SSRF

I was a guest challenge writer for perfect blue’s CTF held mid February. We play-tested each others chals :P MAKIMA Challenge Description Makima simps check in here I’m actually a Power stan. I just needed an excuse for people to look at my Makima drawing. TL;DR Hide php in image, making a PHP/image polyglot X-Accel-Header redirection through CDN to reach internal .php files and access /uploads/your_img.png/lol.php to execute PHP The important parts The default.conf, which is the config used for the nginx proxy server, has an RCE vulnerability: ...

MapleCTF 2022 ran this year to great success, which is fantastic given the tight timeframe we were operating on shortly after coming back from DEFCON 30. We held a beginner-friendly, UBC-local version back in January, so our endgame for this version was to make more creative and harder challenges that people hopefully enjoyed. I wrote 3 web challenges for this CTF: honksay, Viene Library and Art Gallery, the latter 2 I will detail here. I hope you enjoyed them if you played! ...

A writeup for the first web problem, “Harmony Chat”, in DragonCTF 2020. A very fun and interesting challenge! TL;DR Application is vulnerable to RCE via insecure deserialization on the /csp-report endpoint Use FTP active mode to SSRF a post request to /csp-report that would open a reverse shell on the application’s HTTP server Cat flag for profit Let’s Begin! The Harmony Chat is a Discord-esque chat app where you can /register an account and create channels. Once registered, you’re given your UID, which you use to /login or to invite other users into a channel you create. ...

This was a CTF I unfortunately didn’t have the time for, as I was busy doing finals in April :(. My team let me know about this cool and unique problem, and I’m glad they did! ...