42 Commits
Author SHA1 Message Date
maik 9da5c9936a fix: show active on dark theme 2026-08-08 20:21:40 +02:00
maik ba1077b0c8 feat: improve pagination 2026-08-08 18:37:45 +02:00
maik 7997a5b895 Update home subtitle 2026-08-07 00:28:04 +02:00
maik 6756fb5af6 Update about page 2026-08-06 23:21:24 +02:00
maik 3e078bf55f Remove wallet from footer 2026-08-06 23:21:13 +02:00
maik fab68f78fb Fix use max height instead of height 2025-01-05 02:09:50 +01:00
maik af3694f0ef Add a ToC that is always visible on desktop 2025-01-05 02:02:52 +01:00
maik 46c6f9037e Fix indentation 2025-01-05 01:13:00 +01:00
maik 31a552963f Fix link color on dark mode 2025-01-05 01:12:49 +01:00
maik a2dc744551 Add act3-elf-stack writeup 2025-01-04 18:10:47 +01:00
maik 868c11507c Improve table layout 2025-01-04 18:10:28 +01:00
maik 6fa9f7b09f Fix linting and formatting issues 2025-01-04 13:03:35 +01:00
maik cc261d6aaa Add styling for h5 and h6 2025-01-04 12:50:03 +01:00
maik 5487b22a4f Fix looks of nested code block in collapse 2025-01-04 12:45:02 +01:00
maik 631eb1219a Add act3-santa-vision writeup 2025-01-04 03:46:44 +01:00
maik d3b327afc0 Fix border radius and add padding so code visible with copy button 2025-01-04 03:39:51 +01:00
maik 0fe3cf6682 Fix highlight's incorrect top border on collapse 2025-01-04 03:39:14 +01:00
maik 1dbbb4a325 Make covers more colorful 2025-01-04 01:04:06 +01:00
maik e0e562be5e Fix hidden class, set display none to be important 2025-01-04 01:00:02 +01:00
maik 844ad3b9ac Add act2-microsoft-kc7 writeup 2025-01-04 00:16:02 +01:00
maik 6242a1f876 Fix w3 validation errors 2025-01-03 22:04:15 +01:00
maik 201ba2ef75 Add copy code block functionality 2025-01-03 22:03:55 +01:00
maik 2c9eef4749 Fix hamburger menu not being centered 2025-01-03 22:03:17 +01:00
maik 0f2d9a4dc1 Properly support line numbers on highlight 2025-01-03 20:44:46 +01:00
maik 8513bd9ac5 Fix border 2025-01-03 20:44:23 +01:00
maik 990640b79a Improve highlight color 2025-01-03 20:44:06 +01:00
maik e4dffe1d19 Add act2-snowball-showdown writeup 2025-01-03 16:15:06 +01:00
maik db9373b9f8 Add act2-powershell writeup 2025-01-03 16:14:33 +01:00
maik bfd686f940 Fix blockquote quote location on mobile 2025-01-02 12:32:18 +01:00
maik 2ef57de694 Add act2-drone-path writeup 2025-01-02 01:48:23 +01:00
maik c76df05651 Add act2-mobile-analysis writeup 2025-01-01 15:18:42 +01:00
maik 195def9964 Add more elf messages 2024-12-31 16:47:26 +01:00
maik 7edaf1993f Add act1-hardware-hacking part 2 writeup 2024-12-31 16:25:15 +01:00
maik 1a201a554a Improve table looks 2024-12-31 16:24:51 +01:00
maik f11331d900 Slightly improve x shift 2024-12-31 13:52:36 +01:00
maik 3f3d2d7c41 Add act1-hardware-hacking part 1 writeup 2024-12-30 22:00:22 +01:00
maik d4bc6b0a00 Fix popup image sizing 2024-12-30 21:28:44 +01:00
maik eb70525934 Add hints and update story formatting 2024-12-30 20:55:03 +01:00
maik 1f9042cb72 Fix links messing up count 2024-12-30 19:49:49 +01:00
maik cf537b1488 Show checkmark after copying/selecting heading 2024-12-30 18:46:33 +01:00
maik af883f2f6e Allow collapsible blocks to be tightly together 2024-12-30 18:18:56 +01:00
maik fc16fb4046 Improve collapsable code to be reusable 2024-12-30 18:08:57 +01:00
166 changed files with 9540 additions and 951 deletions
Binary file not shown.

After

Width:  |  Height:  |  Size: 2.2 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.9 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 5.5 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.0 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.2 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 662 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 322 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 20 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 1.1 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 14 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 34 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 6.9 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 17 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 12 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 40 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 6.2 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 12 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 11 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 18 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 10 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 634 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.9 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.6 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 586 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 607 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 564 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 107 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 607 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 548 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 493 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 506 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 582 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 135 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 601 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 685 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.9 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.8 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 315 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 525 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.6 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.2 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.7 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.0 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 81 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 26 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 51 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 58 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 86 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 25 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 63 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 28 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 108 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 107 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 136 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 77 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 124 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 48 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 49 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 11 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.6 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.2 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 572 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 538 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 627 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 533 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 560 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 541 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.6 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.4 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 66 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 316 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 54 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 115 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.9 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.7 MiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 947 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 978 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 982 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 972 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 108 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 110 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 108 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 925 KiB

+11 -5
View File
@@ -40,6 +40,12 @@ page = ["HTML", "RSS"]
[pagination] [pagination]
pagerSize = 12 pagerSize = 12
[markup]
[markup.tableOfContents]
endLevel = 4
ordered = true
startLevel = 2
[params] [params]
dateform = "Jan 2, 2006" dateform = "Jan 2, 2006"
dateformShort = "Jan 2" dateformShort = "Jan 2"
@@ -49,7 +55,7 @@ dateformMonth = "Jan, 2006"
# Metadata mostly used in document's head # Metadata mostly used in document's head
description = "Hey there, my name is Maik de Kruif, I create websites, bots and other kinds of software. At the moment, I'm still studying computer science at Avans University of Applied Sciences. I am also a big fan of open-source software, which is why you'll find many of my projects on Github. And last but not least, I love playing around with cyber-security related stuff." description = "Hey there, my name is Maik de Kruif, I create websites, bots and other kinds of software. At the moment, I'm still studying computer science at Avans University of Applied Sciences. I am also a big fan of open-source software, which is why you'll find many of my projects on Github. And last but not least, I love playing around with cyber-security related stuff."
keywords = "Devloper, Software Engineer, Software Developer, Maik, Computer Science, Portfolio, Blog, Maik de Kruif" keywords = "Developer, Software Engineer, Software Developer, Maik, Computer Science, Portfolio, Blog, Maik de Kruif"
images = [""] images = [""]
genre = "Blog" genre = "Blog"
@@ -58,7 +64,7 @@ rssLimit = 15
showReadingTimeInList = false showReadingTimeInList = false
homeSubtitle = "Software Engineering, Linux and Cyber Security" homeSubtitle = "Software Engineer and Cyber Security Specialist"
# Prefix of link to the git commit detail page. GitInfo must be enabled. # Prefix of link to the git commit detail page. GitInfo must be enabled.
gitUrl = "https://github.com/maikka39/Personal-Website/commit/" gitUrl = "https://github.com/maikka39/Personal-Website/commit/"
@@ -125,9 +131,9 @@ image = "/img/home/portrait.png"
twitter = "@maik_dev" twitter = "@maik_dev"
# Wallets # Wallets
[[params.wallets]] # [[params.wallets]]
name = "XMR" # name = "XMR"
address = "83cfsXGHPaW81hKJtAPYZEgbfFqANMTXXRwghsBpjf5oTDRV3BnCC4jFno8tLTnF4C6gJzGjPEmpvjntXaiGBB7kVitkDKi" # address = "83cfsXGHPaW81hKJtAPYZEgbfFqANMTXXRwghsBpjf5oTDRV3BnCC4jFno8tLTnF4C6gJzGjPEmpvjntXaiGBB7kVitkDKi"
# Social icons # Social icons
[[params.social]] [[params.social]]
+3 -6
View File
@@ -2,7 +2,7 @@
author = "Maik de Kruif" author = "Maik de Kruif"
title = "About" title = "About"
date = 2021-11-19T12:26:01+01:00 date = 2021-11-19T12:26:01+01:00
description = "Ever since I was a little kid, I've loved coding. From the moment of writing my first program in Python and manipulating it to produce the desired output, I have been obsessed with the idea of writing software to solve practical problems. Programming is like a never-ending puzzle where you continuously have to come up with a new way to solve it." description = "I’m a passionate coder with a strong foundation in programming. With a love for solving practical problems through software development, I am driven to continuously explore new ways to create innovative solutions. My personal side-projects and exploration of cybersecurity further enhance my skills and dedication to building powerful and impactful applications."
images = [] images = []
tags = [ tags = [
"aboutme", "aboutme",
@@ -10,12 +10,9 @@ tags = [
categories = [ categories = [
"me", "me",
] ]
toc = false
+++ +++
Ever since I was a little kid, I've loved coding. From the moment of writing my first program in Python and manipulating it to produce the desired output, I have been obsessed with the idea of writing software to solve practical problems. Programming is like a never-ending puzzle where you continuously have to come up with a new way to solve it. Ever since I was a little kid, I've loved coding. From the moment of writing my first program in Python and manipulating it to produce the desired output, I have been obsessed with the idea of writing software to solve practical problems. Programming is like a never-ending puzzle where you continuously have to come up with a new way to solve it.
Outside of my job, I run a small business with a couple of friends where we develop drone shows. I'm responsible for both designing and writing the control software as well as creating and designing the actual drones. When I get home after work, I tend to either continue writing code for some personal side-projects, or play around with cyber-security related stuff. Occasionally, I can also be found working on electronics projects. This is what keeps me up at night, a never-ending thirst to create beautiful, powerful things and share them with the world.
When I get home after work/school, I tend to either continue writing code for some personal side-projects, or play around with cyber-security related stuff. This is what keeps me up at night, a never-ending thirst to create beautiful, powerful things and share them with the world.
Skills/Interests: Python, Java, Scala, JavaScript, Node, CSS, HTML, Git, SQL, MongoDB, Apache, Nginx, Docker.
@@ -25,7 +25,6 @@ During one of his earlier videos, LiveOverflow challenged his viewers to find th
In LiveOverflow's eighth video, [he told his viewers that the server has been opened to the public](https://youtu.be/QradKmQ27JY?t=1246). I immediately started looking for ways to find it. After researching for a while, I found multiple ways to find it, but I thought they would all take a fair bit of time (I'll get back to this later). So, instead of spending time actually learning stuff, I rewatched his videos to see if there would be a clue in there. Luckily it worked out. In [one video](https://youtu.be/Hmmr1oLt-V8?t=28) he blurred the IP inside the terminal, but forgot about the terminal title bar :smile:. I notified him of this, as it was obviously unintended, and the IP was changed shortly after, as many people apparently found it. In LiveOverflow's eighth video, [he told his viewers that the server has been opened to the public](https://youtu.be/QradKmQ27JY?t=1246). I immediately started looking for ways to find it. After researching for a while, I found multiple ways to find it, but I thought they would all take a fair bit of time (I'll get back to this later). So, instead of spending time actually learning stuff, I rewatched his videos to see if there would be a clue in there. Luckily it worked out. In [one video](https://youtu.be/Hmmr1oLt-V8?t=28) he blurred the IP inside the terminal, but forgot about the terminal title bar :smile:. I notified him of this, as it was obviously unintended, and the IP was changed shortly after, as many people apparently found it.
{{< figure src="/img/posts/liveoverflow-minecraft-server/first_ip_screenshot.png" title="Screenshot of video containing the IP address" >}} {{< figure src="/img/posts/liveoverflow-minecraft-server/first_ip_screenshot.png" title="Screenshot of video containing the IP address" >}}
### IP change ### IP change
@@ -36,7 +35,7 @@ During my research, I came across masscan. This is a piece of software that lets
I got to work and wrote a script that scans the IP range in which the old IP was located. It starts by using masscan to scan the entire range of IP addresses, and saves it to a file to use later. I then read this file, and request basic Minecraft server information like its MOTD, players and favicon. This information was saved in another file, in which, I could easily search for LiveOverflow. In the end, the new IP only had one digit changed. I got to work and wrote a script that scans the IP range in which the old IP was located. It starts by using masscan to scan the entire range of IP addresses, and saves it to a file to use later. I then read this file, and request basic Minecraft server information like its MOTD, players and favicon. This information was saved in another file, in which, I could easily search for LiveOverflow. In the end, the new IP only had one digit changed.
{{< code language="python" title="scan.py" isCollapsed="true" >}} {{< collapsible-block badge="python" title="scan.py" isCollapsed="true" >}}
```py ```py
import masscan import masscan
@@ -261,7 +260,7 @@ print(len(current_servers))
print(len(valid_servers)) print(len(valid_servers))
``` ```
{{< /code >}} {{< /collapsible-block >}}
_This code is copied from a Jupyter Notebook, so it's not the most efficient and may not even work, the [here for the Github Gist of the Notebook](https://gist.github.com/maikka39/8019e2f1a45e1021fff05bd1e1688e14)_ _This code is copied from a Jupyter Notebook, so it's not the most efficient and may not even work, the [here for the Github Gist of the Notebook](https://gist.github.com/maikka39/8019e2f1a45e1021fff05bd1e1688e14)_
@@ -117,7 +117,7 @@ Let's try to use the previous attack but with the flag file:
We get a big error: We get a big error:
{{< code language="html" title="Error message" >}} {{< collapsible-block badge="html" title="Error message" >}}
```html ```html
<br /> <br />
@@ -183,7 +183,7 @@ line: 3 in <b>/var/www/html/index.php</b> on line <b>40</b><br />
<b>/var/www/html/index.php</b> on line <b>43</b><br /> <b>/var/www/html/index.php</b> on line <b>43</b><br />
``` ```
{{< /code >}} {{< /collapsible-block >}}
We probably got it because PHP is actually handling the PHP file as a PHP file 😀. This means we have to get it in some other way. We probably got it because PHP is actually handling the PHP file as a PHP file 😀. This means we have to get it in some other way.
@@ -74,7 +74,7 @@ This means the server is most likely using either Jinja2 of Twig.
Now that we found the vulnerability, we can start exploiting it. Let's start by getting the config. We can try to get it by entering `{{config}}` or `{{config.items()}}` as the emoji. Now that we found the vulnerability, we can start exploiting it. Let's start by getting the config. We can try to get it by entering `{{config}}` or `{{config.items()}}` as the emoji.
{{< code language="python" title="Result" >}} {{< collapsible-block badge="python" title="Result" >}}
```python ```python
dict_items([ dict_items([
@@ -224,7 +224,7 @@ dict_items([
]) ])
``` ```
{{< /code >}} {{< /collapsible-block >}}
If we take a look at it we find an item called 'flag' but it looks like it is encrypted in some way: If we take a look at it we find an item called 'flag' but it looks like it is encrypted in some way:
@@ -282,7 +282,7 @@ The source of the server is probably `app.py` as it's the default for flask appl
config.__class__.__init__.__globals__['os'].popen('cat app.py').read() config.__class__.__init__.__globals__['os'].popen('cat app.py').read()
``` ```
{{< code language="python" title="app.py" >}} {{< collapsible-block badge="python" title="app.py" >}}
```python ```python
import random import random
@@ -332,7 +332,7 @@ if __name__ == '__main__':
``` ```
{{< /code >}} {{< /collapsible-block >}}
When looking at the file, we see that the flag variable is set to the output of the `magic` function: When looking at the file, we see that the flag variable is set to the output of the `magic` function:
@@ -154,7 +154,7 @@ To get the subclasses, we first have to convert `''.__class__.__mro__[1].__subcl
After submitting this, we get the following result: After submitting this, we get the following result:
{{< code language="text" title="Result" >}} {{< collapsible-block badge="text" title="Result" >}}
```js ```js
[ [
@@ -643,7 +643,7 @@ After submitting this, we get the following result:
] ]
``` ```
{{< /code >}} {{< /collapsible-block >}}
In this result we find the following class: `<class 'os._wrap_close'>`. This is the `os` module and it is on index `127`. We can verify it's index by getting it from the submodules list using the following input: In this result we find the following class: `<class 'os._wrap_close'>`. This is the `os` module and it is on index `127`. We can verify it's index by getting it from the submodules list using the following input:
@@ -680,7 +680,7 @@ Now let's grab the contents of `app.py`:
{{ [[[""|attr("\x5f\x5fclass\x5f\x5f")|attr("\x5f\x5fmro\x5f\x5f")][0][1]|attr("\x5f\x5fsubclasses\x5f\x5f")()][0][127]|attr("\x5f\x5finit\x5f\x5f")|attr("\x5f\x5fglobals\x5f\x5f")][0]["popen"]("cat app\x2epy")|attr("read")() }} {{ [[[""|attr("\x5f\x5fclass\x5f\x5f")|attr("\x5f\x5fmro\x5f\x5f")][0][1]|attr("\x5f\x5fsubclasses\x5f\x5f")()][0][127]|attr("\x5f\x5finit\x5f\x5f")|attr("\x5f\x5fglobals\x5f\x5f")][0]["popen"]("cat app\x2epy")|attr("read")() }}
``` ```
{{< code language="python" title="app.py" >}} {{< collapsible-block badge="python" title="app.py" >}}
```py ```py
import random import random
@@ -732,7 +732,7 @@ if __name__ == '__main__':
app.run(host='0.0.0.0', port=8000) app.run(host='0.0.0.0', port=8000)
``` ```
{{< /code >}} {{< /collapsible-block >}}
## Magic function ## Magic function
@@ -80,7 +80,7 @@ Alas, we get the cat picture again. That's weird. There might be a filter on the
Using the same decoding method, we get the following result: Using the same decoding method, we get the following result:
{{< code language="php" title="index.php" >}} {{< collapsible-block badge="php" title="index.php" >}}
```html ```html
<!DOCTYPE html> <!DOCTYPE html>
@@ -92,7 +92,12 @@ Using the same decoding method, we get the following result:
<meta name="description" content="" /> <meta name="description" content="" />
<meta name="viewport" content="width=device-width, initial-scale=1" /> <meta name="viewport" content="width=device-width, initial-scale=1" />
<link rel="stylesheet" href="style.css" type="text/css" media="screen" /> <link
rel="stylesheet"
href="style.css"
type="text/css"
media="screen"
/>
<link <link
rel="stylesheet" rel="stylesheet"
href="https://use.fontawesome.com/releases/v5.6.3/css/all.css" href="https://use.fontawesome.com/releases/v5.6.3/css/all.css"
@@ -136,7 +141,9 @@ Using the same decoding method, we get the following result:
<?php <?php
if (!isset($_GET["image"])) { if (!isset($_GET["image"])) {
?> ?>
<a href="/index.php?image=cat.jpg">Is this santa?</a> <a href="/index.php?image=cat.jpg"
>Is this santa?</a
>
<?php <?php
} else { } else {
$path = $_GET["image"]; $path = $_GET["image"];
@@ -147,7 +154,9 @@ Using the same decoding method, we get the following result:
echo '<img src="data:image/jpeg;base64,'.base64_encode($image).'" width="100%"/>'; echo '<img src="data:image/jpeg;base64,'.base64_encode($image).'" width="100%"/>';
} ?> } ?>
</div> </div>
<div class="card-footer text-center">Almost there</div> <div class="card-footer text-center">
Almost there
</div>
</div> </div>
</div> </div>
</div> </div>
@@ -158,20 +167,31 @@ Using the same decoding method, we get the following result:
<div class="col-md-2"> <div class="col-md-2">
<img src="/logo.png" /> <img src="/logo.png" />
</div> </div>
<div class="col-md-9 offset-md-1 align-middle"> <div
class="col-md-9 offset-md-1 align-middle"
>
<p class="text-center"> <p class="text-center">
<span class="align-middle"> <span class="align-middle">
The Advent of CTF is brought to you by The Advent of CTF is brought
<a href="http://www.novi.nl">NOVI Hogeschool</a>. It to you by
is built by <a href="http://www.novi.nl"
>NOVI Hogeschool</a
>. It is built by
<a <a
href="https://twitter.com/credmp/" href="https://twitter.com/credmp/"
class="icoTwitter" class="icoTwitter"
title="Twitter" title="Twitter"
><i class="fab fa-twitter"></i> @credmp</a ><i
>. If you are looking for a Dutch Cyber Security class="fab fa-twitter"
></i>
@credmp</a
>. If you are looking for a
Dutch Cyber Security
Bachelor degree or bootcamp, Bachelor degree or bootcamp,
<a href="https://www.novi.nl">check us out</a>. <a
href="https://www.novi.nl"
>check us out</a
>.
</span> </span>
</p> </p>
</div> </div>
@@ -187,7 +207,7 @@ Using the same decoding method, we get the following result:
</html> </html>
``` ```
{{< /code >}} {{< /collapsible-block >}}
Just the PHP part: Just the PHP part:
@@ -49,7 +49,9 @@ $(function () {
socket.on("chat message", function (msg) { socket.on("chat message", function (msg) {
console.log(msg.command); console.log(msg.command);
if (msg.command === "code") { if (msg.command === "code") {
$("#messages").append($("<li>").html("<pre>" + msg.message + "</pre>")); $("#messages").append(
$("<li>").html("<pre>" + msg.message + "</pre>")
);
} else { } else {
$("#messages").append($("<li>").text(msg.message)); $("#messages").append($("<li>").text(msg.message));
} }
@@ -97,7 +97,7 @@ In [3]: pickle.loads(base64.b64decode("gAN9cQAoWAUAAABib2FyZHEBXXECKF1xAyhYAQAAA
This time our board is quite a bit larger: This time our board is quite a bit larger:
{{< code language="py" title="Board" >}} {{< collapsible-block badge="py" title="Board" >}}
```py ```py
{ {
@@ -179,7 +179,7 @@ This time our board is quite a bit larger:
} }
``` ```
{{< /code >}} {{< /collapsible-block >}}
We can see that a `chain` value has been added. From the title of this challenge, we can say that this is the blockchain that we likely have to bypass. We can see that a `chain` value has been added. From the title of this challenge, we can say that this is the blockchain that we likely have to bypass.
@@ -230,7 +230,7 @@ We can see that, to verify the game, the function loops through all the blocks i
To crack this, we can simply reverse this algorithm. To do this, I grabbed the script from the HTML source, and added a crack method like so: To crack this, we can simply reverse this algorithm. To do this, I grabbed the script from the HTML source, and added a crack method like so:
{{< code language="py" title="solve.py" >}} {{< collapsible-block badge="py" title="solve.py" >}}
```python ```python
import hashlib import hashlib
@@ -304,7 +304,7 @@ if __name__ == "__main__":
print(export_base64(game)) print(export_base64(game))
``` ```
{{< /code >}} {{< /collapsible-block >}}
After running this script, we get the following result: After running this script, we get the following result:
@@ -36,7 +36,7 @@ Visit <https://04.adventofctf.com> to start the challenge.
When opening the website we're (for the first time) not provided with a login form. It is still authentication though as we are greeted with a message: "If you have access to it the special present will be shown below:". Also, I noticed the URL changed after about five seconds. That hints at some javascript, so let's open the sources tab in devtools. We find `login.js`. When opening the website we're (for the first time) not provided with a login form. It is still authentication though as we are greeted with a message: "If you have access to it the special present will be shown below:". Also, I noticed the URL changed after about five seconds. That hints at some javascript, so let's open the sources tab in devtools. We find `login.js`.
{{< code language="js" title="login.js" >}} {{< collapsible-block badge="js" title="login.js" >}}
```js ```js
function startup() { function startup() {
@@ -93,7 +93,7 @@ startup();
check(); check();
``` ```
{{< /code >}} {{< /collapsible-block >}}
This looks like some obfuscated code. So I started with de-obfuscating the code. After a few minutes of reading the code, I remembered to always start at the output. And after looking at the `check()` function I found out I had wasted my time. This looks like some obfuscated code. So I started with de-obfuscating the code. After a few minutes of reading the code, I remembered to always start at the output. And after looking at the `check()` function I found out I had wasted my time.
@@ -72,7 +72,7 @@ As you can see the string is escaped and the result of this query will have the
When submitting it I got the following result: When submitting it I got the following result:
{{< code language="text" title="Result" >}} {{< collapsible-block badge="text" title="Result" >}}
```markdown ```markdown
| id | Description | Proof | | id | Description | Proof |
@@ -244,7 +244,7 @@ When submitting it I got the following result:
| secrets | 2-------- | 3------- | | secrets | 2-------- | 3------- |
``` ```
{{< /code >}} {{< /collapsible-block >}}
## Solution ## Solution
@@ -41,7 +41,7 @@ This is talking about robots, which my be a hint to look at the [`robots.txt`](h
### What is a robots.txt file? ### What is a robots.txt file?
A `robots.txt` file lives at the root of a website. So, for the site www.example.com, a robots.txt file would live at www.example.com/robots.txt. robots.txt is a plain text file that follows the [Robots Exclusion Standard](http://en.wikipedia.org/wiki/Robots_exclusion_standard#About_the_standard). A robots.txt file consists of one or more rules. Each rule blocks (or allows) access for a given crawler to a specified file path in that website. A `robots.txt` file lives at the root of a website. So, for the site www\.example\.com, a robots.txt file would live at www\.example\.com/robots.txt. robots.txt is a plain text file that follows the [Robots Exclusion Standard](http://en.wikipedia.org/wiki/Robots_exclusion_standard#About_the_standard). A robots.txt file consists of one or more rules. Each rule blocks (or allows) access for a given crawler to a specified file path in that website.
### Opening the file ### Opening the file
@@ -92,7 +92,7 @@ When opening the source, we also find the following comment:
To solve this challenge, I came up with the following script: To solve this challenge, I came up with the following script:
{{< code language="js" title="solve.js" >}} {{< collapsible-block badge="js" title="solve.js" >}}
```js ```js
function controlCar(scanArray) { function controlCar(scanArray) {
@@ -151,7 +151,7 @@ function controlCar(scanArray) {
} }
``` ```
{{< /code >}} {{< /collapsible-block >}}
It starts off by initializing some global variables if the game is running for the first time (or after a restart). After which, it check if there are still moves in the queue. If so, it grabs the last item out of the queue and returns it. It starts off by initializing some global variables if the game is running for the first time (or after a restart). After which, it check if there are still moves in the queue. If so, it grabs the last item out of the queue and returns it.
@@ -43,7 +43,7 @@ You’re taking a stroll in the lab, when Dr. Klostermann is calling your name:
[attachment.zip](/files/writeups/google-ctf/2021/beginners-quest/4/attachment.zip) [attachment.zip](/files/writeups/google-ctf/2021/beginners-quest/4/attachment.zip)
{{< code language="c" title="chal.c" isCollapsed="true" >}} {{< collapsible-block badge="c" title="chal.c" isCollapsed="true" class="tight" >}}
```c ```c
#include <stdbool.h> #include <stdbool.h>
@@ -208,7 +208,7 @@ int main(void)
} }
``` ```
{{< /code >}} {{< /collapsible-block >}}
## Recon ## Recon
@@ -308,7 +308,7 @@ for set_mask, clr_mask in zip(set_masks, clr_masks):
print(flag.strip()) print(flag.strip())
``` ```
{{< code language="py" title="Full code" isCollapsed="true" >}} {{< collapsible-block badge="py" title="Full code" isCollapsed="true" >}}
```py ```py
set_mask_str = "gpio_set_mask" set_mask_str = "gpio_set_mask"
@@ -343,7 +343,7 @@ for set_mask, clr_mask in zip(set_masks, clr_masks):
print(flag.strip()) print(flag.strip())
``` ```
{{< /code >}} {{< /collapsible-block >}}
## Solution ## Solution
@@ -50,7 +50,7 @@ As you and Gökhan are leaving the crates to enter a car, you spot the tough guy
[attachment.zip](/files/writeups/google-ctf/2021/beginners-quest/5/attachment.zip) [attachment.zip](/files/writeups/google-ctf/2021/beginners-quest/5/attachment.zip)
{{< code language="py" title="RoboCaller1337.py" isCollapsed="true" >}} {{< collapsible-block badge="py" title="RoboCaller1337.py" isCollapsed="true" class="tight" >}}
```py ```py
import random import random
@@ -103,9 +103,9 @@ if __name__ == "__main__":
main() main()
``` ```
{{< /code >}} {{< /collapsible-block >}}
{{< code language="txt" title="robo_numbers_list.txt" isCollapsed="true" >}} {{< collapsible-block badge="txt" title="robo_numbers_list.txt" isCollapsed="true" class="tight" >}}
```txt ```txt
263-170-6234 263-170-6234
@@ -734,7 +734,7 @@ if __name__ == "__main__":
446-996-9104 446-996-9104
``` ```
{{< /code >}} {{< /collapsible-block >}}
## Recon ## Recon
@@ -793,7 +793,7 @@ for a,b in zip(key, secret):
print(flag) print(flag)
``` ```
{{< code language="py" title="Full code" isCollapsed="true" >}} {{< collapsible-block badge="py" title="Full code" isCollapsed="true" >}}
```py ```py
from mt19937predictor import MT19937Predictor from mt19937predictor import MT19937Predictor
@@ -816,7 +816,7 @@ for a,b in zip(key, secret):
print(flag) print(flag)
``` ```
{{< /code >}} {{< /collapsible-block >}}
## Solution ## Solution

Some files were not shown because too many files have changed in this diff Show More