[saarCTF 23] Pasteable Writeup

Challenge Description The challenge was a web application that allowed users to create and share password-protected notes. The application is written in PHP and uses a MySQL database to store the notes. When creating a note, the user must enter a title, some content, and a password that is used to encrypt the note. The note is then stored in the database and the user is given a link to share the note with others....

November 20, 2023 · Matteo Golinelli & Michele Grisafi

[SrdnlenCTF 23] Koenigsberg Writeup

As the name of the challenge suggests, we are dealing with graphs (https://en.wikipedia.org/wiki/Seven_Bridges_of_K%C3%B6nigsberg). There will probably be a graph implemented in some way inside the binary, and the goal will probably be to traverse each and every node only once. Reverse-engineering The challenge comes in the form of a x86_64 ELF binary, with symbols. The main function is pretty simple: undefined8 main(void) { int iVar1; size_t sVar2; long in_FS_OFFSET; char input [104]; long local_10; local_10 = *(long *)(in_FS_OFFSET + 0x28); setbuf(stdout,NULL); setbuf(stdin,NULL); puts("Send me the damn flag....

October 30, 2023 · Carlo Ramponi

[SrdnlenCTF 23] Pugwar Writeup

Challenge description What do you call a cold pug? A pugsicle! Website: http://pugwar.challs.srdnlen.it Author: @Octaviusss This time we don’t have source code. The X-Powered-By header returned by the server is equal to Express so most likely we are attacking a Node.js application. The application offers the following functionality: Registration/Login Creating a pug with a name, ability and secret associated with your user (/choose-fighters) Edit the ability of a pug that you created (/fighter-customization) In the Hall Of Fame page we see a pug called Mario with its ability....

October 30, 2023 · Ivan Valentini & Alessandro Mizzaro