> For the complete documentation index, see [llms.txt](https://sibivasan.gitbook.io/sibivasan/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sibivasan.gitbook.io/sibivasan/writeups/ctf-writeups/nitectf-2024.md).

# NiteCTF 2024

## 1, Cybernotes:

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FPrdeTZYyCIqoSN4RLIXk%2Fimage.png?alt=media&amp;token=8579f091-28c5-4eee-b4e4-4e2d0da6c657" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FKnIIcfVPzUtKy6tsvpI2%2Fimage.png?alt=media&amp;token=bcd76450-f8c6-49a0-a619-72367bc2e304" alt=""><figcaption></figcaption></figure>

1\. On the network tab, the request made for bg.jpg

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2F784TrTqZa2u2yOaY3TVn%2Fimage.png?alt=media&amp;token=85d1f9db-db40-4409-a416-cfdbb1766ab3" alt=""><figcaption></figcaption></figure>

2\. We got the logs in the `/uploads/.`

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FPUye4j3ME3zPPDj6D4Ei%2Fimage.png?alt=media&amp;token=7a811816-102d-446f-856e-4c8bfdbbd316" alt=""><figcaption></figcaption></figure>

3\. Got the `username` in the logs.

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2F9jOgvcEWdnnzWJ1PG1zK%2Fimage.png?alt=media&amp;token=3d20ff3f-9e42-4df4-b31d-87370ce69682" alt=""><figcaption></figcaption></figure>

4\. Got the `Passwords`in the logs.

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FKbZMe0uPOEXrgicPzCTb%2Fimage.png?alt=media&amp;token=bcc009cd-68cc-4d5b-afb2-9035c6a3702d" alt=""><figcaption></figcaption></figure>

5\. Got the `DockerFile` the file has ⁣`JWT_SECRET_KEY & FDRP_JWT_SECRET_KEY.`

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FsQbkgfj9qoB5xMYMWxBy%2Fimage.png?alt=media&amp;token=fb97afdb-2747-4ec9-9c77-1facc73a8d05" alt=""><figcaption></figcaption></figure>

6\. Using the username and password, we have login into the application.

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FN4yZsTmo4s1EVu9RwhPN%2Fimage.png?alt=media&amp;token=3d0bff6d-bdae-4265-a110-27391d297b61" alt=""><figcaption></figcaption></figure>

7\. Getting the notes in this endpoint.

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2F1cLXsd4uo1YrB0qsHFxp%2Fimage.png?alt=media&amp;token=5ac96bb6-7f23-482a-8032-09dd70acfb2b" alt=""><figcaption></figcaption></figure>

8\. Decode and change the secret with JWT\_SECRET\_FILE. we got from DockerFile. `JWT_SECRET_FILE=H6jga21h1.`

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FAusRU9Bjay2fYQPQT4FG%2Fimage.png?alt=media&amp;token=40b832f5-164d-424a-861f-9198327cdf2f" alt=""><figcaption></figcaption></figure>

9: Got the flag.

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FmeTqUyK8hgRMIfdOz9HV%2Fimage.png?alt=media&amp;token=e59978f3-0f6a-4734-b45a-62afb00e0ad8" alt=""><figcaption></figcaption></figure>

## 2, Charlie Hunt 1:

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2F0CSC627x7ZR9ew2wdxDz%2Fimage.png?alt=media&amp;token=5e875119-323d-4612-86be-c8eab18b58b7" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FN68FCR6PEv7NKia1SL2Z%2Fimage.png?alt=media&amp;token=90a89f83-dddf-4d94-8be7-db3d1f62f3d2" alt=""><figcaption></figcaption></figure>

1\. While submitting the review.

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2F2s8eGCVFfu6CWon2khLz%2Fimage.png?alt=media&amp;token=40d61e3d-e885-4cd0-a029-9e15f3e8c654" alt=""><figcaption></figcaption></figure>

2\. Changing the Api version v2 to v1 and the non-numeric value to the stars it will throw the error.

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FzkCKQnO98H7pAomnpnI5%2Fimage.png?alt=media&amp;token=466c7342-8edd-4d95-8726-8e9272d9cca1" alt=""><figcaption></figcaption></figure>

3. &#x20;`__v: is unknown,` So we add \_\_v as a key and provide the input.

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2FyYSqdkaCYflx7HYsy4R9%2Fimage.png?alt=media&amp;token=fdc55891-1ee4-46d8-8aca-dc61e2aeb49b" alt=""><figcaption></figcaption></figure>

4. The application renders the input "`__v":"{{7*7}}"` to `__v:49`, starting to craft the SSTI payload.

<figure><img src="https://1152868336-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCgUNmwmwzhhEXlNJ5H3g%2Fuploads%2Fn4SCck4osOSgnEAd9M9m%2Fimage.png?alt=media&amp;token=258bcd39-11ce-439b-b826-fe72d90191af" alt=""><figcaption></figcaption></figure>

**`Payload: {`**`{url_for['__`**`gl'+'obals__`**`']['__`**`buil'+'tins__`**`']['op'+'en'](app\\x2epy)['re'+'ad']()}}.`

`Flag: nite{3rror5_can_b3_u53ful_s0m3t1m35}`