PicoCTF2018 – Web – Artisinal Handcrafted HTTP 3
Objective:
We found a hidden flag server hiding behind a proxy, but the
proxy has some... _interesting_ ideas of what qualifies someone to make HTTP
requests. Looks like you'll have to do
this one by hand. Try connecting via nc
2018shell.picoctf.com 18685, and use the proxy to send HTTP requests to
`flag.local`. We've also recovered a
username and a password for you to use on the login page:
`realbusinessuser`/`potoooooooo`.
Hint:
(1)
_Be the browser._ When you navigate to a page, how does your
browser send HTTP requests? How does
this change when you submit a form?
Solution:
This is
my first-time sending HTTP GET and POST manually, so I leaned pretty heavily on
online resources
@pico-2018-shell:~$
nc 2018shell.picoctf.com 18685
Real
Business Corp., Internal Proxy
Version
2.0.7
To
proceed, please solve the following captcha:
_____
__
/ __ \
/ | ______
`' / /'
__ __ `| | |______|
/ / \
\/ / | | ______
./
/___ > <
_| |_ |______|
\_____/
/_/\_\ \___/
> 2
Validation
succeeded. Commence HTTP.
GET /
HOST:
flag.local
HTTP/1.1
200 OK
x-powered-by:
Express
content-type:
text/html; charset=utf-8
content-length:
321
etag:
W/"141-LuTf9ny9p1l454tuA3Un+gDFLWo"
date: Thu,
26 Sep 2019 18:24:23 GMT
connection:
close
<html>
<head>
<link
rel="stylesheet" type="text/css" href="main.css"
/>
</head>
<body>
<header>
<h1>Real
Business Internal Flag Server</h1>
<a
href="/login">Login</a>
</header>
<main>
<p>You
need to log in before you can see today's flag.</p>
</main>
</body>
</html>
Okay
from here we see there is a login page in the HTML /login let’s get /login and
see what is shows
@pico-2018-shell:~$
nc 2018shell.picoctf.com 18685
Real
Business Corp., Internal Proxy
Version
2.0.7
To
proceed, please solve the following captcha:
_____ ___
| ___| /
| ______
|___
\ __
__ / /| | |______|
\ \ \ \/ / / /_| | ______
/\__/
/ >
< \___ | |______|
\____/ /_/\_\
|_/
> 20
Validation
succeeded. Commence HTTP.
GET /Login
HTTP/1.1
host:
flag.local
HTTP/1.1
200 OK
x-powered-by:
Express
content-type:
text/html; charset=utf-8
content-length:
498
etag:
W/"1f2-UE5AGAqbLVQn1qrfKFRIqanxl9I"
date: Thu,
26 Sep 2019 18:24:49 GMT
connection:
close
<html>
<head>
<link
rel="stylesheet" type="text/css" href="main.css"
/>
</head>
<body>
<header>
<h1>Real
Business Internal Flag Server</h1>
<a
href="/login">Login</a>
</header>
<main>
<h2>Log
In</h2>
<form
method="POST" action="login">
<input
type="text" name="user" placeholder="Username"
/>
<input
type="password" name="pass"
placeholder="Password" />
<input
type="submit" />
</form>
</main>
</body>
</html>
It
needs a username password luckily they gave this to us, let do a POST with and
give the user/pass to the login page
@pico-2018-shell:~$
nc 2018shell.picoctf.com 18685
Real
Business Corp., Internal Proxy
Version
2.0.7
To
proceed, please solve the following captcha:
_____ ____
|____
| / ___| ______
/ /
______ / /___ |______|
\ \ |______| | ___ \ ______
.___/
/ | \_/ | |______|
\____/ \_____/
> -3
Validation
succeeded. Commence HTTP.
POST
/login HTTP/1.0
Host:
flag.local
Content-Type:
application/x-www-form-urlencoded
Content-Length:
38
user=realbusinessuser&pass=potoooooooo
HTTP/1.1
302 Found
x-powered-by:
Express
set-cookie:
real_business_token=PHNjcmlwdD5hbGVydCgid2F0Iik8L3NjcmlwdD4%3D; Path=/
location:
/
vary:
Accept
content-type:
text/plain; charset=utf-8
content-length:
23
date: Thu,
26 Sep 2019 18:34:34 GMT
connection:
close
OK so
we get a cookie back from the login let’s pass the cookie to the login page and
see what happens
@pico-2018-shell:~$
nc 2018shell.picoctf.com 18685
Real
Business Corp., Internal Proxy
Version
2.0.7
To
proceed, please solve the following captcha:
______ _____
|___ /
|____ | ______
/ /
______ / / |______|
/ /
|______| \ \ ______
./ / .___/ / |______|
\_/ \____/
> 4
Validation
succeeded. Commence HTTP.
GET /
host:
flag.local
cookie:
real_business_token=PHNjcmlwdD5hbGVydCgid2F0Iik8L3NjcmlwdD4%3D
HTTP/1.1
200 OK
x-powered-by:
Express
content-type:
text/html; charset=utf-8
content-length:
438
etag:
W/"1b6-bgxSS92CBVm1uJx+NK7DdppIBp8"
date: Thu,
26 Sep 2019 18:40:06 GMT
connection:
close
<html>
<head>
<link
rel="stylesheet" type="text/css" href="main.css"
/>
</head>
<body>
<header>
<h1>Real
Business Internal Flag Server</h1>
<div
class="user">Real Business Employee</div>
<a
href="/logout">Logout</a>
</header>
<main>
<p>Hello
<b>Real Business Employee</b>!
Today's flag is:
<code>picoCTF{0nLY_Us3_n0N_GmO_xF3r_pR0tOcol5_5f5f}</code>.</p>
</main>
</body>
</html>
Now we got
the flag picoCTF{0nLY_Us3_n0N_GmO_xF3r_pR0tOcol5_5f5f}
Comments
Post a Comment