{"id":389,"date":"2015-07-31T00:42:46","date_gmt":"2015-07-30T22:42:46","guid":{"rendered":"https:\/\/0x90r00t.com\/?p=389"},"modified":"2015-08-29T13:43:39","modified_gmt":"2015-08-29T11:43:39","slug":"cybercamp-2015-web-4-write-up-fr","status":"publish","type":"post","link":"https:\/\/0x90r00t.com\/fr\/2015\/07\/31\/cybercamp-2015-web-4-write-up-fr\/","title":{"rendered":"[Cybercamp 2015] [Web 4] Write Up"},"content":{"rendered":"<h2>Description<\/h2>\n<blockquote><p>On se retrouve devant une page web affichant une image comme quoi le hotlinking est interdit ou que l&rsquo;image demand\u00e9e n&rsquo;existe pas.<\/p><\/blockquote>\n<p><a href=\"https:\/\/0x90r00t.com\/wp-content\/uploads\/2015\/07\/image.php_.png\"><img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-390 aligncenter\" src=\"https:\/\/0x90r00t.com\/wp-content\/uploads\/2015\/07\/image.php_.png\" alt=\"image.php\" width=\"200\" height=\"200\" srcset=\"https:\/\/0x90r00t.com\/wp-content\/uploads\/2015\/07\/image.php_.png 200w, https:\/\/0x90r00t.com\/wp-content\/uploads\/2015\/07\/image.php_-150x150.png 150w\" sizes=\"auto, (max-width: 200px) 100vw, 200px\" \/><\/a><!--more--><\/p>\n<h2>Resolution<\/h2>\n<p>En observant les headers http lors du chargement de l&rsquo;image, on se rend compte qu&rsquo;il y en a un inhabituel, &lsquo;<strong>Debug: &#8211;<\/strong>&lsquo;.<br \/>\nEn t\u00e2tonnant on s&rsquo;est rendu compte qu&rsquo;il contenait &lsquo;<strong>&#8211;<\/strong>&lt;header http referer&gt;&rsquo; , mais pourquoi ce tiret au d\u00e9part ?<br \/>\nDans la logique, on met comme referer http:\/\/challenge.cybercamp.es:8084\/gallery\/, car \u00e7a semble \u00eatre l&rsquo;url de base de la galerie vu que quand on tente d&rsquo;acc\u00e9der \u00e0 cette url, on obtient un message \u00ab\u00a0gallery not available\u00a0\u00bb.<br \/>\nEvidemment, \u00e7a aurait \u00e9t\u00e9 trop simple, mettre ce referer ne permet pas d&rsquo;obtenir le flag.<br \/>\nApr\u00e8s avoir essay\u00e9 la quasi-totalit\u00e9 des headers existants, une petite id\u00e9e nous est venue : et si finalement il fallait passer quelque chose dans l&rsquo;url ?<br \/>\nL&rsquo;url de base est &lsquo;gallery\/image.php?<strong>image<\/strong>=8123914&prime;, pourtant 8123914 ne ressemble pas \u00e0 un nom d&rsquo;image, l&rsquo;argument ne serait-il finalement pas un id ?<\/p>\n<p>Charger l&rsquo;url gallery\/image.php?<strong>id<\/strong>=8123914 avec, comme referer, http:\/\/challenge.cybercamp.es:8084\/gallery\/ nous a fait obtenir le flag.<\/p>\n<p><a href=\"https:\/\/0x90r00t.com\/wp-content\/uploads\/2015\/07\/Capture-10.png\"><img loading=\"lazy\" decoding=\"async\" class=\" size-full wp-image-391 aligncenter\" src=\"https:\/\/0x90r00t.com\/wp-content\/uploads\/2015\/07\/Capture-10.png\" alt=\"flag\" width=\"197\" height=\"196\" srcset=\"https:\/\/0x90r00t.com\/wp-content\/uploads\/2015\/07\/Capture-10.png 197w, https:\/\/0x90r00t.com\/wp-content\/uploads\/2015\/07\/Capture-10-150x150.png 150w\" sizes=\"auto, (max-width: 197px) 100vw, 197px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Description On se retrouve devant une page web affichant une image comme quoi le hotlinking est interdit ou que l&rsquo;image demand\u00e9e n&rsquo;existe pas.<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,35,36],"tags":[],"class_list":["post-389","post","type-post","status-publish","format-standard","hentry","category-2015-fr","category-ctf-fr","category-cybercamp-fr"],"_links":{"self":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/389","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/comments?post=389"}],"version-history":[{"count":9,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/389\/revisions"}],"predecessor-version":[{"id":712,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/posts\/389\/revisions\/712"}],"wp:attachment":[{"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/media?parent=389"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/categories?post=389"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/0x90r00t.com\/fr\/wp-json\/wp\/v2\/tags?post=389"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}