d30464a5932565254554a536132354d5546673d\n'
81
b'> What does this mean:\t4d44684b626d6c6b5130307956553935566e4a76556d687a613056546356706962574651567a644554454a48526a5a6a5a6d637851585a6c56466c3165446c36644568594e54524a546d6f7a5558644c6248413d\n'
82
b'> What does this mean:\t54554d315a6a6c72656e4e4951576871535642526558526961557057635764464e7a424f62457847623256345a4842755647465964314d7953316c3252304a564f47303056334978556c6f3264544e6a5245383d\n'
83
b'> What does this mean:\t543170476230706d645564594d485a6a626d6c6c59553545656e4e785457683552545657596a686e644731585a456c525658633262464279516a464d57554e424e486872556b677956464d35533270774e7a4d3d\n'
84
b'> What does this mean:\t5a47357a546e4a51616d56734d58564263455531565652534d476848536e644a5757743464445a7859324a3561546b306257464c566b39475a7a64544f444e49656e5a4e56325a5951304a765555777952466f3d\n'
85
b'> What does this mean:\t52315a49643255355354685963575a55576b466e6246426865455a54646a5533636c465665554a3162586f78626d67305432743053306f774e6b356b62334e4d5131497a596c6c58545551795258427161574d3d\n'
86
b'> What does this mean:\t62305a524e484e434e6c644e52566c72593270445545705561555177534464426432786e625752364e58465352306c6d645735595a546c4c646c5a614d6d46695658513454334a776558684d4d326854546a453d\n'
87
b'> What does this mean:\t565464336358566b55544246626e5a615a6c6735534842725631524d5a5851305354466e4d307379656a6868536d4e70566e4e7155304a4e62316c5354304e474e6d7834596b5131546b646f636d31355156413d\n'
88
b'> What does this mean:\t59334d78643252515233707161316454536e684e51325a7953545a6e4e46685053464a42646b5a685a57394655576c314f5464566347314d52474a434f485275546e4531533152574d6a426162466c354d32673d\n'
89
b'> What does this mean:\t526d6476633163344d6d313354306442575752695347684e4e6b49305a5670525132787257457333535845784e58566a615870575657464f6547357152585a555a6b78354f58524555484177636b70544d31493d\n'
90
b'> What does this mean:\t57574676566a5a774d6c567961485a74527a527a6445465557466f7a5545737761555a3354336c78596a643162446c6e5a6d526a616a5653656e6846516a46755130784a5555524b4f47564f6131644e5530673d\n'
91
b'> What does this mean:\t5748644e616c46456447397a5a55566a5a6c4d314f565a6e6355746f62544a4865464250646d6c4b51315133576b4a366554457a636e56476247464a4d474a754f45787263465642546b67325a466b30556c633d\n'
92
b'> What does this mean:\t613268345530646c4d54637a4d6d5a4e57465a77537a6c78556b4a4455486c7053573930536c7049546a565264304650636a4236616a5a58596c5130624468685a32356b54455a746331563252574e3152466b3d\n'
93
b'> What does this mean:\t545841354f475a7a646c5a51567a557a51574e30525573335445525555324a59516d644b52314a6c626e687465544a4f513251304d456879576d464a656d687263586476616b39476457777856566c704e6c453d\n'
94
b'> What does this mean:\t5a6a425763336c61526c46796157315a5a57707355444e454e3168554e6b7730516b35345355467753303978597a45355133557955335931623064536446644661326734536b316e5955686964325256626e6f3d\n'
95
b'> What does this mean:\t62586c4756445a4865464a336457646a61476c5156314669574734314d327857536a467252544a425130314352484a4a644752785956557757545249546b3833576d5535616b7876646a686d656c4e4c6333413d\n'
96
b'> What does this mean:\t4f454a44566b30336255357357446c6c565735474d6e56725544566d556d6c6f52335a4a56474a4b4d32457855334e49547a593065454661616d526e6230786a656e52336348465252584a4556336c4c5754413d\n'
97
b'> What does this mean:\t4e30314f4f47746d5746467864306c61564868685432686b62455a445a574e3151544e46596b633155484a7a536a6c54616a46364e6a523263465a4d52466456655574306257637953476c43556d39755754413d\n'
98
b'> What does this mean:\t614456444e32777a5957564b5a6a5236646b56694d464a4c5933426e57556c7056557878636b3150516c704256465a7a5a456379555852766256644f626b5a3465545a31616d733464316849553052514f54453d\n'
99
b'> What does this mean:\t526b6b7963576449536e6869646e527562565a56517a56704d564650516d464657484a735445316c656e6c7a616b3577563259324f57396b52464e514e30733056466c6a556a677a61444233576b46486457733d\n'
100
b'> What does this mean:\t4e464e5857485645565531504e6a6c79646b786c4d54565a63464651655852424d305a445a324a3653325a466232357153465a336332317363576c61595868485931524f4d6a426f556a6334536d52435357733d\n'
101
b'> CloudSEK{au30ma3i0n_1s_fun}\n'
list index out of range
[*] Closed connection to 43.204.152.119 port 1337
PS D:\GitHub\ctf>

Flag: CloudSEK{au30ma3i0n_1s_fun}

Illusive Mind with Illusive Thoughts

Points: 100

On 1st October, Our Underground Intelligence Team observed a post at the Dark Web, where an hacker claiming to have whole Database dump of the CSP Bank [Central Public Bank] and was selling it for $5000.
Soon our security research team started digging further to find out the root cause of this leak, as CSP Bank’s web assets scope were limited and properly secured, we didn’t find anything. Then our team indexed all the apps belongs to the CSP Bank at Bevigil (World’s first security engine for mobile apps) and started performing their research.
Later they came to know that CSP Bank Firebase database were misconfigured i.e open to the public through one can get the sensitive information to chain it further.
Moving further, our team checks the other app of the company and noticed something suspicious at the “Unknown High Entropy String” rule of the Bevigil which gave the credentials of the DB through which we accessed the Database having Admin Privilege.
Soon, we documented the detailed research & notified to the compromised company about this incident.
Flag format: Once you get it, you would know it.
Note: Some apps of the CSP bank has been deindexed, so one has to find out a way to reach the other apps.
https://bevigil.com/osint-api
Hint
- You can search for all the URL present inside a Package on the Bevigil Asset Explorer
- Bevigil Asset Explorer: https://bevigil.com/osint-api?query=com.intl.cspbank&criteria=package

We can use https://bevigil.com/ and search for CSP Bank, we get this result https://bevigil.com/report/com.intl.cspbank?section=assets

In this section under ASSETS we see Firebase URL Rule Here we see that it is exposed in com.intl.cspbank/source/sources/com/intl/cspbank/constants.java file

Firebase URL is: https://csp-bank-default-rtdb.firebaseio.com

From the description we know that this Firebase database is misconfigured and open to the public so we try to access the database by visiting \.json file on url

https://csp-bank-default-rtdb.firebaseio.com/.json

we are able to see the database content. In this file we see one entry on index 45, line 317

"45": {
        "Account Name": "Central Public Bank",
        "DB_URL": "https://mysql_db.cspbank.com",
        "ID": "Y29tLmludGwuY3NwY2FyZA=="
    }

In this the value "ID" is base64 encoded, by base64 decoding this we get com.intl.cspcard

cspcard is new app name so we search this on https://bevigil.com/ and we get this https://bevigil.com/report/com.intl.cspcard?section=strings

There is one "Unknown High Entropy String" rule in this report and it is also mentioned in description of challenge.

It is exposed in com.intl.cspcard/source/sources/com/intl/cspcard/sec_data.java this file

when we analyze this file we get the_key string which is long hex.

private final String the_key = "D8 FF 20 FF 20 E0 20 00 20 10 20 42 20 46 20 21 20 11 20 00 20 01 20 00 20 48 20 6E 20 27 20 5F 20 2E 20 5F 20 2E 20 73 20 6F 20 6D 20 65 20 52 20 61 20 6E 20 64 20 6F 20 6D 20 43 20 68 20 61 20 72 20 61 20 63 20 74 20 65 20 72 20 73 20 2E 20 5F 20 2E 20 5F 20 0A 44 0A 20 6F 6F 6E 20 74 74 73 72 6F 20 65 61 68 64 72 6F 63 65 64 2F 64 6E 65 6F 63 65 64 20 64 72 63 64 65 6E 65 69 74 6C 61 20 73 6E 69 74 20 65 68 63 20 64 6F 2E 65 20 0A 43 0A 6E 6F 72 67 74 61 2C 73 59 20 75 6F 6D 20 64 61 20 65 74 69 20 2E 65 48 65 72 69 20 20 73 6F 79 72 75 66 20 61 6C 21 67 43 0A 6F 6C 64 75 45 53 5F 4B 65 42 69 56 69 67 2D 6C 64 7B 5F 62 64 61 69 6D 3A 6E 64 61 69 6D 40 6E 38 39 7D 37 0A 0A 43 2D 6F 6C 64 75 45 53 20 4B 65 53 75 63 69 72 79 74 54 20 61 65 0A 6D 5F 20 2E 20 5F 20 2E 20 73 20 6F 20 6D 20 65 20 52 20 61 20 6E 20 64 20 6F 20 6D 20 43 20 68 20 61 20 72 20 61 20 63 20 74 20 D8 20 FF 20 E0 20 FF 20 10 48 69 6E 74 2D 4A 46 49 46 20 D8 20 FF 20 E0";

Decoding this from hex we get somthing like this:

D
 oon ttsro eahdroced/dneoced drcdeneitla snit ehc do.e 
C
norgta,sY uom da eti .eHeri  soyruf al!gC
olduES_KeBiVig-ld{_bdaim:ndaim@n89}7

C-olduES KeSucirytT ae

if we look carefully we realize that every 2 characters are swaped we can use python to get the message

a = """D
 oon ttsro eahdroced/dneoced drcdeneitla snit ehc do.e 
C
norgta,sY uom da eti .eHeri  soyruf al!gC
olduES_KeBiVig-ld{_bdaim:ndaim@n89}7

C-olduES KeSucirytT ae"""

for i in range(0, len(a), 2):
    print(a[i+1],a[i], end="", sep="")

Output:

Do not store hardcoded/encoded credentials in the code.

Congrats, You made it. Here is your flag!
CloudSEK_BeVigil-{db_admin:admin@987}

-CloudSEK Security Tea

Flag: CloudSEK_BeVigil-{db_admin:admin@987}

Hack the Wires

Points: 100

Recently, we got an email from an anonymous person reporting that a Hacker has setted a proxy for Bevigil which allows anyone from the internet to use Bevigil for Free and Unlimited. He might has Stolen a session cookie from our internal CloudSters and used that in the proxy. We blindly can’t expire all the session’s cookies for user experience, so we need to figure out the Particular session cookie and expire that only.
The anonymous person has also shared an android application naming Bevigil for Free and Unlimited hosted at BeVigil where an attacker has stored the Proxy URL in the app’s assets [IPs, URLs, Hostnames, etc] & his details for publicity stunt.
Could you help us to find out the same cookie so that we can revoke it as soon as possible!!
https://bevigil.com/report/com.intl.bevigilunlimited

In this report after looking in assets we get this file com.intl.bevigilunlimited/source/resources/res/values/strings.xml which contains the proxy URL

In this xml file we get this url:

<string name="proxyUrlBackup">https://webctf.cloudsek.com/hack-in-the-wires</string>

In the source code of this given url we get the following comment:

<!--
  $cookie = file_get_contents("/cookies.txt");
  if ($_GET['getData']){
      if(preg_match("/^http.[:]\/\/(bevigil.com\/)./", $_GET['url'];)){
          $response = file_get_contents($_GET['url'];, false, $cookiesAndHeaders);
      }else{
          $response = false;
      }

  }-->

by analyzing this php code we can divide this process in 3 steps

GET parameter getData=true to satisfy the first if condition
value of GET parameter url should match the regex ^http.[:]\/\/(bevigil.com\/).
use LFI in url parameter to read the /cookies.txt

first condition is easy just include getData=true in GET request

for the seconde step let's understand the regex

^http: it means the string should start with http
following . means any one character
\/\/ it means //
(bevigil.com\/) it means a group in first it start with bevigil + . meaning any one character + com + /
last . meaning any character

for example: https://bevigil.com/a this will match the regex

but trying LFI in this dose not work so i will use online php editor to debug the payload

In this online editor i'm using payload=echo file_get_contents("https://bevigil.com/../../.code.tio"); In the debug section we can see following warning:

PHP Warning:  file_get_contents(): Unable to find the wrapper "https" - did you forget to enable it when you configured PHP? in /home/runner/.code.tio on line 3

It is trying to parse the http protocall so now we have make sure it dose not identify our payload as http url so we can read the local file for this we have . in regex after http so first i tried different characters like httpq, httpd but it still identify it as http then i tried special characters, : works now in editor payload=echo file_get_contents("http:://bevigil.com/../../.code.tio"); works so now we just need to try few ../ to get /cookies.txt

finally the payload=http:://bevigil.com/../../../../../cookies.txt give us the flag

https://webctf.cloudsek.com/hack-in-the-wires?getData=true&url=http:://bevigil.com/../../../../../cookies.txt

Flag: CloudSEK{3FI_i$_C00!}

:octocat: Happy Hacking :octocat:

Previousctfs NextCTF

Last updated 1 year ago

Was this helpful?