Sourcetoad CTF 2021

Produced by @iBotPeaches (Connor Tumbleson), for a Q4 2021 Engineer challenge.

• Originally hosted on CTFd.io with a combination of some t3.nano instance on AWS
• Most puzzles were simple index.html files leading to assets/images/files.
• Complex puzzles leveraged the services feature of CTFd to deploy a docker image.
• Completed on December 3, 2021 at Sourcetoad with all Engineers.

---

• web/challenges - each folder represents a challenge.
• web/common - Styles used by all challenges.
• setup - any non-public setup (mysql, etc) needed for a challenge.
• notes - any notes/partial solves for the challenge to help for the solution.
• solutions - written guides for all puzzles (to help teach afterwards).
• ctf - The challenge.yml specification built files for CTFd.

Intro

• This repo exists to make building the CTF easier. It has no real automation to spin up.
• The real setup for this for our CTF required a few AWS servers and a mix of Apache/Nginx.
• CTFd was used for this original event.
• It may be open sourced afterwards, because all of these puzzles might be helpful to others to train/learn
  • They were all made from hints of others or just simply made up

---

Flags

See FLAGS.md, but I encourage first reading the solutions directory for explanations.

---

Points

• Easy - 100
• Normal - 150
• Medium - 250
• Medium Hard - 400
• Hard - 600
• Very Hard - 1000
• Extreme - 2000
• Ultimate - 3000

---

Hints

1. N/A
2. Alt Text (Base64)
3. JS Auth - Look up atob
4. Caesar Cipher
5. Exif Data
6. Hex Editor -> OutGuess
7. Hex -> Binary
8. SQL Injection (OR)
9. Cookies / Serialization
10. DNS TXT Record
11. robots.txt
12. Hex (Reversed) -> Binary
13. RSA-Crack
14. XSS
15. XXE
16. Hex Editor / Strings Command
17. SQL Injection (UNION)
18. Brain F*ck
19. URL Manipulation
20. IHDR
21. Stack Smashing
22. RFC4229
23. SSRF
24. User-Agent
25. CVE-2021-3129
26. SSSS
27. Mass Assignment
28. Binary via colors?
29. dotenv
30. CVE-2021-21263
31. #544f41 = TOA
32. security.filesystem.nullbytes.php
33. 17 Mistakes Microsoft Made in the Xbox Security System
34. OR 1=1

---

CTFD Setup

• All challenges should be in dynamic point mode, but never lose more than 15% of their score.
• IE (A 1000 point question can only decay to 850)
• All hints should cost a max of 15% of the question
• Categories are Web / Steganography / "File/Text" / Cryptography / RE / Laravel

Thanks

• Sourcetoad for funding CTFd license
• Sourcetoad for giving 4 hours with all engineers for a challenge.
• We (Sourcetoad) may be hiring. Take a look!