Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google CTF 2019

capturetheflag.withgoogle.com

Post reply on HN
Print view View original

121–130 of 140 posts

Re: Google CTF 2019

#121

Post by MajorSauce »

ehsankia wrote: post #110
dexhunter wrote: post #103

stuck on https://govagriculture.web.ctfcompetition.com/ this task, any help?

Same here. Unless there's some steganography, I'm really all out of ideas. I see see the content of folders (/static/, /static/images/, etc), but that doesn't help. I can't get anything out of /admin and the content of /post don't appear anywhere for any sort of XSS attack.

I completed the challenge. You don't need to see the result of the entry to deduct if XSS is possible.

If the server is parsing your input, maybe you can find a way for the server to leak more than it wants.

If you want more information, or simply the answer, PM me.

Re: Google CTF 2019

#122

Post by karlding »

ehsankia wrote: post #110
dexhunter wrote: post #103

stuck on https://govagriculture.web.ctfcompetition.com/ this task, any help?

Same here. Unless there's some steganography, I'm really all out of ideas. I see see the content of folders (/static/, /static/images/, etc), but that doesn't help. I can't get anything out of /admin and the content of /post don't appear anywhere for any sort of XSS attack.

There isn't any steganography (at least for the flag that I found). They have a bot that actually "reads" your post, which you can verify for yourself. This is alluded to in the message that you get when submitting a post:

> Your post was submitted for review. Administator will take a look shortly.

Re: Google CTF 2019

#123

Post by ehsankia »

karlding wrote: post #122
ehsankia wrote: post #110

Earlier quoted context omitted.

Same here. Unless there's some steganography, I'm really all out of ideas. I see see the content of folders (/static/, /static/images/, etc), but that doesn't help. I can't get anything out of /admin and the content of /post don't appear anywhere for any sort of XSS attack.

There isn't any steganography (at least for the flag that I found). They have a bot that actually "reads" your post, which you can verify for yourself. This is alluded to in the message that you get when submitting a post: > Your post was submitted for review. Administator will take a look shortly.

> which you can verify for yourself

How can you verify? That's what I was stuck, it's hard to test things if you're not getting any sort of feedback. That message seemed pretty constant.

EDIT: I see, managed to verify it by putting an image on my own webserver and seeing the log hit. I got a rough idea now, thanks!

EDIT2: Got it :)

Re: Google CTF 2019

#124

Post by clashmeifyoucan »

chris92de wrote: post #100
tito3 wrote: post #59

Earlier quoted context omitted.

Stuck on this one, can see readme.flag but not sure how to proceed

i ended up using fold. theres also has to be a way to read the ORME.flag by modifying the file permissions but i haven't figured that one out yet.

I bypassed the shell by executing the binary straight from the loader so I was able to do a chmod +r and cat to get it.

Re: Google CTF 2019

#125

Post by random123456789 »

koyote wrote: post #82
dysoco wrote: post #70

Earlier quoted context omitted.

I'm on that as well, for me it seems it just decodes some Unicode characters and does arithmetic to print the message, I don't know why it's taking so long or how can I speed it up.

It's calculating prime numbers which is why it's slow. Now if only I was to work out which prime numbers it wants... :)

Hints: Prime numbers, Palindromes, XOR and offset for later :)

Re: Google CTF 2019

#126

Post by tntn »

ehsankia wrote: post #109
danvittegleo wrote: post #107

Earlier quoted context omitted.

Running it with pypy sped it up quite a bit and got it far enough to figure out the remaining portion of the URL.

Haha, I was gonna try exactly that, but I got too lazy trying to install pypy3 on my shitty centos box. My other option was to translate it into real assembly, but that also seemed like more work that I wanted to put into it.

> My other option was to translate it into real assembly

I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.

Re: Google CTF 2019

#127

Post by archgoon »

tntn wrote: post #126
ehsankia wrote: post #109

Earlier quoted context omitted.

Haha, I was gonna try exactly that, but I got too lazy trying to install pypy3 on my shitty centos box. My other option was to translate it into real assembly, but that also seemed like more work that I wanted to put into it.

> My other option was to translate it into real assembly I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.

How did you implement the JUMP_TOP instruction? You need to jump to the x86_64 instructions that correspond to the given emoji index; did you implement a jump table?

Re: Google CTF 2019

#128

Post by tbarbour »

aereal wrote: post #111
koyote wrote: post #82

Earlier quoted context omitted.

It's calculating prime numbers which is why it's slow. Now if only I was to work out which prime numbers it wants... :)

have you guys figured it out? I got stuck here too.

https://github.com/InverseIntegral/ctf_writeups/tree/master/... - great write up of the solution here

Re: Google CTF 2019

#129

Post by behindsight »

paulddraper wrote: post #20
behindsight wrote: post #18

Earlier quoted context omitted.

Most likely for any contracts accepted to be legally binding.

Google Code Jam has no such restriction.

Google Code Jam has restrictions:

16 years or older to participate; 18 years or older to attend the onsite final round.

> If your age is not at least the Minimum Age [18+], you are only eligible to win a t-shirt.

https://codingcompetitions.withgoogle.com/codejam/rulesandte...

Re: Google CTF 2019

#130

Post by m4cie »

MajorSauce wrote: post #121
ehsankia wrote: post #110

Earlier quoted context omitted.

Same here. Unless there's some steganography, I'm really all out of ideas. I see see the content of folders (/static/, /static/images/, etc), but that doesn't help. I can't get anything out of /admin and the content of /post don't appear anywhere for any sort of XSS attack.

I completed the challenge. You don't need to see the result of the entry to deduct if XSS is possible. If the server is parsing your input, maybe you can find a way for the server to leak more than it wants. If you want more information, or simply the answer, PM me.

Hi, could you provide some more information regarding how one can force the server to leak more information than it should? I have been stuck with this exercise for quite some time and am honestly out of ideas.
Post reply on HN