3.2 KiB
+++ author = "Maik de Kruif" title = "Challenge 8 - AdventOfCTF" date = 2020-12-08T09:34:24+01:00 description = "A writeup for challenge 8 of AdventOfCTF." cover = "img/adventofctf/da781419d6bf02d0a580e48414b9cbde.png" tags = [ "AdventOfCTF", "challenge", "ctf", "hacking", "writeup", "web", ] categories = [ "ctf", "writeups", "hacking", ] +++
- Points: 800
Description
If only you could figure out where to go.
Visit https://08.adventofctf.com to start the challenge.
Finding the vulnerability
When opening the website we're greeted with the following message:
Did you know that the fastest robot can solve a rubiks cube in 0.887 seconds?
This is talking about robots, which my be a hint to look at the robots.txt.
What is a robots.txt file?
A robots.txt file lives at the root of a website. So, for the site www.example.com, a robots.txt file would live at www.example.com/robots.txt. robots.txt is a plain text file that follows the Robots Exclusion Standard. A robots.txt file consists of one or more rules. Each rule blocks (or allows) access for a given crawler to a specified file path in that website.
Opening the file
The file shows the following:
# robots.txt generated by *************.com
User-agent: *
Disallow: /
Disallow: /cgi-bin/
Disallow: /encryption/is/a/right
Disallow: /fnagn/unf/znal/cynprf/gb/tb
This probably means there is some sensitive information on one of the Disallow locations. Let's look at them one by one.
/cgi-bin/
When opening /cgi-bin/, we get a 404 error. So let's skip this one for now.
/encryption/is/a/right
Upon opening /encryption/is/a/right, we get some encoded string back. It looks like base64 so let's try to decode it using base64 -d in the terminal:
echo "RW5jb2RpbmcgYW5kIGVuY3J5cHRpb24gYXJlIDIgZGlmZmVyZW50IHRoaW5ncy4=" | base64 -d
> Encoding and encryption are 2 different things.
This doesn't mean a lot so let's have a look at the next one.
/fnagn/unf/znal/cynprf/gb/tb
After opening /fnagn/unf/znal/cynprf/gb/tb, we're greeted with the following text:
"Oh, the places you'll go", my favorite poem... but this is the wrong place. Maybe you read that wrong?
Hmm, it says "Maybe you read that wrong?". The URL also looks kinda weird. It might be rot13 encoded. So let's try to decode it using rot13:
echo "/fnagn/unf/znal/cynprf/gb/tb" | rot13
> /santa/has/many/places/to/go
Note: rot13 is not a program on linux, I just programmed it as an alias for tr 'A-Za-z' 'N-ZA-Mn-za-m'
We got new url (I hope 😀). Let's try to access it. We got the flag! It is NOVI{you_have_br@1ns_in_your_head}.
This flag can then be submitted for the challenge.