# CyberTeam India Internship CTF

#### Web and Forensics

This is my first write-up and third CTF ever

This CTF was a bit weird (no crypto , 50% forensics, WTF!) also the challenges were short but some of them needed out of the box thinking (at least for me).

### FILE FOUND — 50

This challenge is actually the easiest one I have encountered (maybe for forensics only)

We have file that looks like a java compiled class, I will check it anyway with command ***file .***

So, now the basic approach will be reading its content to get some hints or flag maybe. You can do this by using either ***cat*** or ***strings,*** I have used strings which give us the following result.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633766688/09d0b83c-5b52-43f7-b9dd-f554e62aeb83.png)

This is encrypted using caesar cipher.

***FLAG{FORENSICS\_101}***

### Help Ann — 100

By using the command ***file***, I get to know that this is a png file, but I am unable to open it.

So, I opened the file using ***hexeditor*** to check the header

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633768646/a99dff78-8938-42b3-9aa7-381b6c59a798.png)

It looks like header is broken/corrupted so I replaced it with the png header

or magic number i.e, ***89 50 4e 47 0d 0a 1a 0a***

Now, we got an image that is a QR code. So I scanned it on [this website](http://webqr.com) and I got the flag.

**Flag{Aw3s0m3-Y0u-G0t-th1s}**

### Just Smile — 100

We have an image, so I looked at its content by using ***strings***

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633770722/66e3af81-4755-4daa-94dc-3288749d9da7.png)

It looks like this file contain extra chunk of data after the png ends (IEND)

So, we will try to extract it using ***binwalk***

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633773004/c368cce5-1cab-4e9c-be8b-4aae8e4559f0.png)

binwalk — d=’.\*” smile.png -e

This gives us an ELF file. I tried to execute it using ***gdb*** but it ask for a password.

By reading the content of the file I got a string ***This\_Is\_Not\_the\_Flag\_but\_Useful*** and yes this is the password.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633774629/5ec3be74-ccca-4a95-a549-56bdc9b2f015.png)

***FLAG{APPENEDING\_FILES\_REALLY!!}***

### ***Light — 50***

Again we got an image, so as usual I tried reading its content and got something in the end

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633776722/1992177d-20cb-44c9-8927-00a763e76951.png)

This is in binary so I hopped [here](http://codebeautify.org/binary-to-text) and quickly got the flag. This was easy, right?

***Flag{So-L!gHt}***

### Wanna some Biscuits — 50

The challenge name clearly suggests for Cookie, so I intercepted the request and sent it to repeater

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633778813/3fe63066-360d-4981-9678-d2c3d04c6295.png)

This looks like it is encoded in base 64, so I decoded and got this

***O:4:”User”:2:{s:8:”userName”;s:9:”anonymous”;s:7:”isAdmin”;b:0;}***

This looks like unserialized data of php. After changing it for admin and changing ***isAdmin*** value to ***1\. \[*** Also ***s:9*** represents the character length of ***anonymous \]*** Resultant will look like

***O:4:”User”:2:{s:8:”userName”;s:5:”admin”;s:7:”isAdmin”;b:1;}***

I encoded this in base64 and replaced the original cookie and got this response:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633780218/be6a7bc6-fdbc-49a3-ac5a-9eb5b2bf59f4.png)

***FLAG{REALLY!!\_IN\_COOKIES}***

### request Gate — 50

Again from challenge name this looks like it is about HTTP requests

So I intercepted the request, forwarded it and got this response

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633781514/ccd1dd58-5bc4-4875-bfcc-f26f69763de9.png)

As obvious I changed the method to PUT but it still throws Error 405 with message ***Not Allowed.*** After unsuccessful multiple attempts I thought of accessing the php page that can handle the PUT request in the same directory. So I made a PUT request to [http://35.197.254.240/request-gate/index.php](http://35.197.254.240/request-gate/index.php) and Voila!

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633783474/c66e9450-6078-429f-84e6-f05a71665d08.png)

***M3th0ds!sN0t0nlyG3T0rP0ST***

***Curl*** can be the easy way to this

***curl -X PUT ‘***[***http://35.197.254.240/request-gate/index.php'***](http://35.197.254.240/request-gate/index.php%27)

### Yellow Duck — 100

In this challenge we have URL that contains the .png file but cannot see it online or download so I used ***Curl,*** you can also use ***wget***

This file looks like it is base64 encoded

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633785048/74f0a5d4-8c27-4de2-9afe-7a875628fa2b.png)

By resemblance of ‘+’ and ‘/’ between strings and default extension, I thought this might be an image encoded in base64, so i decoded this from [here](http://freeonlinetools24.com/base64-image) and got a file

Its content doesn’t make any sense to me. So I decided to check hex values of its header

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633787023/db792b1e-93fb-44bf-99d3-48ba8c6c2987.png)

Notice the header, it is similar to the png header so I thought this might be encrypted. I read few write-ups and came to know that it is XORED.

I used ***xortool*** to decrypt it , here most frequent character is \\00x

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1748633797078/597e59f6-c5bb-43c9-9586-108f144ac423.png)

If you dont know the possible char you can use ***xortool -b output-onlinepngtools.png*** . It’ll test for all cases, and u need to check for flag for each output.

***flag{Y0u\_CatchIt\_0100110120100}***

Thank You

Suggestions are welcomed.

For more web based write-ups you can see [this](https://medium.com/@Mr_R0w07/glug-ctf-web-writeup-490c8448d484).