“Iโm not a hacker. Iโm just someone who wants to make the world a little better. But the world isnโt going to change itself.” Submit your answer in the following format: ACECTF{3x4mpl3_fl4g} The flag content should be in lowercase letters only. http://34.131.133.224:9998/
๐ฏ Challenge Files & Infrastructure
Provided Files
1
Files:None
๐ Initial Analysis
First Steps
Initially, the website appears as follows:
Site Presentation
Since I didn’t find anything by inspecting the page source, I decided to check the robots.txt:
Robots
Finding some routes. Instead of inspecting them one by one, I wrote a for loop in bash that uses curl:
By doing this, I extracted the text from each page. I noticed that some pages had strange text, like /buried and /secret_path, and I thought that buried might contain a part of the flag in decimal to be converted into ascii (since there are no hex characters), and secret_path seems pretty obvious that it might be in morse code. Let’s move on to the exploitation phase.
๐ฏ Solution Path
Exploitation Steps
Initial setup
The first thing I do is verify that /buried contains the first part of the flag converted to decimal. I do this with CyberChef by applying the From Decimal filter.
First Part
As we can see, the decoded text is indeed the first part of the flag. Let’s move on to the next phase.
For the last part of the flag, the final curl request tells us, “Sometimes the answers are hidden in plain sight. Or, in this case, styled just right. ๐๏ธ๐”. Since “styled” is mentioned, I figured it might be in the css. Indeed, by inspecting the source of /, I found the CSS file http://34.131.133.224:9998/static/css/style.css, and inside it, I found #flag.
CSS
As we can see, it specifies (content: “bC5 !2CE @7 E96 u=28 :D i f9b0db4CbEd0cCb03FC`b5N”;), which looks quite strange. I then used (https://www.dcode.fr/cipher-identifier) to identify the cipher used.
Cipher Identifier
It turns out to be a ROT47, so I used CyberChef again with the ROT47 filter to decode it.
Third Part
Putting together the three parts, I obtained: ACECTF{1nf1l7r471ng_7h3_5y573m_15_345y_wh3n_y0u_kn0w_wh3R3_7h3_53cr3t5_4r3_bur13d}. However, there’s still one last step, which is to make it lowercase as mentioned in the challenge description. So, I used Python to do that.
The automatic exploit takes the decimal text and converts it to ASCII, the Morse code and translates it to text, then takes the last part of the flag in ROT47, applies the decode, and finally forms the complete flag.
